Privacy Policy
How ViralPay collects, uses, shares, protects and deletes personal data across our website, portals, mobile services, campaigns and social-media integrations.
1. Who we are
ViralPay is a digital marketing, creator, partner, research and sales-engagement platform operated by Hotspot Collectors Limited. In this Privacy Policy, “ViralPay”, “we”, “us” and “our” refer to the ViralPay platform and its operator.
For privacy enquiries or requests, contact viralpay@viralpay.co.ke.
2. Scope
This Policy applies when you visit www.viralpay.co.ke, create or use a ViralPay account, participate in campaigns, connect a social-media account, submit a survey or field-research response, generate or receive a lead, use a wallet or payment feature, communicate with ViralPay, or otherwise use a ViralPay service.
3. Personal data we may collect
Account and identity information
- Name, email address, telephone number, country, account role and login/security information.
- Business, employer, professional or creator-profile information you provide.
- Verification, onboarding and approval information required for the relevant ViralPay role.
Social-media connection data
When an Influencer chooses to connect a supported social account using the platform’s native authorization process, ViralPay may receive information permitted by that platform and by the permissions you approve, such as:
- platform user or channel identifier, username/handle, profile name and profile image;
- pages, channels or professional accounts you are authorized to manage;
- audience, follower/subscriber and engagement metrics made available by the platform;
- content or performance metrics required to verify campaign delivery and reporting;
- access and refresh tokens required to maintain the authorized connection.
ViralPay does not ask for or store your Facebook, Instagram, TikTok, YouTube, X or LinkedIn password. Social-account connection is optional. WhatsApp is not used as an Influencer social-profile verification connector; telephone or messaging contact information may be processed separately where you choose to provide it.
Campaign, sales and research data
- Campaign participation, tracking links, deliverables, submissions, clicks, responses, leads, conversions, attribution and performance data.
- Survey and research responses, including location information where a field activity requires location validation.
- Fraud, duplicate, device, bot-detection and integrity signals used to protect advertisers, partners and ViralPay.
Financial and transaction data
- Wallet transactions, invoices, receipts, funding, withdrawals, commissions, settlement records and payment references.
- We may receive payment status or reference information from payment providers. We do not intentionally store full payment-card credentials unless a specific regulated payment service requires it.
Technical information
- IP address, device/browser information, timestamps, session information, security logs and cookies or similar technologies.
4. Why we process personal data
| Purpose | Examples |
|---|---|
| Provide the service | Create accounts, authenticate users, operate portals, campaigns, social connections, research, leads, wallets and reporting. |
| Verify eligibility and performance | Confirm connected social accounts, campaign participation, deliverables, attribution and performance metrics. |
| Payments and accounting | Process funding, earnings, invoices, receipts, withdrawals, settlements and financial reconciliation. |
| Security and integrity | Detect bots, duplicate activity, suspicious devices, fake engagement, fraudulent leads, account abuse and unauthorized access. |
| Communications | Send account notices, approvals, campaign updates, invitations, payment notifications, support messages and legally required notices. |
| Compliance | Meet legal, regulatory, tax, audit, dispute-resolution and lawful authority requirements. |
| Improve ViralPay | Analyze aggregated or anonymized service usage, reliability and product performance. |
Depending on the context, we process personal data on the basis of consent, performance of a contract, compliance with legal obligations, protection of legitimate interests permitted by law, or another lawful basis available under applicable law.
5. Social-media platforms and OAuth authorization
Connecting a social account is initiated by the Influencer. ViralPay redirects you to the relevant platform, where you sign in directly with that platform and choose whether to authorize ViralPay. The social platform controls its own login, consent screen, permissions and API availability.
You may disconnect a connected social account from ViralPay. Disconnecting stops future authorized access, subject to technical completion of revocation and any records we must retain for completed campaigns, fraud prevention, accounting, legal claims or regulatory compliance.
ViralPay only treats a social account as platform-verified where the connection has been authenticated through an approved provider authorization flow or where a clearly identified legacy verification rule lawfully applies.
6. How we share personal data
We may share only the information reasonably necessary for the relevant purpose with:
- advertisers, agencies, Influencers, Marketers, Publishers, BPO or sales-conversion parties involved in a campaign or transaction;
- payment, hosting, email, security, analytics, storage, customer-support and technology service providers acting under appropriate contractual or legal safeguards;
- supported social-media platforms where required to authenticate, refresh, revoke or synchronize an authorized connection;
- professional advisers, auditors, insurers, regulators, courts or law-enforcement bodies where disclosure is legally required or reasonably necessary to protect rights, safety or the integrity of the platform.
ViralPay does not sell personal data to advertisers or data brokers.
7. International data transfers
Some technology or social-media providers may process data outside Kenya. Where personal data is transferred outside Kenya, ViralPay will use safeguards required by applicable data-protection law, such as appropriate contractual protections, an adequacy basis, another lawful transfer mechanism, or consent where required.
8. Data retention
We keep personal data only for as long as necessary for the purpose for which it was collected, to maintain legitimate business and security records, and to satisfy legal, accounting, tax, regulatory, fraud-prevention and dispute-resolution obligations.
Different categories of data may have different retention periods. When data is no longer required, ViralPay will delete, anonymize or otherwise securely dispose of it where reasonably practicable and permitted by law.
9. Security
We use reasonable technical and organizational safeguards designed to protect personal data, including access controls, role-based permissions, server-side secret storage, encryption for protected credentials/tokens where implemented, audit logging, anti-fraud controls, backups and security monitoring.
No internet service can guarantee absolute security. If a personal-data breach creates a real risk of harm, ViralPay will respond and make notifications required by applicable law.
10. Your data-protection rights
Subject to applicable law and any lawful limitations, you may have the right to:
- be informed about how your personal data is used;
- access personal data held about you;
- request correction of inaccurate or misleading personal data;
- object to certain processing;
- request deletion where the law permits;
- request portability of eligible personal data in a structured, commonly used format;
- withdraw consent where processing depends on consent, without affecting prior lawful processing;
- request appropriate human review where a significant decision is made solely by automated processing and applicable law provides that right.
To exercise a right, email viralpay@viralpay.co.ke. We may need to verify your identity before acting on a request.
11. Account and social-data deletion
You may request deletion of your ViralPay personal data or revoke a connected social account. Visit our Data Deletion Instructions or contact viralpay@viralpay.co.ke.
Deletion requests do not require ViralPay to erase records that must lawfully be retained, including completed financial transactions, invoices, payment records, audit logs, fraud/security evidence, contractual records, legal claims or regulatory records. Where retention is required, access will be limited to the purposes for which retention remains lawful.
12. Cookies and similar technologies
ViralPay may use strictly necessary cookies for authentication, session security and core website operation, and may use other permitted technologies for preferences, performance or analytics. Where consent is required, we will request it before using non-essential cookies.
13. Children
ViralPay is intended for adults capable of entering binding commercial arrangements. We do not knowingly create earning, advertiser or creator accounts for children unless a specific lawful product flow expressly permits it with appropriate authorization and safeguards.
14. Changes to this Policy
We may update this Privacy Policy to reflect changes in law, regulation, platform integrations or ViralPay services. The updated version will show its effective date. Material changes may also be communicated through the platform or by email where appropriate.
15. Complaints and contact
Questions, requests or complaints may be sent to viralpay@viralpay.co.ke. You may also have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner (ODPC).