Privacy Policy

This Privacy Policy explains which personal data we process when you use our website startviral.de, our customer platform app.startviral.de, and our services, for what purposes we process it, and what rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Startviral UG (haftungsbeschränkt)
Kollwitzstraße 76
10435 Berlin
Germany

Represented by the managing director: Nils Spölgen
Email: support@startviral.de

2. Data transfers to third countries

Some of the service providers we use are based in the USA or process data there. Transfers to third countries only take place if the requirements of Art. 44 et seq. GDPR are met — in particular on the basis of the provider’s certification under the EU-U.S. Data Privacy Framework (DPF) or the EU Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). We indicate the respective basis for each service below.

3. Hosting and server log files

Our website and customer platform are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA take place on that basis. We have concluded a data processing agreement with Vercel.

When you visit our pages, information is automatically processed in server log files: IP address, date and time of access, page accessed, referrer URL, browser type and version, and operating system. This data is technically required to provide, stabilize, and secure the website. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Log files are deleted after no more than 30 days unless retention is required for security reasons.

4. Registration and customer account

When you register at app.startviral.de, we process the data you provide: name, email address, password (stored in encrypted form), Instagram username, and details of your chosen plan. This processing serves to provide your customer account and to perform the contract (Art. 6(1)(b) GDPR). The data is deleted when you delete your account, unless statutory retention obligations apply.

5. Provision of our services (Creator Ads)

To run your campaigns, we process your Instagram username, publicly accessible content of your Instagram profile (e.g. posts, reels, stories), and campaign and performance data. We do not require or obtain access to your Instagram account.

Ads are delivered via the Ads Manager of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”). In doing so, we create audiences (e.g. custom audiences and lookalike audiences) to show your content to suitable users. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in effective campaign management (Art. 6(1)(f) GDPR). Meta’s privacy policy additionally applies to processing by Meta: https://www.facebook.com/privacy/policy/

6. Payment processing (Stripe)

We use Stripe for payment processing. The provider for customers in the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; data may be transferred to Stripe, Inc. in the USA (DPF-certified). Stripe processes the data required for payment (e.g. name, email address, payment method, billing data), in part as an independent controller, particularly for fraud prevention and to fulfill its own legal obligations. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). More information: https://stripe.com/privacy

7. Contact and customer support

When you contact us (e.g. by email to support@startviral.de or via the contact form), we process your details to handle your request. The legal basis is Art. 6(1)(b) GDPR (contractual or pre-contractual communication) or Art. 6(1)(f) GDPR (other inquiries).

To organize our support, we use the platform Front (FrontApp, Inc., 100 Montgomery St, San Francisco, CA 94104, USA) as a processor. We delete inquiries once they are no longer required; statutory retention obligations remain unaffected.

8. Email communication and newsletter

For our email communication — including transactional emails such as registration confirmations, invoices, and service information — we use Google Workspace provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor. Data may be transferred to Google LLC in the USA (certified under the EU-U.S. Data Privacy Framework).

We send transactional emails on the basis of Art. 6(1)(b) GDPR. We send newsletters only with your consent (Art. 6(1)(a) GDPR) or — to existing customers for our own similar services — on the basis of Section 7(3) of the German Act Against Unfair Competition (UWG) in conjunction with Art. 6(1)(f) GDPR. You can unsubscribe at any time via the link in every email or withdraw your consent with effect for the future.

Our emails may record open and click rates for performance measurement. You can object to this at any time by unsubscribing.

9. Cookies and consent

We use cookies and similar technologies. We use strictly necessary cookies (e.g. for login and session functions) on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(f) GDPR. We only set non-essential cookies — in particular for analytics and marketing — with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you give via our consent banner.

You can withdraw or adjust your consent at any time with effect for the future: via the “Cookie settings” link in the footer of this website. You can also delete or block cookies in your browser settings.

10. Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager manages and deploys website tags and does not itself set cookies for analytics or marketing purposes; however, it triggers other tags that may collect data. Those tags are only loaded in accordance with the choices you make in the consent banner.

11. Google Analytics 4

With your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), we use Google Analytics 4, a web analytics service provided by Google Ireland Limited. Google Analytics uses cookies and similar technologies to analyze your use of our website (e.g. pages visited, session duration, approximate location, device used). Google Analytics 4 does not store IP addresses; they are only used for coarse geolocation and then discarded.

Data may be transferred to Google LLC in the USA (DPF-certified). The retention period we have configured for user-level data is 14 months. You can withdraw your consent at any time via the cookie settings. More information: https://policies.google.com/privacy

12. Meta Pixel

With your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), we use the Meta Pixel provided by Meta Platforms Ireland Limited. It enables us to show interest-based ads on Facebook and Instagram to visitors of our website, measure the performance of our ad campaigns (conversion tracking), and build audiences for advertising. Data collected includes your IP address, device information, and your behavior on our website; if you are logged in to Meta, Meta may link your visit to your account.

We and Meta are joint controllers for the collection and transmission of this data (Art. 26 GDPR); the key terms are set out in Meta’s Controller Addendum: https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent processing. Data may be transferred to Meta Platforms, Inc. in the USA (DPF-certified). You can withdraw your consent at any time via the cookie settings; you can also manage personalized advertising at https://www.facebook.com/adpreferences.

13. Google Ads conversion tracking

With your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), we use Google Ads conversion tracking (Google Ireland Limited). If you reach our website via a Google ad, a cookie is set that allows us to measure whether certain actions (e.g. a registration) resulted from the ad. We only receive statistical evaluations without identifying individual persons. Conversion cookies typically expire after 30 to 90 days. You can withdraw your consent at any time via the cookie settings.

14. Retention periods

Unless stated otherwise in this Privacy Policy, we delete personal data as soon as it is no longer required for the stated purposes and no statutory retention obligations (e.g. commercial or tax law periods of up to 10 years) apply. Where such obligations apply, processing is restricted instead.

15. Your rights

As a data subject, you have the following rights:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. You may object to processing for direct marketing purposes at any time without stating reasons.

To exercise your rights, simply email support@startviral.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit); you may also contact the authority at your habitual place of residence.

16. Obligation to provide data

You are neither legally nor contractually obliged to provide your data. However, without the data required for registration, payment, and campaign delivery, we cannot provide our services.

17. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

18. Changes to this Privacy Policy

We update this Privacy Policy when our processing activities or the legal situation change. The current version published on this page applies.