Privacy Policy

EvoViral is operated by R7AD, a sole proprietorship in Markham, Ontario, Canada. R7AD is responsible for the personal information described in this policy. Privacy contact: our support desk.

• Account details — your email address and sign-in data. To create and secure your account.
• Connected account information — the social account(s) you connect on any supported platform (username, platform IDs, profile picture, connection status). To run automations on the account you choose.
• Automation content — the keywords, messages, links and posts you configure. To deliver the service you set up.
• Conversation data — comments and direct messages that interact with your automations, including the people who message you (username, message content, timestamps). To send your configured replies and power your automations and stats.
• Social performance metrics — aggregate views, reach, impressions, engagement and follower counts for the accounts you connect, read through the platform APIs only to show your Analytics page. Not linked to individual people and never used for advertising.
• Billing details — plan, payment status and receipts. Card numbers go directly to Stripe; we never see or store them.
• Pageview analytics — a cookieless, first-party count of page views (the day, the page path, the referring site’s hostname and a view total — no IP address, no identifier and no cookie). Only with your consent, to understand how the site is used.
• Technical logs — IP address, pages requested and delivery events from our providers. Security and keeping the service running.

We do not sell personal information and we do not use it for advertising or behavioural profiling. Beyond the sign-in session cookie and your theme preference, we set no cookies — see our Cookie Policy.

We process personal information to provide the service you ask for, to meet legal obligations, and — for optional marketing emails — only with your consent. You can withdraw consent at any time (see §7); withdrawing essentials means we can no longer run the service. Marketing emails are separate and optional, with one-click unsubscribe.

We use a small set of processors. They handle data only on our instructions. The full list, with each provider’s purpose and location, is on our Subprocessors.

• Supabase — database, file storage and sign-in.
• Netlify — application hosting and standard server logs.
• Stripe — payment processing and invoices.
• Zernio — the social-platform API engine that connects your accounts, delivers your comment replies, direct messages and WhatsApp answers, and reports their status. Zernio stores connection tokens for your connected accounts in order to run these functions.
• Resend — sending sign-in, confirmation and service emails.
• Google and Apple — optional sign-in providers. If you choose one, it confirms your email address to us and applies its own privacy terms to that sign-in.

We do not share personal information with anyone else except where the law requires it, or to protect rights, safety or security.

Inside EvoViral, access to personal information is limited to the people who run the service, and only where there is a genuine need — to operate, support or secure it, or to comply with the law. We never read your conversations for advertising, profiling or any purpose beyond running the service for you.

When you connect an Instagram, Facebook, TikTok, Threads, YouTube, X, Bluesky, Telegram, Google Business or WhatsApp account, we ask you to confirm in one recorded step that you own or are authorized to manage it, and you authorize EvoViral to read the comments, reviews, messages and publishing data addressed to that account and to send replies or publish on your behalf. We store that confirmation — the date, the wording you accepted and its fingerprint — so both of us can point to what was agreed.

For the conversations your automations handle, you are the controller of your customers’ information and we act as your processor: we handle it only to run the features you switch on, and never for our own purposes. Messages addressed to your connected accounts are stored to run your automations and show your stats; the text itself is never displayed in the app and is not included in exports.

Disconnect an account at any time on the Connections page — its access tokens are deleted from our engine immediately and no further comments or messages flow for it. Conversation data tied to a disconnected or deleted account is removed with it (see §9).

Some providers store or process information in the United States or other countries. We choose providers with established privacy and security programs, and we keep the data we send them to what the service needs. Where a transfer needs a safeguard, we rely on an appropriate transfer mechanism — for example the Standard Contractual Clauses or an approved adequacy framework — put in place with that provider.

You can ask us to:

• see the personal information we hold about you;
• correct anything that is wrong;
• delete your account and your information;
• withdraw consent or stop a use you no longer agree to;
• get a copy of your information in a portable format.

Two of these you can do yourself, instantly, in your account settings: download a portable copy of your account and workspace record, and delete your account and data. For everything else, use our support desk and we will act on it. We verify identity before acting so no one else can access your data, and we respond within the time the law allows — normally 30 days (California requests follow the separate timeline in §8). These rights apply to everyone who uses EvoViral, including users covered by the GDPR (EU/UK) and PIPEDA (Canada).

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). We have never done so, and there is nothing to opt out of.

We honour Global Privacy Control (GPC) signals. Because we sell and share to no one, a browser or extension that sends a GPC signal is respected automatically — the choice is already the default we apply — and we treat the signal as a valid opt-out wherever it is legally recognised.

To make a request under the CCPA/CPRA — to know what we hold (right to know), to delete it (right to delete), to correct it (right to correct), or to opt out — write to us through our support desk. Two of these you can also do yourself, instantly, in your account settings: download a portable copy of your account and workspace record, and delete your account and data.

We verify every request before we act. For most requests a signed-in request from your own account is enough; where we need more, we ask for information that confirms it is really you, and we use it only for that. You may use an authorized agent to make a request for you; we may ask the agent to show written permission signed by you, and we may still contact you to confirm you gave it.

We will not discriminate against you for exercising any of these rights: you keep the same service, the same price and the same quality. We respond to a verified request within 45 days, and if we need more time we tell you why and take up to a further 45 days.

We keep your information while your account is active. When you delete your account we remove or anonymize your personal information, except what we must keep for legal, tax and accounting records or to resolve disputes. Service event logs (for example, delivery attempts between the platforms and us) are deleted automatically after 30 days.

EvoViral is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16; if we learn we have, we delete it.

If we make material changes to this policy we will announce them in the app or by email before they take effect. Questions: contact our support desk.