Privacy Policy.

Version 1.0 — in force from 7 October 2026

This Privacy Policy explains how Viroan sp. z o.o. collects and uses your personal data, who processes it for us, where it is processed, how long it is kept, and the rights the General Data Protection Regulation (GDPR) gives you. It is the information we give you under Articles 13 and 14 of the GDPR, not terms you agree to; it accompanies the Terms of Service (clause 1.3) and is written in plain language, as the law requires. Defined terms used here (Product, Licence, Creator and the like) have the meaning given in the Terms of Service.

1. Who we are, and how to reach us

1.1. The controller of your personal data is Viroan sp. z o.o., with its registered office at ul. Wielicka 42, lokal B3, 30-552 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001270651, NIP PL 679-337-75-98, REGON 545853960 (“Viroan”, “we”, “us”).

1.2. For any question about this Policy or your data, and to exercise your rights, write to legal@viroan.com or to support@viroan.com, or by post to the address in clause 1.1.

1.3. We have not appointed a Data Protection Officer, because we are not required to; the contacts in clause 1.2 handle data-protection matters. We are established in the European Union, so no representative under Article 27 of the GDPR is required. You always have the right to complain to a supervisory authority (clause 10).

2. What this Policy covers

2.1. This Policy covers the personal data we process as controller when you visit viroan.com, hold a Viroan account, buy and use a Licence, publish as a Creator or receive a payout, or contact us. Your role — visitor, buyer, Creator or payee — affects what we process, and the Policy says where it does.

2.2. A Product you buy runs on your own machine and your own broker or exchange account. We do not operate it and do not have access to it, so what it does with your trading data on your own equipment is outside this Policy. We never receive your exchange or broker credentials (see clause 3.7 and the Risk Disclosure).

2.3. If you apply to work at Viroan or are a member of our staff, a separate notice applies to that relationship.

3. The personal data we collect

3.1. When you create and use an account. Your email address; a password, which we store only in hashed form and cannot read; your username (which is public on reviews and, if you publish, on your Creator page); optionally your name and postal address and an avatar if you add them; your declared country of residence; a referral code if you used one; your communication preferences; your two-factor-authentication settings; and a record of your acceptance of our agreements — the version accepted, the date, your IP address and a cryptographic hash of the document — which we keep as proof of consent. The data the sign-up form marks as required is needed to conclude the contract, and without it we cannot open an account; the rest is optional.

3.2. When you buy and use a Licence. The Products you license; your orders and payments (the amount, currency, the VAT applied, the status, and the masked or partial payment details our payment provider returns — we never receive or store your full card number); activation and device records for a Licence, including, for a MetaTrader Product, a value derived from your computer that the licence check sends to us so that one Licence is not used past its limit; activation keys, which we store only as a hash; and your reviews, reports, and the ratings you leave.

3.3. If you become a Creator or a payee. To list Products or receive payouts you must complete an identity check carried out by our verification provider. The check uses your identity document, a short selfie or liveness recording and a facial comparison — which are biometric data, a special category of personal data — and, for a company, its registry details, tax identifiers and beneficial owners. We receive the result and the identity fields extracted from the document; the provider processes the images and the biometrics. This check is required for those roles; the legal basis is in clause 4, and the provider in clause 7.

3.4. Automatically, as you use the platform. Technical and security data: your IP address; the approximate country derived from it, which we compute on our own servers without sending your address to anyone; the type of your browser and device; the pages you open and the actions you take; the times and devices from which you sign in; and, if you allow it in the cookie banner, a device fingerprint — a value computed in your browser from its characteristics — which we use to detect fraud and the opening of multiple accounts. Some of this is read or stored through cookies and similar technologies (clause 6 and the Cookie Policy).

3.5. When you contact us. The content of your support messages and any files you attach; and, if you choose to use the Telegram support bot, the data you send through Telegram (clause 7 — do not send identity documents or other sensitive data through it).

3.6. Data we derive. An internal risk indicator about account conduct, and links between accounts that share a device, an IP address, a telephone number or an address — both used only to prevent fraud and abuse, and described in clause 5.

3.7. What we do not collect. We do not ask for or receive your exchange or broker credentials, and we cannot place a trade on your account. We do not store your full card number. We do not verify a buyer’s identity by default. We do not screen you for politically-exposed-person status or adverse media. We do not buy personal data to build profiles of you, and we do not sell your personal data.

4. Why we use your data, and our legal basis

We use your personal data for the following purposes, each on the legal basis stated:

• To provide the service — your account, the marketplace, your Licences and their delivery, and support for the platform and your account: because it is necessary to perform our contract with you (Article 6(1)(b) GDPR).
• To keep the platform and your account secure, and to prevent and investigate fraud and abuse — email verification, two-factor authentication, the device fingerprint, the linking of accounts that share signals, the internal risk indicator, and the enforcement of our Terms: because it is in our legitimate interest to secure the service and protect the marketplace and its users (Article 6(1)(f)). You may object (clause 10). The device fingerprint is computed on and read from your device only with your consent, as Article 399 of the Polish Electronic Communications Law requires (clause 6); once you allow it, we use it on this legitimate-interest basis, and if you withdraw your consent it is no longer collected.
• To verify the identity of Creators and payees, including the biometric data in the identity check: on the basis of your explicit consent to that check (Article 9(2)(a)), together with the necessity of the check for the Creator or payee relationship you ask for (Article 6(1)(b)). The check is required for those roles; you give your consent before it begins, and if you do not wish to undergo it you may simply not take that role. We do not use the biometric data for any other purpose.
• To meet our legal obligations — issuing and keeping invoices and accounting records, complying with sanctions and export-control rules, and answering lawful requests from authorities: because we are under a legal obligation (Article 6(1)(c)), and, where identity data is needed to meet such an obligation, on the ground of substantial public interest where it applies (Article 9(2)(g)).
• To keep a record of your acceptance of our agreements: because we must be able to demonstrate it (Article 6(1)(c) and (f)).
• To send you marketing or product news, if you ask for it: on the basis of your consent (Article 6(1)(a)), which you may withdraw at any time. Messages about your account, your purchases, security and changes to the agreements are not marketing and are sent on the bases above.

5. Automated decisions and profiling

5.1. Most of our checks only assist a person: a measure affecting your account or your content is decided by a human being (see the moderation provisions of the Terms of Service).

5.2. A small number of eligibility decisions are made by software alone and may have a legal or similarly significant effect, and we tell you plainly which: a creator or payee application is refused automatically if our verification provider returns a “declined” result, or if the identity document shows that you are under 18; and sign-up or an application is refused automatically if you declare residence in a country we may not serve for legal or sanctions reasons. The legal basis is the necessity of the decision for entering into a contract, and compliance with a legal obligation.

5.3. Where such a decision is made about you, you have the right to obtain the intervention of a person on our side, to express your point of view and to contest the decision. Write to legal@viroan.com.

5.4. We profile only to prevent fraud and abuse: the device fingerprint (if you allowed it), the linking of accounts that share signals, and the internal risk indicator described in clause 3.6. The risk indicator adds scrutiny; it does not by itself restrict your account, withhold money or end your access — a person decides any measure. It is part of the data we hold about you and is provided on an access request, subject to the limits in clause 10.

6. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to keep you signed in, to make the site work and to keep it secure. Technologies that are not strictly necessary — the device fingerprint used to prevent fraud and the opening of multiple accounts, keeping a referral code in your browser, and embedded media — are used only with your consent, which is asked for separately and which you may withdraw at any time; once you allow the device fingerprint, we use it on the basis of our legitimate interest in the security of the service (clause 4). What each one is, how long it lasts and how to control it is set out in the Cookie Policy.

7. Who we share your data with

7.1. We do not sell your personal data. We share it only with providers that process it for us under a data-processing contract, and with authorities where the law requires. The principal recipients are:

• our payment service provider, Stripe, which processes your payment and returns only masked details to us (Stripe Payments Europe, Limited, in Ireland; Stripe transfers some data to Stripe, LLC in the United States, which is certified under the EU–US Data Privacy Framework, and also relies on the Commission’s Standard Contractual Clauses);
• our identity-verification provider, Didit, which carries out the Creator and payee identity check described in clause 3.3 (processing within the European Economic Area);
• our email provider, which delivers verification codes, receipts and account notices (an EU provider);
• our hosting provider, OVH, on whose servers in the European Union the platform and its database run;
• Telegram, if you choose to use the Telegram support bot (clause 8);
• Creators, for a Product you license or a Creator you write to: your username, your messages and the status and dates of your Licence — never your name or email address; reviews are public with your username;
• the European Commission’s VIES service, to check a company VAT number a Creator gives us;
• our professional advisers, and a prospective or actual buyer of our business, under confidentiality; and
• public authorities and courts, where we are legally required to disclose.

7.2. Some pages load fonts or embedded media (for example a Creator’s demonstration video); where that involves a third party, it is identified in the Cookie Policy. Our own staff access your data only as far as is needed for support, security and compliance, under access controls and with a record kept of sensitive access.

8. Where your data is processed

Your personal data is processed primarily within the European Economic Area: our hosting, email and identity-verification providers operate within it, and our payment provider’s European entity is in Ireland. Where we or our providers transfer data outside the European Economic Area — in particular Stripe’s transfers to the United States (clause 7.1) — we rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework, or on the Commission’s Standard Contractual Clauses, and you may ask us for a copy of the safeguard relied upon. If you use the Telegram support bot, Telegram, which operates outside the European Economic Area, processes your messages as an independent controller under its own terms. Using the Telegram bot is your choice; the email and in-application support channels keep your data within the European Economic Area.

9. How long we keep your data

We keep your personal data only for as long as it is necessary for the purpose for which we hold it, and then delete or anonymise it. In particular:

• account data — for as long as you hold the account; after you close it we delete or anonymise what we no longer need, keeping only what the law or a pending matter requires, and an internal identifier and your username in pseudonymised form, so that the username cannot be taken over and the records we must keep stay linked;
• orders, invoices and accounting records, including the evidence of where you are for VAT, refunds and chargebacks, and Creator payout and tax records — for 10 years from the end of the year of the transaction, the period EU VAT rules require for the records of the one-stop shop, which also covers the periods in Polish tax and accounting law;
• the record of your acceptance of the agreements — for as long as you hold the account and 6 years after, the general limitation period for claims;
• security and sign-in logs, the device fingerprint and fraud-prevention records — 12 months on a rolling basis; records linked to an open case until the case is closed and 3 years after; the value derived from your computer for a MetaTrader Licence — until 12 months after the Licence ends;
• identity-verification data — for the duration of the Creator or payee relationship and 5 years after it ends, including the sanctions-screening records as evidence that we complied with sanctions law; for a refused application, the outcome and its reason for 3 years, so that the refusal can be reviewed or contested; the document images and the biometrics are held by our verification provider under its own retention, and we do not need them beyond the result of the check;
• support messages — for 6 years after the matter is closed, the general limitation period for claims;
• the record of your consent to marketing e-mails — while the consent is valid and 5 years after you withdraw it; a record that you unsubscribed is kept for as long as needed to respect it;
• records of e-mails we sent you — 12 months.

Our backups are overwritten on a rolling cycle, so data you ask us to delete may remain in an encrypted backup until that backup is rotated, after which it is gone.

10. Your rights

10.1. As a data subject you have the right to obtain access to your data and a copy of it; to have inaccurate data corrected; to have your data erased; to restrict or to object to our processing of it; to receive the data you provided in a structured, commonly used, machine-readable form and to have it transmitted to another controller where that is technically feasible; to withdraw a consent at any time, without affecting the lawfulness of processing before the withdrawal; and not to be subject to a decision based solely on automated processing as described in clause 5.

10.2. To exercise any of these rights, write to legal@viroan.com or support@viroan.com. We answer without undue delay and within one month, which we may extend by two further months for a complex or voluminous request, telling you so within the first month. We may need to confirm your identity before we act.

10.3. Some rights have limits the law allows — for example, we may keep data we are legally required to keep, and we may decline or narrow a request where it would adversely affect the rights and freedoms of others or an ongoing investigation.

Your right to object. Where we rely on our legitimate interest (clause 4), including the profiling for fraud prevention in clause 5.4, you may object at any time on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims. You may object to direct marketing at any time, and we then stop without exception.

10.4. If you consider that we handle your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the supervisory authority of the country in which you live or work.

11. How we protect your data

We apply technical and organisational measures appropriate to the risk: encryption of data in transit over HTTPS and appropriate protection at rest, access controls and logging, and two-factor authentication, which we encourage you to enable. We do not store your full card number and never hold your exchange or broker credentials. No system is entirely secure; where a breach of personal data affects you and is likely to present a risk, we will notify the supervisory authority and, where the risk is high, you, as the GDPR requires. You can help us by using a strong, unique password and by reporting anything suspicious to security@viroan.com.

12. Children

The platform is intended for persons aged 18 or over. It is not directed to children, and we do not knowingly collect their personal data. If you believe that a person under 18 has provided us with personal data, write to legal@viroan.com and we will delete it.

13. Changes to this Policy

We may update this Policy. The version number and the effective date are shown above, and previous versions are retained and available on request. Where a change materially affects how we use your personal data, we give you notice in advance by email and within the application. A change to this Policy does not reduce the rights the law gives you.

14. Contact and complaints

For any matter concerning your personal data, contact legal@viroan.com or support@viroan.com, or write to Viroan sp. z o.o., ul. Wielicka 42, lokal B3, 30-552 Kraków, Poland. You may also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or to the supervisory authority of your own country. These contact points are repeated in the Legal Notice.

15. Language

This Policy is published in English and Polish. If you are a Polish citizen or resident in Poland, the Polish version applies to you; in all other cases the English version applies, and any other translation is provided for information only. This mirrors the language rule in clause 16.3 of the Terms of Service.