1. Overview
Viralyads is Africa's first distributed creator advertising network — a platform that connects African content creators with brands seeking authentic, verified social media promotion. The platform operates under Blackie Networks, a technology company building creator-economy infrastructure across Africa.
We take your privacy seriously. This policy describes our practices regarding the collection and use of personal information in connection with the Viralyads website at viralyads.com and all associated mobile and web applications (collectively, the "Platform"). By accessing or using the Platform, you agree to the practices described in this Privacy Policy.
2. Who We Are
The data controller for purposes of this Privacy Policy is:
References to "Viralyads", "we", "us", or "our" in this policy refer to Blackie Networks operating under the Viralyads brand.
3. Data We Collect
We collect different categories of information depending on whether you use Viralyads as a creator or as a brand/client.
3.1 Information You Provide
| Category | Examples | Who |
|---|---|---|
| Account credentials | Email address, password (hashed) | Creators & Brands |
| Profile information | Display handle, country, phone number | Creators |
| Payment information | PayPal email address, M-Pesa phone number | Creators |
| Business information | Business name, website URL, industry, KRA PIN | Brands |
| Campaign content | Post URLs, screenshot uploads, video links | Creators |
| Billing details | Billing address, payment references, invoice data | Brands |
| Communications | Support emails, in-app messages, feedback forms | All users |
3.2 Information Collected Automatically
- IP address and approximate geolocation (country/region level)
- Device type, operating system, and browser type
- Pages visited, time spent on pages, clickstream data
- Referral URLs and campaign tracking parameters
- Session identifiers and authentication tokens (stored as secure HTTP-only cookies)
- Website visit logs when creators visit brand websites as part of campaign verification
3.3 Information from Third Parties
- If you sign in with Google OAuth, we receive your name and email address from Google
- Payment processors (Stripe, PayPal, Paystack, M-Pesa Daraja) may share transaction confirmation references with us
- AI verification services may return metadata about submitted screenshots and social media posts
4. How We Use Your Data
We process your personal data only for the purposes listed below and rely on one of the following legal bases: contract performance (processing necessary to provide the service), legitimate interests (fraud prevention, security), or consent where explicitly requested.
Providing the Platform
Creating and managing your account, enabling slot reservation, processing campaign submissions, and releasing payouts to creators via PayPal or M-Pesa.
Payment Processing & Escrow
Holding client funds in escrow, verifying campaign completion, and disbursing creator payouts. We retain financial transaction records as required by applicable financial regulations.
AI-Powered Post Verification
Analysing creator-submitted screenshots and post URLs to verify that content meets campaign requirements and that posts remain live for the required duration. Screenshots are processed by AI but not used to train third-party AI models.
Fraud Detection & Platform Security
Identifying suspicious activity such as fake screenshots, duplicate accounts, slot manipulation, or payment fraud. We use IP data, device fingerprints, and behavioural patterns solely to keep the platform safe.
Communications
Sending transactional emails (payout confirmations, slot reminders, password resets), SMS alerts, and push notifications. Marketing communications are only sent where you have opted in.
Analytics & Improvement
Understanding how users navigate the platform, which features are used, and where friction exists. This data is aggregated and anonymised where possible.
Legal Compliance
Meeting obligations under applicable laws including anti-money laundering (AML) requirements, tax reporting, and responding to lawful requests from regulators or courts.
6. Third-Party Services
Viralyads integrates with the following third-party services. Each has its own privacy policy.
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe | Card payments from brands | Payment card data (processed directly by Stripe) |
| M-Pesa Daraja (Safaricom) | Mobile money payments & creator payouts in Kenya | Phone number, transaction reference |
| PayPal | Creator payout disbursement | Creator PayPal email, payout amount |
| Paystack | Bank transfer creator payouts | Creator bank details, transfer code |
| Brevo (formerly Sendinblue) | Transactional email delivery | Email address, name, template variables |
| Google (Firebase / OAuth) | Optional sign-in, push notifications | Email, name (if Google sign-in used) |
| Anthropic Claude AI | Screenshot & post verification | Image hashes, post metadata (not PII) |
| Amazon Web Services (S3) | Screenshot & proof-of-post storage | Uploaded screenshot files |
| Redis | Session & rate-limit caching | Session tokens (no PII) |
8. Data Retention
We retain personal data only as long as necessary for the purposes described in this policy, subject to legal obligations.
| Data Type | Retention Period |
|---|---|
| Active account data | For the lifetime of your account |
| Campaign & submission records | 3 years after campaign completion (financial audit trail) |
| Payout & transaction records | 7 years (tax and AML compliance) |
| Screenshot uploads (S3) | 180 days after campaign settlement |
| IP / access logs | 90 days |
| Deleted account data | Anonymised within 30 days; financial records retained 7 years |
| Password reset tokens | 1 hour from issuance (auto-expired) |
9. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Access
Request a copy of the personal data we hold about you.
Rectification
Correct inaccurate or incomplete information in your profile.
Erasure
Request deletion of your account and associated data (subject to legal retention requirements).
Portability
Receive your data in a structured, machine-readable format.
Restriction
Request that we limit processing of your data in certain circumstances.
Object
Object to processing based on legitimate interests, including direct marketing.
Withdraw Consent
Where processing is based on consent, withdraw it at any time without affecting prior processing.
Lodge a Complaint
File a complaint with your local data protection authority.
To exercise any of these rights, email privacy@viralyads.com. We will respond within 30 days. We may need to verify your identity before processing your request.
10. Security
Blackie Networks implements industry-standard technical and organisational measures to protect your personal data:
- All data transmitted via HTTPS/TLS 1.2+ encryption
- Passwords stored using bcrypt hashing — never in plaintext
- Authentication tokens are HTTP-only, SameSite=Lax cookies, inaccessible to JavaScript
- Rate limiting and account lockout on authentication endpoints to prevent brute-force attacks
- Escrow funds held in isolated accounts — not commingled with operational funds
- S3 screenshot storage uses server-side encryption (AES-256)
- Role-based access control: only authorised staff can access production data
- Regular security audits and penetration testing
No system is 100% secure. If you discover a security vulnerability, please report it responsibly to security@viralyads.com.
11. Children's Privacy
Viralyads is not intended for, and does not knowingly collect personal data from, individuals under the age of 18. If you are under 18, please do not register on the platform. If we become aware that we have collected data from a minor, we will take immediate steps to delete it. Parents or guardians who believe their child's data has been collected should contact us at privacy@viralyads.com.
12. International Data Transfers
Viralyads operates primarily across Africa and processes data through servers and service providers that may be located in the United States, European Union, or other jurisdictions. Where we transfer personal data outside your country of residence, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) with EEA-based processors
- Adequacy decisions where applicable
- Data Processing Agreements (DPAs) with all sub-processors
- Binding Corporate Rules where applicable
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Send an email notification to registered users
- Display a prominent notice within the platform for 30 days
Continued use of the platform after the effective date of an updated policy constitutes acceptance of the changes.
14. Contact Us
For any questions, concerns, or requests related to this Privacy Policy or your personal data:
Blackie Networks — Privacy Team
Operating Viralyads (viralyads.com)
We aim to respond to all privacy requests within 30 days.