VB Viralbutler

Privacy Policy

Last updated: 13 October 2026. Deutsche Fassung

This policy explains which data Viralbutler collects, why we use it, who receives it, how long we keep it and how you can delete it. It applies to the website viralbutler.com and to the Viralbutler app.

1. Who we are

Viralbutler is operated by Neumann Marketing GmbH, Brachtstraße 22, 40223 Düsseldorf, Germany. Managing director: Artur Neumann. Commercial register: Amtsgericht Düsseldorf, HRB 107148. For privacy questions or complaints, write to an@viralbutler.com.

2. What Viralbutler does

Viralbutler is a content creation and publishing app for businesses and creators. You create or upload posts, review them and publish or schedule them to social media accounts that you connect yourself. Viralbutler only publishes to accounts you connected and only content you approved or scheduled. Access is currently by invitation (closed beta).

3. Data we collect

Account and workspace data

• name, email address, company or brand name and the settings you enter in your workspace
• content you provide: videos, images, audio, texts, captions and the drafts created from them
• publishing records: which content went to which account, when, the platform post ID, status and error messages

Data from connected platforms

When you connect an account, we receive and store the following data through the official platform APIs:

• Instagram (Instagram API with Instagram Login): account ID, username, name, profile picture, biography, website, metadata of recent posts and an access token.
• Facebook Pages (Facebook Login): your app-scoped Facebook user ID, the Pages you manage, and for the Page you select its ID, name, username, category, link, picture, tasks and access tokens.
• Threads: account ID, username, name, profile picture, biography and an access token.
• YouTube (YouTube API Services): channel ID, title, handle, URL, thumbnail, access and refresh tokens, and the IDs and status of videos you publish through Viralbutler.
• TikTok (Login Kit, Content Posting API): open ID, username, display name, avatar, creator settings (privacy options, interaction settings, maximum video length), tokens, and publish IDs and status.
• LinkedIn: member ID, name, email address, profile picture and tokens.
• X: user ID, username, name, profile image and tokens.

Optional comment automation: if you switch on automatic replies for your own account, we process comments and messages on that account (commenter ID, username, text) and the replies we send for you.

Technical data

• IP address, browser type, time and requested page in our server logs
• a session cookie that keeps you signed in; we do not use advertising cookies in the app
• on contact and booking forms: a bot check by Cloudflare Turnstile

4. How we use data

• to connect your accounts and show which account is connected
• to create drafts, previews, captions, images and videos from the content you provide
• to publish or schedule content you approved, and to show the publishing status
• to send automatic replies to comments or messages, only if you set this up for your own account
• for support, security, abuse prevention and error analysis

We do not sell personal data. We do not use data from connected platforms for advertising or for building user profiles. We do not use data from connected platforms to train AI models.

5. AI processing

To create drafts, captions, images, videos, voice-overs or transcripts, Viralbutler sends the content you provide (for example a video, transcript or prompt) to AI providers that process it for us: OpenAI, Anthropic, Google (Gemini), HeyGen, Kling AI and BytePlus. They return the result to Viralbutler. We do not send access tokens to AI providers. If you use comment automation, comment text may be sent to an AI provider to choose or draft the reply.

6. YouTube and Google user data

• Viralbutler uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.
• Viralbutler's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• We use Google user data only to provide the features you see in Viralbutler: identify your channel, upload the videos you approve with the title, description and visibility you set, and show their status. We do not transfer Google user data to AI providers or other third parties, except where needed to provide these features, for security, or to comply with law.
• You can revoke Viralbutler's access at any time: click "Disconnect" in Viralbutler, or remove Viralbutler at security.google.com/settings/security/permissions. When you disconnect in Viralbutler, we revoke the token at Google immediately and delete the stored channel data and tokens. If you revoke access in your Google account, we delete the stored YouTube data within 30 days.

7. Instagram, Facebook and Threads

You can disconnect an account in Viralbutler or remove Viralbutler in your Instagram, Facebook or Threads settings (Apps and websites). When you remove the app, Meta informs us and we delete the stored tokens and profile data of that account. You receive a confirmation code that you can check on our data deletion page.

8. Who receives data

• Hetzner Online GmbH (hosting, data centre in Nuremberg, Germany)
• the platforms you connect (Meta, Google/YouTube, TikTok, LinkedIn, X), when you publish or connect
• the AI providers listed in section 5, for the content you send for generation
• Cloudflare (bot protection on forms) and, if you buy a paid plan, Stripe (payments; we do not store card details)
• our own CRM system for contact requests and emails

Some providers are located outside the EU, for example in the USA. In these cases we rely on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or on standard contractual clauses.

9. Storage and security

Data is stored on our servers in Germany. Access tokens are stored encrypted. All connections use HTTPS. Only authorised staff can access the systems.

10. How long we keep data

• Tokens and profile data of a connected account: as long as the account is connected. When you disconnect or send a deletion request, we delete them immediately.
• Content and drafts: as long as your workspace exists. Published media files are archived or deleted automatically after publication.
• Publishing records (platform, post ID, time, status): as long as your workspace exists, to document what was published through your account. They are deleted with your workspace or on request.
• Server logs: for a short period for security and error analysis.
• Invoices and other records: as long as tax and commercial law require.

11. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection. If processing is based on consent, you can withdraw it at any time. You can complain to a data protection authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen. To use your rights, write to an@viralbutler.com.

12. Legal basis

We process data to provide the service you use (Art. 6(1)(b) GDPR), based on your consent where we ask for it (Art. 6(1)(a) GDPR), and based on our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR).

13. Deleting your data

See our data deletion page for all options. We complete deletion requests within 7 days.

14. Changes

We update this policy when Viralbutler changes. If we want to use your data in a new way, we inform you and ask for your consent before we do so.