ViralTree is a referral and waitlist service made by AiVanci Ltd, a company registered in England and Wales (company number 16823149, registered office Colony - Flint Glass Works, 64 Jersey Street, Manchester, England, M4 6JW). In this policy "we", "us" and "ViralTree" mean AiVanci Ltd. Questions and requests about personal data go to hello@viraltree.io.
This policy is written for three groups of people. Find your section.
| You are | Read |
|---|---|
| A visitor to viraltree.io | §1 and §5–§9 |
| An organiser who has an account and runs campaigns | §2 and §5–§9 |
| A participant who joined a campaign run by an organiser using ViralTree | §3 and §5–§9 |
1. Visitors to viraltree.io
What we collect. Server logs at our hosting provider record your IP address, browser type and the pages you request. We keep these for 30 days for security and to keep the site running.
Cookies and your choice. Essential cookies keep sign-in and your privacy choice working. We ask before loading Google Analytics on our website. You can allow or reject analytics, and change your choice with Cookie choices. Rejecting analytics does not affect your account or the service. We do not use advertising cookies.
Counting page views. We use Vercel Web Analytics for aggregate page counts. It sets no cookies and does not recognise you on later visits. If you allow analytics, we also use Google Analytics 4 to understand visits, traffic sources and completed account signups. It uses first-party analytics cookies (prefixed vt_ga4, up to one year). Your browser remembers your choice in vt_site_analytics for six months. A short-lived, server-owned vt_site_signup cookie (up to 30 minutes, only after analytics consent) lets us count a completed new account once without treating returning sign-ins as signups. Withdrawing consent stops our GA4 events and clears our GA4 cookies; it does not delete events already received by Google.
What we send to Google. Page views, campaign attribution parameters and a signup method such as email or Google. Dashboard and demo-claim URLs are reduced to generic page names. We do not send your email address, name, account or organisation identifiers, campaign names, form answers, sign-in codes, invite tokens or referral links. Google also receives technical information from your browser, such as browser/device details and your IP address while processing requests. Google Analytics is not loaded for our measurement on organisers’ campaign pages, private demo previews or administration pages. Advertising features and Google signals are disabled for this integration.
Lawful basis. Legitimate interest in running a secure website and aggregate page counting; consent for Google Analytics and its cookies. You can withdraw that consent at any time through Cookie choices.
2. Organisers (account holders)
When you create an account and run campaigns, we are the controller of your account data.
What we collect and why
| Data | Where it comes from | Why | Lawful basis |
|---|---|---|---|
| Email address, display name, sign-in identifier | Google sign-in or the email sign-in link you request | To create and secure your account, and to send you the service emails described below | Contract |
| Organisation name, workspace and campaign settings, brand assets you upload (logo, colours, copy) | You | To run your campaigns | Contract |
| Team invitations (the invitee's email) | You | To add members to your organisation | Contract, and our legitimate interest in letting teams work together |
| Billing status, plan, Stripe customer and subscription identifiers | Stripe, when you subscribe | To bill you and enforce plan limits | Contract |
| Payment card details | You, on Stripe's hosted checkout | To take payment | Contract. We never see or store card numbers. Stripe holds them. |
| Usage of the dashboard and API (requests, timestamps, IP addresses) | Your browser and API clients | Security, rate limiting, abuse prevention, diagnosing faults | Legitimate interest |
Service emails we send you. Sign-in links, team invitations, plan-limit warnings at 80% and 100%, billing receipts and failures, and notices about billing and plan changes. These are part of the service and cannot be switched off while you hold an account. We do not send marketing email to organisers without separate consent.
Sign-in providers. If you sign in with Google, Google tells us your email address and name and nothing else. We do not receive your Google password or access to your Google account beyond that.
Product analytics in the dashboard. Once you are signed in, we record which pages of the dashboard you open and which controls you use, tied to your account and your organisation, so we can see where the product is confusing and fix it. We use PostHog for this, on their EU servers. It runs only inside the signed-in product: never on the marketing pages, and never on the sign-up pages your participants see. We do not record your screen, and we do not use this data for advertising or share it with anyone. Ask us and we will exclude your account.
Lawful basis. Performing our contract with you, and our legitimate interest in improving the product.
3. Participants (people who joined an organiser's campaign)
If you joined a waitlist, referral programme or sign-up form on another company's website and that form was powered by ViralTree, that company (the "organiser") is the controller of your personal data. They decide what to ask you and what to do with your answers. ViralTree processes your data on their behalf as a processor, under a written agreement with them.
The organiser's privacy notice governs. The organiser should link their own privacy notice near the form. Questions about why you were asked for your data, or requests to see, correct or delete it, go to the organiser first. If you cannot reach them, contact us and we will help.
What ViralTree stores about participants. Only what the organiser's form collects, plus what the referral mechanism needs to work:
- Email address, and if the organiser asks for it, your name, phone number and answers to their custom questions.
- Your unique referral code and link, who referred you (if anyone), and who you have referred.
- The time you joined, whether you confirmed your email, and which milestones you have reached.
- Technical signals when you join and when someone follows your link: IP address, browser user agent, the page the link landed on, and click timestamps. These exist to detect fake referrals (for example the same browser signing up repeatedly through its own link). We do not build a browser fingerprint. We do not use these signals for advertising or profiling beyond fraud checks.
- If the organiser connects a payment or ticketing platform, a record that a person with your email address converted (bought a ticket, paid) so the organiser can reward the referrer. We store the fact of the conversion and an external reference, not the payment details.
Cookies and local storage set by the ViralTree script on the organiser's site. These are first-party cookies on the organiser's domain. They are strictly necessary for the referral mechanism and are not used to track you across other sites.
| Name | Purpose | Lifetime |
|---|---|---|
vt_aid | An anonymous random id so we can tell one browser's clicks from another's when scoring fraud | 365 days |
vt_ref (first and last) | Remembers whose referral link brought you to the site, so that person gets credit if you join | 90 days |
vt_pid | Remembers that you already joined, so the page can show you your own link instead of the form again | 365 days |
vt:* in localStorage | Mirrors referral and participant state for browsers that drop cookies quickly | Until you clear browser storage; these mirrors currently have no automatic expiry |
Confirmation email. If the organiser has turned on double opt-in, we send you one email with a confirmation link on the organiser's behalf. It contains no marketing.
What we do not do with participant data. We do not sell it, share it with other organisers, use it to train models, or contact you except as instructed by the organiser. There is no public leaderboard. The organiser can review attributed sign-ups and campaign results. The page-view counting described in section 1 is not run on campaign sign-up pages: we measure our own site, not the organiser's audience.
4. Where data is processed and who else touches it
Our servers run in London (Vercel, region lhr1). Our database and sign-in service run on Supabase in Dublin, Ireland (AWS eu-west-1). We use these sub-processors:
| Sub-processor | What they do for us | Location |
|---|---|---|
| Supabase, Inc. | Database and authentication | Ireland (AWS eu-west-1) |
| Vercel, Inc. | Hosting, application servers and cookieless page-view counts | London, with global edge for static assets |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments and subscriptions | Ireland / USA |
| Resend, Inc. | Sends confirmation and service emails | USA |
| PostHog, Inc. | Product analytics inside the signed-in dashboard (organisers only) | Germany (EU cloud) |
| Google LLC / Google Ireland Limited | Sign in with Google (organisers only); optional website analytics after consent | Ireland / USA |
Where a sub-processor is outside the UK, transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on an adequacy decision. We will update this table before adding a sub-processor and give organisers 30 days' notice under the Data Processing Agreement.
5. How long we keep data
| Data | Kept for |
|---|---|
| Organiser account and campaign data | While the account exists. Deleted within 30 days of the organisation being deleted. |
| Participant data | While the organiser keeps the campaign. Deleted when the organiser erases the participant or deletes the organisation. |
| Billing records | 6 years after the transaction, as UK tax law requires. Held at Stripe and in our invoices. |
| Server and security logs | 30 days |
| Google Analytics event and user-level data | 2 months in our GA4 property; aggregate reports may be retained longer. |
| Deletion audit records | Indefinitely, but they hold no personal data (a one-way hash of the email and the date). |
6. Your rights
Under UK GDPR and, where it applies, EU GDPR, you can ask to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent where consent was the basis. You can also complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
Organisers can do most of this themselves: export any campaign as a CSV, erase any participant from the participants page or through the API, and delete the whole organisation from the team page.
Participants should ask the organiser, who can erase you in one click. If you write to us instead, we will confirm which organiser holds your data and pass the request on, or act on it ourselves where the organiser cannot be reached.
We answer requests within one month.
7. Security
Data is encrypted in transit (TLS) and at rest by our sub-processors. Access to production data is limited to the people who run the service and is logged. API secret keys are stored hashed. Organisers are responsible for keeping their own sign-in and API keys private. If we discover a breach affecting your data we will tell affected organisers without undue delay and, where required, the ICO within 72 hours.
8. Children
ViralTree is not directed at children under 16. Organisers must not use it to collect data from children without a lawful basis of their own. If you believe we hold a child's data without such a basis, contact us and we will delete it.
9. Changes
We will post changes here and update the date at the top. For material changes affecting organisers we will email account holders at least 14 days before they take effect.