Privacy policy

Last updated: October 22, 2026.

Data controller

Frédéric Lebredonchel, sole trader operating KreaViral — 57 rue des Grands Champs, 78300 Poissy, France. Contact: [email protected].

Data and purposes

Depending on the features used, KreaViral processes account and authentication data, email address, name and profile picture where provided by Google, preferences, uploaded files and creations, scripts, images, videos, audio tracks, subtitles, generation history, subscription and billing data, Follower Orders and target social account, connected TikTok accounts, support requests, exchanges with the “Lia” AI assistant, technical logs, security and abuse-prevention data, and cookie choices.

This data is used to create and administer the Account, authenticate the user, provide requested creations, generate or transform content, manage subscription quotas, process payments and orders, provide selected integrations, deliver support and conversational assistance, prevent fraud and abuse, secure the service and, where consent is required, measure audience.

Google authentication

If you choose “Continue with Google”, authentication is handled through Google and Supabase Auth. KreaViral receives the information needed to create or sign in to the Account, including the provider technical identifier, email address and, where supplied by Google, name and profile picture. KreaViral does not receive your Google password.

Creation, AI and subtitles

Some features send only the data required for the requested processing to the relevant providers. OpenAI and Mistral may be used for certain AI functions, including scripts, suggestions, image generation or moderation depending on the active feature. Fish Audio may be used for voice synthesis. AI subtitles may be produced from video audio using a WhisperX service operated within KreaViral infrastructure; the video or its audio track is then processed to generate transcription and timing alignment.

The “Lia” conversational assistant, available from a bubble on the site, relies on Mistral to generate its replies. Messages exchanged with Lia (and the visitor’s email address where provided) are recorded server-side to improve the assistant and for commercial and legal follow-up, as stated in the tool itself.

TikTok integration and publishing

When you voluntarily connect a TikTok account, KreaViral processes the data required for the integration, such as the TikTok technical identifier, username, display name, profile picture and required access tokens. Tokens are stored server-side and protected in order to provide authorised functions, including account synchronisation and, where available, sending or publishing a video. Publication settings, caption and the AI-generated-content indication may be sent to TikTok when publication is requested. You can remove the TikTok connection from your Account where this option is available.

Subscriptions, payments and Follower Orders

Stripe processes payments, recurring subscriptions, payment methods and certain billing data. KreaViral stores the references needed to track the transaction or subscription, but not full payment-card numbers. For a Follower Order, KreaViral stores in particular the selected platform, quantity, target account supplied, amount and fulfilment status.

Kréas and creation library

KreaViral also records Kréas allocations, their origin (subscription, bonus or historical entitlements), validity periods, reservations, charges, releases and related creation operations. This information is used to display the correct balance, resolve incidents and verify disputed transactions. The generated-image library remains available throughout the Account relationship, subject to deletion requests and applicable statutory retention duties.

Marketing emails and your choices

After creating an account, you may receive an informational welcome email. Following meaningful use of the studio (a substantive draft, a script, or a finished video), KreaViral may send one follow-up related to similar video services, potentially including an offer. You may opt out at no cost and unsubscribe from each email.

Creating an account alone does not allow promotional emails. After meaningful free use of a creation service, and only if clear notice and a free opt-out were offered at signup, KreaViral may use the existing-customer exception for similar services. Historical accounts do not automatically qualify. An objection or unsubscribe remains effective.

Legal bases

Performance of the contract is the basis for processing required for the Account, creations, subscriptions, orders, payments and integrations requested by the user. Legal obligations apply in particular to accounting records. KreaViral’s legitimate interests support processing strictly necessary for security, fraud prevention, abuse prevention and technical diagnostics. Non-essential trackers and audience measurement requiring consent rely on that consent.

Recipients and providers

Data is available only to people and providers that need it to provide the service. Depending on the features used, KreaViral relies in particular on Supabase for authentication and application data, Google for user-selected authentication and consent-based Google Analytics, Stripe for payments and subscriptions, Cloudflare for security, proxying and Turnstile, OpenAI and Mistral for certain AI and moderation functions (including the “Lia” assistant), Fish Audio for certain voices, TikTok for connection and publishing features, and the configured SMTP provider for transactional email. HeyGen may be used in administrator marketing tools; user data is not sent to it unless a feature explicitly requires it.

Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where applicable, KreaViral relies on GDPR transfer mechanisms and safeguards provided by the relevant providers.

Retention

Data is kept for as long as necessary for the purposes described and is then deleted, anonymised or archived where a legal obligation or evidentiary need applies. After an Account deletion request, a 7-day grace period allows cancellation. Billing records are retained for statutory periods. Imported photos and source videos subject to automated cleanup expire according to the rules displayed in the service; moderation events are retained for up to 180 days, administrator audit logs for 365 days, temporary rate-limit keys for 7 days, the hash used to limit abusive account creation for 365 days, internal audience measurement data for 180 days, conversations with the “Lia” assistant for 180 days from the last message, and closed support tickets for 5 years. The Analytics consent choice is stored for six months.

Your rights

Depending on your situation, you have rights of access, rectification, erasure, restriction, objection and portability, and may withdraw consent at any time where processing is based on consent. Exercise your rights at [email protected]. You may also lodge a complaint with the French data protection authority, the CNIL.

Cookies

See the Cookies page for information about trackers and to change your choice at any time.