Privacy Policy
1. Information we collect
When you sign up and use Idea2Viral we collect:
- Account: email, name, hashed password — via Melyx SSO
- Billing info: handled by cart.melyx.id + Stripe / PayPal. We DO NOT store card numbers
- Content you create: ideas, scripts, uploaded audio, avatar images — stored on Melyx servers (Singapore / London)
- OAuth tokens for connected destinations (YouTube, TikTok, LinkedIn, Meta) — stored encrypted, used only to upload videos you explicitly publish
- YouTube channel info: channel ID, channel name, channel thumbnail returned by the YouTube Data API after you connect
- Usage data: quota consumed, credits spent, render duration, language selection
- Technical: IP, browser, request timestamps (for security + debugging)
2. YouTube API Services — specific notice
Idea2Viral uses YouTube API Services. By connecting a YouTube channel to Idea2Viral you agree to the YouTube Terms of Service and Google's Privacy Policy (https://policies.google.com/privacy).
Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Scopes we request and what we do with them:
| Scope | What we do with it |
|---|---|
youtube.upload | Upload the videos you generated in this app to your own channel — only when you click “Publish” or enable auto-publish in your workspace settings. |
youtube.readonly | Read your channel name + thumbnail to display in the workspace switcher and to confirm uploads land on the right channel; read public metadata of competitor videos you add to your watchlist. |
youtube.force-ssl (when bundled) | Set the title, description, tags and privacy state of the videos we upload, using values you provided. |
What we do NOT do:
- Read other users' channels, comments, subscriptions or watch history that you have not opted into watching.
- Modify or delete content we did not upload on your behalf.
- Sell or rent YouTube data to anyone.
- Use YouTube data to train AI models.
How to revoke access:
- Inside the app: Workspace settings → disconnect YouTube.
- From Google: https://myaccount.google.com/permissions or https://security.google.com/settings/security/permissions → revoke access to “Idea2Viral”.
Once you revoke access, the cached OAuth token and any cached YouTube channel metadata are automatically purged within 24 hours.
3. How we use information
- Operating and improving the Service
- Billing and renewing subscriptions
- Sending transactional email (payment confirmations, password resets, quota alerts)
- Fraud and abuse prevention
- Aggregate analytics (no personal identification)
- Uploading the videos you generated to a destination you authorized (YouTube, TikTok, Meta, LinkedIn)
4. How we share information (data processors)
We share minimally, only with these processors:
- OpenAI / Anthropic / Google Gemini (script generation): the text you enter is sent to the chosen provider's API; per their policies it is not used for training.
- fal.ai (voice clone, talking-head avatar, image-to-video): audio / images you upload are sent to fal.ai at render time.
- Microsoft Edge TTS: text is sent to Microsoft's API for voice synthesis.
- YouTube / TikTok / Meta / LinkedIn: only the videos and metadata you explicitly publish are sent.
- Cloudflare (CDN + DNS): MP4 files are delivered via Cloudflare.
- PayPal / Stripe: handle card data directly; we receive only the transaction outcome.
- Authorities: only when legally compelled (court order, subpoena).
We do NOT sell or rent your personal information to advertisers, data brokers, or any other third party for marketing.
5. Content you create
You retain 100% copyright. We hold only the technical license needed to run the platform (storing and displaying it inside your dashboard, and uploading on your request).
Files are auto-deleted per the retention window of your tier. You can manually delete anything anytime in the dashboard.
6. Voice clone & face clone
Audio and images you upload for voice clone / avatar are used ONLY to generate content for you. They are never used to train any public model.
You WARRANT that you have consent from the voice / image owner. Violations result in account termination + legal handover.
7. Cookies and similar technology
Idea2Viral uses cookies and similar storage on your device or browser for the following purposes:
| Cookie / storage | Type | Purpose | Lifetime |
|---|---|---|---|
PHPSESSID | First-party, strictly necessary | Keep you signed in for the current session | Session only |
iv_ws_id | First-party, preference | Remember which workspace you last opened | 30 days |
auth_token (auth.melyx.id) | First-party, strictly necessary | Single sign-on across Melyx apps | 30 days |
localStorage iv_ui_* | First-party, preference | Remember UI preferences (theme, sidebar collapsed) | Until you clear browser storage |
We do NOT load Google Analytics, Facebook Pixel, advertising trackers, or session-replay tools on the dashboard. We do NOT use cookies or similar technology to collect personal data on behalf of any third party.
You can clear cookies at any time via your browser settings; doing so will sign you out and reset your UI preferences.
8. Your rights
- Access and download all of your data (JSON export inside dashboard)
- Edit personal information
- Delete your account (GDPR-style right to be forgotten) — email support or use /data-deletion
- Opt out of marketing email (transactional email is mandatory)
- Lodge a complaint with your local data protection authority
9. Security
TLS 1.3 on every connection. bcrypt password hashing. Database access over a private network. OAuth tokens stored encrypted at rest. Encrypted daily backups, rotated 30 days. Security incidents disclosed within 72 hours per GDPR.
10. Changes to this policy
Material changes are notified by email at least 14 days before taking effect. The “Last updated” date at the top reflects the current version.
11. Contact
Data Protection Officer: [email protected]
For Google / YouTube data deletion requests, write to the same address with subject “YOUTUBE DATA DELETION”.