Privacy Policy

Last updated: October 27, 2026

This policy explains what personal data ViralSwap handles, why, and the rights you have. It covers our website, the ViralSwap app for Mac and our license server.

In short

• Your reels, videos, photos and characters stay on your Mac. The app makes the videos there, and we never receive them.
• Our server knows little: who you are on Whop (your Whop ID, name and e-mail address), your ViralSwap plan, which Mac it runs on, and how many videos you start each day.
• Whop handles payments. We never see your card details.
• Higgsfield, Anthropic (Claude) and HikerAPI receive what the app sends them through your own accounts, under their own privacy policies.
• Error reports reach us only if you choose to send one, and never contain videos or pictures.
• No ads, no tracking, no selling of data.

1. Who is responsible

The controller of your personal data is Vincent Dottai, who runs the sole proprietorship Vincent Dottai Marketing JDG, Ostrzycka 1/3, 82, 04-035 Warszawa, Poland, tax ID (NIP) 1133213907 ("we", "us"). Write to us about privacy at support@viralswap.io. We haven't appointed a data protection officer.

2. What stays on your Mac

The app does its work on your Mac and keeps its data there:

• the reels you add or download, the work files of each video (frames, transcripts, Claude's plan, start images, renders) and the finished videos;
• your characters: their photos, your confirmation of who the person is, Claude's description, the character pictures and the face measurements;
• your settings, the app's log file and the license pass from our server;
• in the macOS Keychain: your ViralSwap session and, if you added one, your HikerAPI key. The Higgsfield tool and Claude Code keep their own sign-ins.

To check that all photos of a character show the same person, to compare a new character with its photos and to check the faces in finished videos, the app measures faces on your Mac. These measurements don't leave your Mac. The app refuses and deletes character photos of anyone who may be under 18.

We can't see or access any of this data. You can delete a character in the app. To remove everything, delete the folders ~/Library/Application Support/ViralSwap and ~/Library/Logs/ViralSwap, the videos you saved in Movies › ViralSwap, and the "ViralSwap" items in the Keychain. Deleting the app alone doesn't remove them.

Photos of other people. If you create a character of someone else, you decide what happens to their photos and data, so you're responsible for it under data protection law: tell them how their photos are used, keep their written permission, and delete the character if they ask you to.

3. What the app sends to other companies, with your accounts

To make your videos, the app sends data from your Mac to these companies, using your own accounts with them. They handle it under their own terms and privacy policies. We don't receive it.

• Higgsfield: the photos you choose for a new character (up to 20), to train it, and for each video the prompts, reference pictures and parts of the reel that Higgsfield needs to make it.
• Anthropic (Claude), through Claude Code: pictures from your reels (single frames and contact sheets), transcripts of what is said in them, contact sheets of your character photos, and our instructions. When you use Ask Claude on a video, also that video's plan, face-check pictures and scores, start image, error, settings, and frames of the original and the result. If you use a Claude consumer plan such as Pro or Max, Anthropic's consumer terms apply, including your choice whether Anthropic may use your chats and coding sessions to improve its models; you'll find it in Claude's privacy settings.
• HikerAPI: the Instagram links and @handles you paste, with your key. The reels are then downloaded to your Mac.
• During setup, the app downloads speech and face models from Hugging Face and installs Claude Code from Anthropic. Like any download, this shows them your IP address.
• Whop: you sign in with Whop in your browser, on whop.com, and Manage subscription opens Whop's billing page.

4. What we receive, why, and for how long

Your Whop account and subscription

• What: your Whop user ID, name and e-mail address, which Whop shares with us when you sign in with Whop (you approve this on Whop's screen) or when we read your subscription from Whop. For each ViralSwap subscription: the plan, billing period, status, renewal or end date, whether you've canceled, the link to its billing page on Whop, and whether a payment was fully refunded. We don't receive your card details, and we don't store your billing address or payment history.
• Why: to unlock the app for your plan, to show your plan and renewal date in the app, and to contact you about your subscription.
• Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
• How long: while you have a subscription, and 12 months after your last one ends.

Your Macs

• What: your Mac's name as set in macOS (it often contains your first name), an ID derived one-way from your Mac's hardware ID (we never receive the hardware ID itself), when each Mac signed in and when it was last seen (to the hour), and when a subscription moved from one Mac to another.
• Why: to keep each subscription on one Mac, to apply the move limit (3 moves in 30 days), and to show you where ViralSwap is active.
• Legal basis: performing our contract.
• How long: the Mac a subscription runs on, as long as we keep the subscription (above); a Mac's sign-in, until 90 days after it was signed out or replaced; moves, 30 days.

Videos you start

• What: how many videos you start each day for each subscription, with a random ID for each video so that it counts only once. No titles, files or content.
• Why: the daily limits of Beginner and Pro.
• Legal basis: performing our contract.
• How long: 90 days.

Sign-ins

• What: while you sign in with Whop, our server keeps what it needs to finish the sign-in safely: your Whop ID, name and e-mail address, your Mac's ID and name, and one-time codes. Whop's own sign-in tokens are revoked right away; we never keep them. Your ViralSwap session token stays in your Mac's Keychain; our server keeps only a one-way hash of it.
• Why and legal basis: to sign you in securely, as part of performing our contract.
• How long: the sign-in data is deleted within 2 days.

Technical data

• What: your IP address and the usual technical details of a request, such as its time and the address requested. We use IP addresses to limit how often sign-ins and license-key checks can be tried. Our hosting provider, Cloudflare, processes this data to deliver and protect our website and server, and keeps short logs of requests and errors for us.
• Why: security, preventing abuse and fixing problems.
• Legal basis: our legitimate interest in keeping ViralSwap secure and working (Art. 6(1)(f) GDPR).
• How long: IP addresses used for limits, within 2 days; logs, up to 7 days.

Error reports, only if you send one

• What: when a video fails, you can choose to send us an error report. You see the whole report before you send it. It contains the error text (with your Mac's user folder replaced by ~), the step that failed, when it happened (with your time zone), the versions of the app and its engine, macOS, Claude Code and the Higgsfield tool, the type of chip in your Mac, and facts about the video: resolution, length, aspect ratio, whether it had speech, and whether the start image and the render were paid for. No videos, pictures or faces. Error texts can contain file names.
• Why: to find and fix bugs.
• Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by asking us to delete your reports.
• How long: until the bug is fixed, and at most 12 months.

E-mails with us

• What: your messages, your e-mail address and name, and what we need to help you, such as your Whop ID.
• Why: support, complaints, withdrawals and refunds.
• Legal basis: performing our contract and our legal duties for complaints and withdrawals (Art. 6(1)(b) and (c) GDPR); for other questions, our legitimate interest in answering them (Art. 6(1)(f) GDPR).
• How long: up to 3 years after the matter is closed.

Payment records for tax and accounting

• What: Whop's reports of the payments for ViralSwap, which can include your name, e-mail address and country, the amount and the tax.
• Why and legal basis: our duties under Polish tax and accounting law (Art. 6(1)(c) GDPR).
• How long: as long as that law requires, usually 5 years from the end of the year in which the tax was due.

Keeping data for legal claims

We may keep data longer than stated above if we need it to establish, exercise or defend a legal claim, until the claim is settled (our legitimate interest, Art. 6(1)(f) GDPR).

5. Who else gets data

• Cloudflare hosts our website and license server and stores its database, as our processor under its data processing terms.
• Whop handles your payments and your Whop account under its own privacy policy, as a separate controller. We receive the data in section 4 from Whop and don't send Whop data about you.
• Our e-mail provider stores the e-mails we exchange with you, as our processor.
• Accountants, tax advisers and lawyers, when we need their help.
• Authorities and courts, when the law requires it.
• A buyer of ViralSwap, if we sell the business. The buyer must keep to this policy.

We don't sell or rent personal data, and we don't share it for advertising.

6. Data outside the EU and the EEA

Cloudflare and Whop are US companies. Our database is located in Europe, but Cloudflare can process requests in its data centers around the world, including in the US. Transfers to Cloudflare are covered by the EU-US Data Privacy Framework and by the EU Standard Contractual Clauses in Cloudflare's data processing terms. If our e-mail provider processes data outside the EEA, it does so under an adequacy decision or the EU Standard Contractual Clauses. The data you give Whop goes to the US under Whop's privacy policy.

7. Your rights

Under the GDPR you have the right to:

• get a copy of your data and information about how we use it;
• have wrong data corrected;
• have your data deleted, or its use restricted;
• receive the data you gave us in a common, machine-readable format, and have it sent to someone else;
• object at any time to our use of your data that is based on our legitimate interests;
• withdraw your consent at any time (for error reports), without affecting what we did before;
• complain to a data protection authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in the country where you live or work.

To use your rights, write to support@viralswap.io, if possible from the e-mail address of your Whop account so that we can check it's you. We answer within one month; if a request is complex, we may need up to two more months, and we'll tell you. If you ask us to delete your account data while you still have a subscription, the app can no longer check your plan, so end the subscription first. Whop keeps its own records; ask Whop about those.

Do you have to give us data? To use ViralSwap you sign in with Whop, so that our server can check your plan; without that, the app doesn't work. Error reports are always optional.

Automated decisions. Our server applies your plan's rules automatically: whether you have an active plan, the one-Mac rule, the move limit and Pro's daily limit. That's how your contract works. If you think a decision is wrong, write to us and a person will look at it. We don't profile you and don't show you ads.

8. Security

All connections to our server are encrypted (HTTPS). Our server stores only one-way hashes of session tokens and one-time codes. A sign-in can only be completed on the Mac that started it, and Whop's sign-in tokens are revoked right away. The pass that lets the app work offline is signed by our server, so it can't be faked. We keep the data we receive to a minimum.

9. Children

ViralSwap is only for adults (18 and over). We don't knowingly collect data about children. The app refuses character photos of anyone who may be under 18.

10. Our website

Our own pages use no cookies, no analytics or tracking tools, and no third-party scripts or fonts. Cloudflare processes your IP address and request details to deliver and protect them (section 4). The buy buttons take you to Whop's checkout on whop.com, where Whop's privacy policy and cookie rules apply.

11. Changes to this policy

We update this policy when ViralSwap or the law changes; the date at the top shows the current version. We e-mail you about important changes before they take effect.

12. Contact

Vincent Dottai Marketing JDG, Ostrzycka 1/3, 82, 04-035 Warszawa, Poland. E-mail: support@viralswap.io.