Privacy, without the fine-print fog.

This policy explains how AIViral processes personal data in three situations: when a business registers as a customer and buys hot leads, when a prospect responds to outreach we run on behalf of a customer and becomes a lead, and when someone visits our own website.

AIViral is a business-to-business service. The prospects we contact are contacted in their professional capacity, and the leads we deliver contain business contact details — not consumer data.

Lead data. When a prospect responds to one of our campaigns, the record can include the business contact details the person shared (typically name, work email, phone number, company and role), the content of their response, the campaign and channel it came from, country or region, and our team's assessment of how hot the lead is.

Account data. For customers we process business contact details, account credentials, company information, billing details, support conversations and targeting preferences.

Technical data. Like any online service we process IP addresses, device and browser information, log entries and similar records needed to run, secure and debug the service. Non-essential cookies or similar technologies are used only in line with applicable notice and choice requirements.

We process lead data to qualify responses, assess how hot each lead is, match leads with the right customer, deliver them to that customer's dashboard, calculate charges, detect fraud and keep an audit trail of each delivery.

We process account data to provide the service, invoice customers, provide support and meet legal and accounting obligations. Technical data is used for security, abuse prevention and service reliability.

We do not use lead contact data to market to those individuals for our own purposes, and we do not sell lead data to anyone other than the single customer the lead is delivered to.

Our outreach is directed at businesses, in a professional context, and is tailored to the recipient's role and company. Where the law requires a lawful basis for this processing, we rely on legitimate interest — connecting businesses with services plausibly relevant to them — balanced against the recipient's rights, or on another basis where required by local law.

Every outreach message identifies who is contacting them and why, and every recipient can opt out at any time. Opt-outs are honored immediately and suppressed across all current and future campaigns.

The customer. A lead's contact details are delivered to exactly one customer — the business whose campaign the prospect responded to. Leads are never sold to multiple buyers and never published.

Service providers. We use a limited set of providers for hosting, security, payments and support. They process data on our instructions, under contract, and may not use it for their own purposes.

Authorities. We may disclose data where the law requires it, and we assess such requests carefully before responding.

Customers who receive a lead become responsible for their own subsequent use. They may use the data only to follow up on the expressed interest, and may not resell it or share it onward.

Lead records are kept for the time needed to complete delivery, settle payment, handle disputes and maintain the audit trail, and are then deleted or de-identified. Aggregated, non-identifying campaign statistics may be retained in a form that cannot be linked back to an individual.

Account and billing records are kept for as long as the account is active and thereafter for the period required by accounting and tax law. Technical logs are rotated on a short cycle. When a customer closes their account, associated personal data is deleted or anonymized within a reasonable period, except where we must retain it for legal reasons.

The service is global: a prospect in one country may be delivered as a lead to a business in another. Where personal data is transferred across borders, we rely on the transfer mechanisms recognized by applicable law — such as adequacy decisions or standard contractual clauses — and assess supplementary measures where required.

Depending on where you live, you may have the right to access your data, correct it, have it deleted, restrict or object to processing, receive a portable copy, and withdraw consent at any time. Withdrawing consent does not affect processing that already happened lawfully.

If you received outreach from us or were delivered as a lead, contact us at support@aiviral.com and we will handle your request — including deletion and suppression from future campaigns. If your data was delivered to a customer, we will coordinate with them so your request is honored through the chain.

You always have the right to complain to your local data protection authority.

The service is not directed at children and processes business contact data only. We do not knowingly collect children's data or special-category data (such as health, political opinions or biometric data); records identified as such are deleted.

We may update this policy as the service evolves. Material changes are dated on this page and, where required, communicated to account holders in advance. The version published here is the one that applies.

Questions, requests and complaints can be sent to Ai Viral Sweden AB at support@aiviral.com. The Swedish Authority for Privacy Protection (IMY) is our lead supervisory authority. Related reading: our GDPR overview, security practices and terms of service.