Updated 29 October 2026. This notice explains how SeedViral uses personal information when you browse, create an account, subscribe and generate videos.
Who operates SeedViral
SeedViral is an AppAgentic product. Contact us through Support.
What we use and why
To provide your account and requested work, we use account identifiers and email, saved series and briefs, uploaded audio, generated assets, schedules, credit and subscription records, and support requests. These are used to deliver the service you request. When you use the features that need them, we also use the pictures, videos, songs and speech you upload or record, the transcripts made from them, and what we make from them for you: presenter portraits, narration, clips, music videos and changed voices. If you cancel a subscription, the reason you pick and any note you write are kept with that subscription and shared with Stripe, our payment provider, so we can understand why people leave. You can explore a browser draft without creating an account.
We use limited service logs and job/payment identifiers to secure the service, prevent duplicate purchases and posts, resolve failures, and investigate misuse. Billing and audit records may also be kept to meet legal obligations. We also measure how the product and our advertising perform, as described under Measurement below.
Legal bases
We use your information to perform our contract with you (your account, the videos and other work you ask for, billing and support); to meet legal obligations (tax, accounting and responding to lawful requests); for our legitimate interests in securing SeedViral, preventing fraud and misuse, handling rights complaints, and measuring and improving the product and our advertising, which you can opt out of as described below; and, for your face and voice, your explicit consent, given in the release you sign. You can withdraw that consent at any time.
Providers and connected accounts
The services used depend on the features enabled and the work you request:
- Google Cloud and Firebase provide hosting, sign-in, account records and private media storage. Google Workspace handles support email.
- AI service providers process briefs, scripts and other text you give us, prompts, reference pictures, narration text, transcripts of uploaded speech, songs and videos, and, if you set them up, your voice sample and face picture, to write scripts, draw pictures, record narration, animate presenters and openings, transcribe audio and make the media you request.
- Stripe handles hosted checkout, subscriptions and billing information through Stripe Managed Payments, where Onelink by Stripe is the merchant of record for the payment. SeedViral stores payment references, not full card details.
- Cloudflare, and Resend as a backup, process recipient addresses and message content to deliver account notifications, invitations and the reminder emails described below.
- Gleap receives support emails forwarded from our support address, including the sender, message and any attachments.
- AppRefer also runs our support chat. Its chat button loads on our pages once the page is idle (never on checkout pages) and keeps a random support session ID in your browser storage (no cookies). When you open the chat or write to us, AppRefer receives your browser language, the page you write from and, when you are signed in, your account ID, email and name, plus the messages and photos you send. Replies may come from an AI assistant, labelled as AI, which hands the conversation to our team when needed. The chat does not record your screen or the other pages you visit.
- AppRefer, our attribution service, processes advertising click information, sign-up, trial-start and checkout-start facts, payment facts, a hashed (SHA-256) copy of your email and account ID, a hashed country, hashed billing name and address details from a first purchase, and Meta's browser cookie ID to measure which ads lead to sign-ups and purchases, as described below.
- Microsoft Clarity runs in your browser, where measurement is enabled, to record how pages are used for session recordings and heatmaps: clicks, taps, scrolling, mouse movement and the pages as they appear, with what you type into form fields masked, plus your browser, device and approximate location. It respects the opt-outs below and uses its own cookies only where allowed. Microsoft processes this under its privacy statement.
- Meta receives page views and setup views from its pixel in your browser (with your hashed email and account ID once you are signed in), and ad-click, sign-up, trial-start, checkout and purchase facts with a hashed (SHA-256) email, hashed billing details and its browser cookie ID from AppRefer, to measure our advertising, as described below.
Providers can process data outside the UK, including in the United States. Our AI service providers process requests in the United States under data processing terms with contractual safeguards for international transfers where applicable. Resend states that email content and delivery logs are stored in the US, even when email is sent through its Ireland region. The other providers describe their international transfer arrangements in their published terms: Google, Cloudflare, Stripe, Resend and Gleap. These include contractual safeguards where applicable.
If you connect YouTube, TikTok or Instagram, SeedViral stores the account identity, permissions and protected access credentials needed for the actions you authorize. Publication sends the selected video and approved metadata to that platform. Disconnect in Settings to stop future use. You can also remove the app in the platform’s own settings.
YouTube and Google
When you connect a YouTube channel, SeedViral uses YouTube API Services. By connecting, you agree to the YouTube Terms of Service, and Google handles your information under the Google Privacy Policy.
We use the connection only to upload the videos you approve or schedule to the channel you connected, to show which channel is connected, to check the processing and privacy status of the videos we uploaded, and to show the view, like and comment counts of those videos in your library. We store the channel’s ID and title and encrypted access credentials. We do not read, change or delete your other videos, comments, playlists or analytics, and we do not share this information with anyone except to provide this feature.
Disconnecting in Settings revokes SeedViral’s access and deletes the stored credentials straight away. The channel ID and title stay with your account history until you delete your account. You can also remove SeedViral’s access at any time on Google’s security settings page.
SeedViral’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Do not include sensitive personal information or someone else’s private material in a brief or upload.
Apps you connect (ChatGPT, Claude and other assistants)
You can connect an assistant app, such as ChatGPT or Claude, to your SeedViral workspace, or give one an API key you create in Developers. Once you approve the connection, the app can read your credit balance, your series and their settings, topic sources and queues, your videos and their status and saved versions, your dramas, songs, clip projects, voice changes and saved presenter names, and the options SeedViral offers. It can get download links to your finished videos that expire within 5 minutes. It can also create drafts, quotes, topics and uploads, change the settings you ask it to, and spend credits on videos and other media you ask for, up to the monthly credit limit you chose when connecting (an API key has no monthly limit; you can revoke it at any time). What the app receives includes the IDs, names, settings, status, prices, revision numbers and dates of these items.
A connected app cannot post to your social accounts, change your plan or billing, use your face or voice, or see your email address, password or card details. What you type into the app is handled by the company that provides it, under its own privacy policy.
For each connection we store the app's name and website, the permissions you approved, your monthly credit limit and when it was connected or disconnected. Access tokens are stored only as one-way hashes, never in plain form. Disconnect at any time in Settings under Connected apps, or revoke an API key in Developers: access stops straight away, and work you had already started still finishes. Deleting your account removes these connections.
How we protect your data
We protect personal information with the safeguards below, and apply them to sensitive data in particular: the access credentials for accounts you connect, your face and voice material, and the files you upload.
- Encrypted in transit. SeedViral is served only over HTTPS with TLS 1.2 or newer, and plain HTTP requests are redirected to HTTPS. Our servers reach our database, storage and service providers over encrypted connections.
- Encrypted at rest. Account records, uploads and videos are stored in Google Cloud, which encrypts all stored data.
- Connected account credentials. Access tokens for YouTube, TikTok and Instagram are encrypted by SeedViral with AES-256-GCM before they are stored, using a key kept in a secret manager, and each encrypted token is bound to its own account record. Only SeedViral's servers can decrypt them. When you disconnect an account or delete your SeedViral account, we revoke the token with the platform and delete it.
- Private storage and short-lived links. Videos, uploads and face and voice material are kept in private storage with public access blocked. Files can only be reached through signed links that expire within 5 minutes, issued to signed-in members of the workspace that owns them or through the download link in that workspace's own video email.
- Least-privilege access. Each part of the service runs under its own service account with only the permissions it needs. Passwords, API keys and signing keys are kept in a secret manager, not in our code. The servers that make videos are private and cannot be reached from the internet.
- Protected account requests. Account features need a signed-in session, requests must come from the real SeedViral website, and requests are rate limited.
- Payments. Card details are entered on Stripe's checkout page and never reach SeedViral's servers.
- Staff access. Only a small number of authorized team members can access production systems, through their own named accounts, and only to run and support the service.
- Deletion. Deleting your account revokes your connections and erases its records and media, as described under Export or delete your account.
Google user data (your YouTube channel's ID and title, its access credentials, and the view, like and comment counts of videos we posted for you) is used only to post the videos you ask for and show you how they are doing. We do not sell it, use it for advertising, or use it to train AI models, and no one reads it except where needed to run that feature, keep it secure or comply with the law.
Your face and voice
If you set up your own face and voice, or someone you invite sets up theirs, we collect a short live recording made with the camera and microphone while the person reads a sentence with fresh check words and says they agree, a transcript of that recording, a voice sample taken from it, one still picture of the face, a short preview made in that voice, and the signed release: the name typed, the date and time, the release version and a fingerprint of its exact text. We then keep the portraits and narration made with them for the videos the workspace asks for.
We use these only to check that the person in the recording agreed, and to make the presenters, characters and narration that workspace requests. They are never used in another workspace or through API keys, never used to recognise or identify anyone, and never sold. Our AI service providers process the voice sample and the picture only to make the requested media: voice and video requests are sent so the provider does not store them and temporary output links last up to one hour, while picture requests may be kept by the provider for up to 30 days to check for abuse. We rely on the person's explicit consent, given in the release.
An invited person signs the release from their own link without needing an account, and gets a private link to check or withdraw it. Anyone can withdraw at any time: in Settings under Your face and voice, or from the private link. Withdrawing stops all new use at once and deletes the material as described below. Videos already finished stay until the workspace deletes them or they expire, and posts already on another platform must be removed there.
Face and voice data: retention and destruction
We treat face pictures, voice samples and the recordings they come from as biometric data. When setup succeeds, the transcript of the recording is deleted straight away. We permanently delete the recording, the voice sample, the face picture, the voice preview and every portrait drawn from them at the first of these: when the person withdraws; when the workspace that holds them is deleted; or 3 years after they were last used. These limits are applied automatically, and a deletion that fails is retried until it finishes. A recording from a setup attempt that fails or is refused, its transcript and anything made from it are kept while the person can still finish setting up, and are deleted at the first of these: when setup succeeds; when the person withdraws; when the workspace is deleted; or 30 days after the last setup step, when the unfinished setup is cancelled. The signed release and withdrawal records are kept as proof of consent until the account is deleted. Backup copies have their own lifecycle and are never used to restore withdrawn material.
Retention and downloads
Accepted video access lasts 90 days from readiness. Download files you want to keep. Download credentials expire much sooner and can be refreshed while the file is available. Media still referenced by another retained video is not deleted early.
Pictures you upload for presenters, reactions and product ads are stored without their file details (such as location tags) and kept while a video or presenter uses them. Speech you upload to the voice changer, its transcript and the changed voice are kept for 90 days unless you delete them sooner, which stops access at once. Long videos you upload to the clipper are converted into parts and the original file is then deleted; an unpaid clipper project is deleted 7 days after upload and a paid one 90 days after its upload. Face and voice material follows the separate rules above.
Selected account music is retained while it is referenced. Quarantined, rejected or unreferenced uploads are eligible for cleanup. Account records stay while needed to operate your account; after deletion, required financial, dispute and security records are restricted and retained for their applicable obligations. Backup copies have a separate lifecycle and are not a way to reactivate deleted accounts.
Export or delete your account
In Settings, export account data and separately download any videos you want to keep. Choose Delete account after a recent sign-in. Deletion first stops new uploads, generation and publishing, then durably cancels billing, revokes connections and removes media, personal records and product analytics linked to the account.
Work already in flight may need provider reconciliation before cleanup can finish. Failed steps are retried; a pending deletion is not reported as complete. Posts already accepted by a social platform may remain there and should be removed through that platform. Necessary financial records and existing backups follow their separate retention rules.
Clearing this browser only removes its local draft and local audio. It does not delete an account or cancel a subscription. For help accessing a deleted or inaccessible account, use Support.
Browser storage, measurement and advertising
Browser storage remembers drafts, authentication and your preferences. The free tools open your files in your browser only; nothing you open in them is uploaded. Text you carry from a free tool into the studio is kept in this browser's storage, not sent to us, until the studio uses it. After 7 days it is no longer used, and it is deleted the next time you open the studio screen or free tool page that reads it; clearing this site's data in your browser also removes it. When measurement is enabled, we use first-party product analytics: we record page views and product steps, such as the setup options you pick from our lists, starting sign-up, viewing plans, starting checkout and playing a video. Each event carries a random browser ID and session ID, a coarse device type (mobile, tablet or desktop) and, if you arrived from a campaign, its source name. The first page view of a visit also records the name of the website that sent you, such as google.com or chatgpt.com, from a fixed list (any other site is recorded as “other”), never the full address of the page you came from. When you are signed in, events are linked to your account ID. These events never include typed text, drafts, video content, your email, your IP address or full page addresses. We also record subscription and credit pack purchases, cancellations and refunds from our billing records, and when a video becomes ready (with the series' niche, language, art style and length), to understand how the product is used, without card or email details, video titles or video content. Product analytics is stored in our own Google Cloud project for up to 400 days, is used only to improve SeedViral, and is never sold.
We advertise SeedViral, for example on Meta (Facebook and Instagram), and measure which ads lead to sign-ups, checkouts and purchases. When you tap one of our ads, AppRefer, our attribution service, records the ad click on its servers before sending you to SeedViral: your IP address, browser information, the advertising click ID and campaign identifiers. On SeedViral we store that opaque click ID and a random browser identifier in a first-party cookie lasting up to 30 days, associate it with your account and checkout, and send AppRefer the fact and time that you created an account, that you started checkout (with the selected plan price) and payment facts (purchases, renewals and refunds), each keyed to that click ID and random browser identifier. With the account, checkout and first purchase facts we also send a hashed (SHA-256) copy of your account email address, a hashed copy of your account ID, a hashed copy of the country your connection comes from and the Meta browser cookie ID that Meta's pixel sets on SeedViral, and with the first purchase hashed (SHA-256) copies of the name, city, state or region, postcode and country from your billing details, so Meta can match them to its own records. The plain email address, name and address are never sent. AppRefer shares these click, sign-up, checkout and purchase details with the advertising network, such as Meta, from its servers to measure and improve advertising. Meta's pixel also runs in your browser on SeedViral to record page views and when you open setup; it respects the opt-outs below. When you are signed in, the pixel is also given the same hashed (SHA-256) copies of your account email and account ID, never the plain email or anything you type. Meta may use its own cookies and your browser information for this, under its own privacy policy. We do not share your plain email address, name, billing address, drafts or video content for this purpose. The opt-outs below stop the hashed details and the cookie ID too. The checkout attribution and delivery records remain with your account until account deletion; the cookie expiry does not erase those records. Hosting services may separately process request information for security.
How to opt out: turn on Global Privacy Control in your browser, and neither the ad link nor SeedViral will record measurement or attribution for that browser, and neither Meta's pixel nor Microsoft Clarity is loaded. You can also choose No thanks under Measurement preferences below, which stops measurement, Meta's pixel, Microsoft Clarity and advertising attribution for this browser and your signed-in account and removes this browser's random analytics IDs and attribution cookie; that choice is saved on this browser for up to 180 days. To opt out for all your devices, or to ask us to stop using previously collected measurement or attribution data, contact Support. Payment attribution already sent remains subject to AppRefer's and the advertising network's retention practices. Opting out does not affect the studio. When you delete your account, we delete the product analytics linked to it, including events from browsers that were signed in to it. Removal is retried automatically and can take up to a few hours to finish.
Reminder emails
If you save a series but don’t subscribe, we may send you up to three emails about it over the following few days: a reminder of the choices you saved, tips on growing a faceless channel and, sometimes, a time-limited offer. We use your account email and the series’ name, settings and time zone for this. We do so because we have a legitimate interest in telling people who have shown interest in SeedViral about it, and UK law lets us email you about our own similar service as long as you can refuse at any time. The emails stop as soon as you subscribe.
To stop them, tick “Don’t send me these” when you create your account, or use the unsubscribe link in any of these emails. It works in one click without signing in. Unsubscribing does not affect account emails, such as receipts or video updates.
Your choices and rights
You can correct saved account content, export it, disconnect platforms, request deletion, unsubscribe from reminder emails and opt out of measurement and advertising attribution. Depending on applicable law and the processing purpose, you may also request access, restriction or object to processing. Contact Support with your request; do not send identity documents unless securely requested.
You may raise a concern with your local data protection authority. In the UK, information is available from the Information Commissioner’s Office. We will update this notice when material processing changes.