ViralTree Terms of Service

These terms are a contract between AiVanci Ltd (England and Wales, company number 16823149, registered office Colony - Flint Glass Works, 64 Jersey Street, Manchester, England, M4 6JW; "ViralTree", "we", "us") and the organisation or person who creates a ViralTree account ("you", the "Customer"). By creating an account, or by clicking to accept, you agree to them. If you are accepting on behalf of a company, you confirm you have authority to bind it.

Schedule 1 (the Data Processing Agreement) is part of these terms and applies whenever you use ViralTree to collect personal data from other people.

1. What ViralTree is

ViralTree lets you run referral campaigns, waitlists and sign-up forms on your own website, through a script you install and a dashboard you manage at viraltree.io. People who join your campaign ("Participants") get a personal link, and ViralTree counts who they bring in.

2. Your account

• You must be at least 18 and give accurate account details.
• You are responsible for everything done through your account and your API keys. Keep them secret. Tell us at once if you think a key or sign-in has been compromised.
• One organisation may have several members. The owner is responsible for the members they invite.

3. Your responsibilities as a controller of Participant data

This is the clause that matters most. You decide what to collect from Participants and why. That makes you the data controller and us your processor. In particular you must:

1. Have your own privacy notice and show it, or a link to it, wherever a Participant gives you their data. The ViralTree script provides a consent-notice element (data-vt-notice) and the campaign builder takes a terms link for this purpose, but the content of the notice is yours.
2. Have a lawful basis for collecting and using each piece of Participant data, and for any marketing you send them afterwards. Turn on double opt-in where your basis is consent.
3. Handle Participant rights requests (access, deletion, objection). The dashboard and API let you erase any Participant at once. We will forward any request that reaches us directly to you.
4. Comply with the law that applies to you, including UK GDPR, EU GDPR, PECR and the equivalent rules in any country where your Participants live, and the rules of any platform you connect (for example Stripe, Eventbrite).
5. Not collect special-category data (health, religion, sexual orientation and the like), payment card numbers, or government identifiers through campaign questions.
6. Not collect data from children under 16 unless you have a lawful basis of your own and tell us.

We provide the tool, the Data Processing Agreement in Schedule 1, and the deletion and export functions. We do not provide legal advice, and we are not responsible for your compliance with data protection law in how you use the data you collect. If a regulator or Participant brings a claim against us because of something you did or failed to do under this clause, you will cover our reasonable costs.

4. Acceptable use

You must not use ViralTree to:

• send or cause unsolicited bulk email or messages, or add people to lists without their agreement;
• create fake Participants, referrals or conversions, or reward yourself through your own links;
• run campaigns for illegal goods or services, or content that is defamatory, hateful, or infringes someone else's rights;
• probe, overload or interfere with the service, or bypass plan limits or rate limits;
• resell access to ViralTree, or use it to build a competing referral product.

We may suspend a campaign or account that breaks this clause. We will tell you why and, where the problem can be fixed, give you the chance to fix it first.

5. Plans, limits and fees

Organisations on the pay-to-publish plans. You may create and edit drafts, preview a CSV, and save an attested audience to a draft without payment. Publishing a campaign and accepting public sign-ups require an active paid subscription. Returning from checkout alone does not activate a campaign; the first subscription payment must be confirmed. An incomplete first payment leaves the campaign in draft and can be retried.

The monthly base prices are Starter £29 for up to 1,000 stored audience records, Growth £49 for up to 3,000, and Scale £89 for up to 10,000. These are the new plans offered at launch; a larger arrangement requires a separate quote. We count stored audience records across all of your organisation's workspaces. One person in several campaigns in the same workspace uses one slot; the same address in two workspaces uses two. Imported records count, even if they are not enrolled in a campaign. Counts do not reset monthly or per campaign. Genuine deletion releases capacity. You may choose an intended plan to set the capacity of your unpaid draft audience; choosing it alone does not create a subscription or charge. A save or import above the selected cap is refused in full. There is no automatic paid plan change when capacity is reached; you must choose and authorise a higher plan.

The checkout shows the total payable, including any applicable tax, before you pay. Tax may vary with your location, customer status and the seller's obligations. Stripe handles your payment details; ViralTree does not store raw card numbers. An owner can manage the subscription and payment method in billing controls. Cancellation is effective at the end of the paid period, when new collection and publishing pause; your historical data and exports remain available. A failed renewal starts a seven-calendar-day recovery period: existing live campaigns may continue collecting within paid capacity, while new publishing and imports pause. If the invoice remains unpaid after that period, new collection also pauses. The owner can use the billing recovery route to pay the outstanding invoice. Recovery restores eligible collection without a retroactive charge for the paused time.

Cancelling future renewal is a separate action. This voluntary policy does not limit any statutory rights. We will give at least 30 days' notice before changing the price of an existing subscription.

Existing legacy subscriptions and accounts. Existing paid customers keep their contracted price and terms unless they agree to a migration or receive a clearly notified renewal arrangement. Existing live free campaigns continue under their current arrangement during the notified transition period. No saved card, prior Starter authorisation, or existing free account is charged or moved to a new paid plan simply because these new plans are offered. Historical annual and Max subscriptions, where present, continue under their own agreed terms. We will notify affected owners before a legacy arrangement changes.

6. Your content and data

• You own it. Your campaign copy, brand assets and Participant data are yours. You give us a licence to host, process and display them only as needed to run the service for you.
• Export. You can export any campaign as a CSV at any time, on every plan.
• Deletion. When you delete your organisation, we delete all of its data within 30 days, except records we must keep for tax or legal reasons and audit entries that contain no personal data.
• Feedback you give us about the product may be used freely.

7. Our service and its limits

• We aim for the service to be available and working, but we do not promise uninterrupted availability and no plan carries a service-level agreement.
• We may change or retire features. We will give reasonable notice for anything that affects a running campaign.
• The service is provided "as is". To the extent the law allows, we exclude implied warranties.
• Liability. Nothing in these terms limits liability for death, personal injury, fraud, or anything else that cannot be limited by law. Otherwise, our total liability to you in any 12 months is capped at the fees you paid us in those 12 months (or £100 if you have paid no fees), and we are not liable for lost profits, lost data that you could have exported, or indirect loss. Referral and fraud scoring is a best effort; we are not liable for a reward you choose to pay on a referral that later proves false.

8. Third-party services

Stripe, Google sign-in, ticketing platforms and anything else you connect are governed by their own terms. We are not responsible for them. If a third-party platform changes its API, an integration may stop working until we update it.

9. Suspension and termination

• You can close your account at any time from the team page.
• We may suspend or close your account for breach of clauses 3 or 4, for non-payment, or if required by law. Except in urgent cases we will warn you first.
• On termination, clause 6 (deletion and export) applies. Clauses 3, 6, 7 and 11 survive.

10. Changes to these terms

We will email account holders at least 14 days before a material change. Continuing to use the service after the date given means you accept the new terms. If you do not, close your account before that date.

11. General

• These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Consumers in the EU keep any mandatory protections of their own country.
• If any clause is found invalid, the rest stand.
• These terms, the Privacy Policy and Schedule 1 are the whole agreement between us about ViralTree.
• Notices to us: hello@viraltree.io. Notices to you: the owner's account email.

Schedule 1: Data Processing Agreement

This schedule applies to personal data of Participants that ViralTree processes on the Customer's behalf ("Customer Data"). Terms have the meanings in UK GDPR.

1. Roles. The Customer is the controller. ViralTree is the processor.

2. Details of processing.

3. Instructions. ViralTree processes Customer Data only on the Customer's documented instructions, which are these terms, the campaign settings the Customer chooses in the dashboard, and the API calls the Customer makes. ViralTree will tell the Customer if it believes an instruction breaks data protection law.

4. Confidentiality. People with access to Customer Data are bound by confidentiality obligations.

5. Security. ViralTree applies the measures in the Privacy Policy §7: encryption in transit and at rest, access limited to staff who run the service, hashed API secrets, logged production access.

6. Sub-processors. The Customer authorises the sub-processors listed in the Privacy Policy §4. ViralTree will give 30 days' notice by email before adding or replacing one. If the Customer objects on reasonable data-protection grounds and no fix is found, the Customer may terminate and receive a pro-rata refund of prepaid fees. ViralTree remains liable for its sub-processors' performance.

7. Data subject rights. ViralTree provides the participant erase function in the dashboard and the DELETE /api/v1/participants endpoint, and CSV export, so the Customer can meet access, portability and deletion requests itself. ViralTree forwards any request it receives directly to the Customer within 5 working days and helps where the tooling is not enough.

8. Breach. ViralTree notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information the Customer needs to notify its regulator.

9. Assistance. ViralTree gives the Customer reasonable help with data protection impact assessments and regulator consultations concerning the processing, and may charge for anything beyond what the product already provides.

10. Deletion and return. On termination, the Customer may export Customer Data. ViralTree deletes Customer Data within 30 days of the organisation being deleted, save for records law requires it to keep.

11. Audit. Once a year, on 30 days' notice, ViralTree will answer the Customer's reasonable written security questions and provide available third-party reports for its sub-processors. On-site audits only where a regulator requires one.

12. International transfers. Transfers outside the UK take place only to the sub-processors in §4 of the Privacy Policy, under the UK IDTA or Addendum, or an adequacy decision.

13. Liability. Liability under this schedule is subject to clause 7 of the terms.