Privacy notice

Skynat runs Viraly and is the responsible party for the personal information described here, which we process in line with South Africa's Protection of Personal Information Act (POPIA).

What we collect

• Account details: name, email, country, password (stored as a one-way hash).
• Identity and payout details: ID or passport number, date of birth, bank or PayPal details. ID and account numbers are encrypted.
• Activity: the brands you join, the agreements you sign, and your links' clicks and sales.
• About people who click your links: a one-way hash of their network address, their browser type and where they came from — never their name.

Why we use it

• To run your account, credit sales to you and pay you.
• To prevent fraud, such as one person running several accounts or buying through their own link.
• To meet legal and tax record-keeping duties.

Who sees it

Skynat staff who run the programme. Skynat brands see only your display name, handle, promo code and performance for their own brand — never your identity documents or bank details. Payment providers receive what they need to pay you.

The Viraly apps and browser extension

The phone app, the desktop app and the browser extension show the same Viraly account. They collect nothing that the website doesn't, apart from the following.

• Browser extension. It stores your personal access token, the Viraly address you connected from, and a copy of your share kit (your brands, links, promo codes and captions) on your own computer. It reads no browsing history and no page content. It writes into a text box only when you choose "Insert my Skynat link" from the right-click menu, and it never posts, sends or submits anything. Disconnect it from Extension in your dashboard and the token stops working at once.
• Phone notifications. If you allow notifications, the phone app registers a notification token with Google Firebase Cloud Messaging, together with the phone type and app version, so we can tell you about sales, unlocked earnings, payouts and decisions on your account. Signing out on that phone removes it. You can also stop any phone from Account → Notifications, or turn notifications off in your phone's settings.
• One-click sign-in. Signing in with Google, Facebook or X in the apps happens in your phone's or computer's own browser. The app receives a one-time code that only it can use, and never sees your password for those services.

We don't sell this information, use it for advertising, or share it beyond what's described here.

How long we keep it

For as long as your account is open. Financial records (sales, commission, payouts) are kept for five years after the last transaction, as tax law requires, then deleted.

Your rights

You can ask for a copy of your information, ask us to correct it, or ask us to delete your account from Account → Privacy. You may also complain to the Information Regulator of South Africa.