Legal - Privacy Policy

The Basics

a. About Us

GoVyrl, Inc. is headquartered in the State of California in the United States (“we,” “us,” “our,” and “GoVyrl”) and operates a variety of Websites and online marketing services and applications, including the Carro application and Carro APIs (the “Services”).

GoVyrl is passionate about connecting Brands with their customers, subscribers, and social media followers. Our Services enable Brands to identify and communicate with Contacts and Influencers in their networks for their marketing purposes. Our Services also enable Brands to get real-time data analytics on how their Contacts and Influencers are interacting with their Brand. Our Services also provide Contacts and Influencers with the opportunity to receive discounts and free items from the Brands that they already love and follow.

Find out more about our Services at www.vyrl.co and www.getcarro.com.

b. Key Terms

In this privacy policy, these terms have the following meanings:

“Contact” is a person a Brand may contact through our Services. In other words, a Contact is anyone on a Brand’s Distribution List or about whom a Brand has given us information. For example, if you are a Brand, a subscriber to your email marketing campaign, a social media follower, or a purchaser of your products, would be considered a Contact.

“Influencer” is a person with 5,000 or more followers on a social media network. This number may be updated from time to time. Brands may have Contacts who are Influencers in their Brand’s Distribution Lists. Influencers may also choose to opt-in to our Services directly for the purposes of receiving communications and discounts from Brands.

“Distribution List” is a list of Contacts a Member may upload or manage on our platform and all associated information related to those Contacts (for example, email addresses).

“Brand” means any person or entity that is registered with us to use the Brand-side Services.

“Personal Information” means any information that reasonably identifies a natural person who is a Brand, a Contact, an Influencer, or a Visitor. Examples of Personal Information include, but are not limited to, first and last name, date of birth, email address, gender, occupation, or other demographic information.

“Website(s)” means any website(s) we own and operate (such as www.vyrl.co or www.getcarro.com) or any web pages, interactive features, applications, widgets, blogs, social networks, social network “tabs,” or other online, mobile, or wireless offerings that post a link to this privacy policy.

“Visitor” means any natural person who visits any of our Websites.

“You” and “your” means, depending on the context, either a Member, a Contact, an Influencer, or a Visitor.

Privacy for Brands

This section applies to the Personal Information we collect and process from individuals who are Brands or potential Brands through the provision of the Services. If you are not a Brand, the Contacts and Influencers or Visitors section of this policy may be more applicable to you and your data. In this section, “you” and “your” refer to Brands and potential Brands.

a. Information We Collect

The Personal Information that we may collect broadly falls into the following categories:

Information You Give Us. You may give us information about you. Personal Information is often, but not exclusively, provided to us when you sign up for and use the Services, consult with our customer service team, send us an email, integrate the Services with another website or service (for example, when you choose to connect your e-commerce account with Carro), or communicate with us in any other way. The categories of information include:

Identifiers such as real name, address, email address, phone number, employer, job title, username, and password for account registration and administration. All passwords are encrypted using secure cryptographic keys that exist only in the possession and under the control of our Brands. We have no way of accessing or providing decrypted passwords.

Commercial information such as your billing address, shipping address, transactions and purchases of the Services. We do not store or process payment information, such as your credit or debit card number or your bank account number.

Internet or other electronic network activity information, such as interactions with our Carro App, interactions with our APIs, and communications and responses with your Contacts or Influencers through our Services.

You may also give us information about Contacts in your Distribution List. Please see the Additional Terms for Brands for your obligations with respect to the privacy of your Contacts’ data.

Information We Automatically Collect. Like many website operators, we collect information that your browser sends whenever you visit our website. We use cookies and other tracking technologies to collect some of this information. Learn more in our Cookie Policy.

The categories of information include:

- Device information: We collect information about the device and applications you use to access the Services, such as your IP address, your operating system, your browser ID, and other information about your system and connection.

- Log data: Our web servers keep log files that record data each time a device accesses those servers and those log files contain data about the nature of each access, including originating IP addresses. We may also access metadata and other information associated with files that you upload into our Services.

- Product usage data: We collect usage data about you whenever you interact with our Services, which may include the dates and times you access the Services and your browsing activities (such as what portions of the Services are used). We also collect information regarding the performance of the Services.

We generally collect this information in the aggregate. We do not associate this information with you or your computer, unless you specifically ask us to troubleshoot any technical or security issues you have with using our websites, or we need to investigate a violation of our Terms.

Information We Collect From Third Parties. From time to time, we may obtain information about you from third-party sources, such as public databases, public profiles on social media platforms, and third-party data providers. We take steps to ensure that such third parties are legally and/or contractually permitted to disclose such information to us.

b. How We Use the Personal Information

We may use the Personal Information we collect through the Services or other sources for a range of reasons, including:

- To provide you with the Services on our Websites.

- To communicate with you about your account and provide customer support.

- To bill and collect money owed to us by you.

- To share with third-party marketing platforms (e.g. Google Ads, Facebook Ads) to provide tailored advertising on our Websites and other websites that you may visit.

- To market our products and/or services to you.

- To analyze Website usage and improve the services offered.

- For market research, project planning, troubleshooting problems.

- For detecting and protecting against error, fraud or other criminal activity.

- To enforce compliance with our Terms and applicable law, and to protect the rights and safety of our Brands and third parties, as well as our own. This may include developing tools and algorithms that help us monitor the use of our Services and prevent violations.

c. How We Share the Personal Information

Affiliates and Service Providers. We share your information with our third-party service providers and any subcontractors as required to offer you our products and services. For example, we use third-party credit card processors to process billing and payments. These service providers are under a duty of confidentiality.

Third Party Marketing and Advertising Organizations. Through website cookies, which you may manage through our cookie banner, we share your information with third party marketing and advertising partners, such as Google, Facebook, Instagram, and YouTube to provide tailored advertising on our Sites and other websites that you may visit.

Third Party Links and Websites. Our website may contain links to and from the websites of third parties. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any data to these websites.

Social Media. Our website may include social media buttons or widgets (“social media elements”). These social media elements may collect your IP address, which page you are visiting on our site, and may set a cookie to enable the feature to function properly. Social media elements are governed by the privacy policy of the social media company providing the feature and/or widget.

Disclosures Required by Law. We may be required to disclose your data in response to lawful requests by public authorities, including to meet law enforcement requirements. We may be under a duty to disclose or share your personal data in order to comply with any legal obligation, to enforce or apply our Terms and other agreements, to protect our rights, property, or safety, or the protect the rights, property, or safety of others. This includes exchanging information with other companies and organizations for the purposes of fraud protection.

d. Legal Bases for Processing (EEA Individuals)

If you are from the European Economic Area, our legal bases for collecting and using your Personal Information is as follows:

- The performance of your contract or to enter into the contract and to take action on your requests. For example, the processing of your Carro account registration, providing information on your interactions with our Carro App, providing communications with your Contacts on the Carro App, and facilitating discounts and free product requests from your Contacts.

- Our legitimate business interests. For example, fraud prevention, maintaining the security of our network and services, direct marketing to you, and improvement of our services.

- Compliance with a mandatory legal obligation. For example, accounting and tax requirements, which are subject to mandatary retention periods. We may also collect your Personal Information to record your requests to exercise your rights and to verify your identity for such requests.

- Consent you provide where we do not rely on another legal basis. Consent may be withdrawn at any time.

- In some limited cases, we may also have a legal obligation to collect Personal Information from you, in response to lawful requests by public authorities, including to meet law enforcement requirements, as described above in “How We Share the Personal Information?”

If you have questions about or need further information concerning the legal bases on which we collect and use your Personal Information, please contact us using the contact details provided in the “Contact Information” section below.

Privacy for Contacts and Influencers

This section applies to the Personal Information we collect and process from individuals who are Contacts or Influencers. If you are not a Contact or Influencer, the Brand or Visitors section of this policy may be more applicable to you and your data. In this section, “you” and “your” refer to Contacts and Influencers.

a. Information We Collect

The Personal Information that we may collect broadly falls into the following categories:

Information We Receive From Brands. Brands may provide us Personal Information about you through the Services. For example, when a Brand uploads their Distribution List or integrates the Services with another website or service (for example, when a Brand chooses to connect their e-commerce account with Carro), or when you sign up for a Brand’s Distribution List through the Carro signup procedure, they may provide us with your Personal Information. This information includes:

- Identifiers such as real name, address, email address, job title, company, or phone number.

- Internet or other electronic network activity information, such as your public profile on social media accounts. Depending on your privacy settings for your social media account, this includes your profile picture, social media handle, number of followers, bio, if you’re verified and your location by city and country.

- Commercial information, such as products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies through the Brand’s Shopify account. This also includes your free or discounted product requests through our Influencer enabled checkout.

Brands are responsible for their privacy and security practices. You may have the opportunity to update some of your information by electing to update or manage your preferences directly with the Brand.

Information You Give Us. If you are a Contact or an Influencer, you may choose to give us information about you directly. You may provide us information in the following ways:

- By contacting us directly through a webform, email, social media message, or otherwise submit inquiries through our Websites.

-By attending our events or other business interactions and providing your contact details.

- By authenticating through a social media account in order to sign up for a free or paid GoVyrl or Carro account and request free or discounted products from Brands

- By applying for a role with GoVyrl.

The categories of information include:

- Identifiers such as real name, address, email address, job title, company, or phone number.

- Your public profile on social media accounts – depending on your privacy setting for your social media account, this includes your profile picture, social media handle, number of followers, bio, if you’re verified and your location by city and country.

- If you authenticate through a social media account, we collect your browsing behavior on the websites of Brands that have opted-in to our Services, in order to provide you free or discounted products from these Brands.

- Interactions with our Carro App and communications and responses with Brands on the Carro App.

- Inferences from the Personal Information above to help Brands determine your influencer level and level of authenticity and engagement on social media accounts.

- Employment information and job history for individuals who apply for a role with GoVyrl.

Information We Automatically Collect. Like many website operators, we collect information that your browser sends whenever you visit our website. We use cookies and other tracking technologies to collect some of this information. Learn more in our Cookie Policy.

The categories of information include:

We generally collect this information in the aggregate to improve our services. We do not associate this information with you or your computer, unless:

- You have chosen to sign up for Services that require tracking across websites. For example, if you wish to sign up for Carro-enabled discounts and free products across Brand websites, we need to track whether you are interacting with a particular Brand’s shopping cart.

- You have asked us to troubleshoot any technical or security issues you have with using our website or application.

- We need to investigate a violation of our Terms.

Information We Collect From Third Parties. From time to time, we may obtain information about you from third-party sources, such as public databases, public profiles on social media platforms, public posts on social media platforms, and third-party data resellers. We take steps to ensure that such third parties are legally and contractually permitted to disclose such information to us.

b. How We Use the Personal Information.

We may use the Personal Information we collect from Brands or other sources for a range of reasons, including:

- To give you information about free products or discounts from Brands that you already follow or buy from.

- To give Influencers the opportunity to contact Brands directly and request free products or discounts.

- To engage in automatic processing and/or profiling, based on measurements and analytics of Contacts and Influencers’ publicly available social media presence, posts, and follower engagement, to provide Brands with a Carro Score and recommended Influencer collaborations. You have the right to opt out of automatic processing and/or profiling.

- To communicate with you about your account and provide customer support.

- Through our website cookies, which you may manage through our cookie banner, to share with third-party marketing platforms (e.g. Google Ads, Facebook Ads) to provide tailored advertising on our Websites and other websites that you may visit.

- If you have signed up through GoVyrl or Carro directly, to market our products and/or services to you.

- To analyze Website usage and improve the services offered.

- For market research, project planning, troubleshooting problems.

- For detecting and protecting against error, fraud or other criminal activity.

c. How We Share the Personal Information.

Brands. We share your public information with Brands that you already follow or buy from, so Brands can contact you with offers for discounted or free products. We may share this information with Brands through avenues such as the Carro browser dashboard, the Carro application dashboard, or through tools and APIs that may integrate with our products and/or services. In order to help protect your privacy, we ask Brands to abide by our Additional Terms for Brands. These terms require Brands to only communicate with (i) Contacts or Influencers that they already have a relationship with, or (ii) Influencers that have opted-in directly to our Services for the purposes of receiving communications and discounts from Brands. These terms also require Brands to respect your privacy when they contact you. If you would like to opt out of this sharing of information with Brands in exchange for discounted or free products, please contact us at the contact information below or submit a request online.

Affiliates and Service Providers. We share your information with our third-party service providers and any subcontractors as required to offer you our products and services. These service providers are under a duty of confidentiality.

Deidentified and Aggregate Data. We may share deidentified and aggregate data with Brands or other third parties to analyze sales and customer trends. This data cannot be reasonably identified to an individual and is not Personal Information.

d. Legal Bases for Processing (EEA Individuals)

If you are from the European Economic Area, our legal bases for collecting and using your Personal Information is as follows:

- As a processor for Brands. As part of our contract with Brands, we allow them to communicate with, and analyze sales data from, Contacts and Influencers who are already their customers and followers. Where Brands have also requested a Carro Score or similar analytics services in their contract, we also provide Brands with information obtained from Contacts and Influencers’ publicly available social media presence, posts, and follower engagement, to provide Brands with a Carro Score and recommended Influencer collaborations. Brands are responsible for the privacy and security of the Personal Information they collect from you prior to uploading them into our databases.

- The performance of your contract or to enter into the contract and to take action on your requests. For example, the processing of your Carro account registration, providing information on your interactions with our Carro App, providing communications with Brands on the Carro App, and facilitating discounts and free product requests from Brands.

- Our legitimate business interests. For example, fraud prevention, maintaining the security of our network and services, direct marketing to you where you have signed up for GoVyrl or Carro directly, and improvement of our services.

- Consent you provide where we do not rely on another legal basis. Consent may be withdrawn at any time.

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Information, please contact us using the contact details provided in the “Contact Information” section below.

Privacy for Visitors

This section applies to Personal Information that we collect and process through our Websites and in the usual course of our business, such as in connection with our sales and marketing activities, recruitment, and events. In this section “you” and “your” refers to Visitors.

If you sign up for a GoVyrl account and use it to communicate with Brands, please go to Section 3 regarding Privacy for Contacts and Influencers.

a. Information We Collect.

The Personal Information that we may collect broadly falls into the following categories:

Information You Give Us. If you are a Visitor, you may choose to give us information about you directly. You may provide us information in the following ways:

- By contacting us directly through a webform, email, social media message, or otherwise. submit inquiries through our Websites.

- By attending our events or other business interactions and providing your contact details.

- By entering into our sweepstakes or drawings.

- By applying for a role with GoVyrl.

The categories of information include:

- Identifiers such as real name, address, email address, job title, company, or phone number.

- Employment information and job history for individuals who apply for a role with GoVyrl.

The categories of information include:

- Device information: We collect information about the device and applications you use to access the Websites, such as your IP address, your operating system, your browser ID, and other information about your system and connection.

We generally collect this information in the aggregate to improve the performance of our Websites. We do not associate this information with you or your computer, unless we need to investigate a violation of our Terms.

b. How We Use the Personal Information

We may use the Personal Information we collect for a range of reasons, including:

- Through website cookies, which you may manage through our cookie banner, we share your information with third-party marketing platforms (e.g. Google Ads, Facebook Ads) to provide tailored advertising on our Websites and other websites that you may visit

- To market our products and/or services to you

- To analyze Website usage and improve the services offered

- For market research, project planning, troubleshooting problems

- For detecting and protecting against error, fraud or other criminal activity

c. How We Share the Personal Information.

Affiliates and Service Providers. We share your information with our third-party service providers and any subcontractors as required to offer you our products and services. These service providers are under a duty of confidentiality.

Third Party Links and Websites. Our Websites may contain links to and from the websites of third parties. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any data to these websites.

d. Legal Bases for Processing (EEA Individuals).

If you are from the European Economic Area, our legal bases for collecting and using your Personal Information is as follows:

- Our legitimate business interests. For example, fraud prevention, maintaining the security of our network and services, direct marketing to you, and improvement of our services.

- Consent you provide where we do not rely on another legal basis. Consent may be withdrawn at any time.

Your Privacy Choices

a. General

Marketing Opt-Out From Brands: If you no longer want to be contacted by one of our Brands through our Services, please unsubscribe directly from that Brand’s email list or contact the Brand directly to update or delete your data.

Marketing Opt-Out From GoVyrl Communications: If you have opted-in to GoVyrl or Carro directly, we may use your Personal Information to contact you with newsletters, marketing or promotional materials and other information that may be of interest to you. You may opt out of receiving any, or all, of these communications from us by following the unsubscribe instructions provided in any email we send. You will still continue to receive service-related messages concerning our Services.

Opt-Out From Carro Dashboard: Influencers have the option to remove their profiles from our Brand dashboard by using the contact form below or submitting a request online. Once removed, Brands would no longer be able to contact you for partnership opportunities.

Exercising Your Privacy Rights: We have listed the privacy rights for several jurisdictions below, but we understand you may have additional rights in your jurisdiction. You may contact us directly at any time about exercising your data protection rights. We will consider your request in accordance with applicable laws, and may remove or update your information within a reasonable time and after providing notice to the Brand of your request. If you authenticated into the Services via Instagram, we will remove any “User Content” (as defined in the Instagram Platform Policy) or other information that you request within a reasonable time (please write to remove@getcarro.com). We may ask you to verify your identity in order to help us respond efficiently to your request.

b. California Residents

Third Party Marketing. California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your Personal Information to third parties for the third parties’ direct marketing purposes. To make such a request, please contact us at the Contact Information below.

California Consumer Privacy Act. If you are a California consumer, you have the following rights beginning on January 1, 2020:

- The right to know what Personal Information is being collected about you.

- The right to know whether your Personal Information is sold or disclosed and to whom.

- The right to say no to the sale of Personal Information.

- The right to access your Personal Information.

- The right, in certain circumstances, to delete the information you have provided to us.

- The right to equal service and price, even if you exercise your privacy rights, unless the difference in service and/or price is reasonably related to the value provided to the you by your Personal Information.

Requests for Deletion and Information. In certain circumstances, California consumers have the right to request that we delete their information. In addition, California consumers have the right to request, up to twice in a 12-month period, that a business that collects Personal Information about the consumer disclose to the consumer the information listed below for the preceding 12 months. We have the right to request verification of your identity for all requests for information.

(1) The categories of Personal Information it has collected about that consumer.

(2) The categories of sources from which the Personal Information is collected.

(3) The business or commercial purpose for collecting or selling Personal Information.

(4) The categories of third parties with whom the business shares Personal Information.

(5) The categories of Personal Information that the business sold about the consumer and the categories of third parties to whom the Personal Information was sold, by category or categories of Personal Information for each third party to whom the Personal Information was sold.

(6) The categories of Personal Information that the business disclosed about the consumer for a business purpose.

(7) The specific pieces of Personal Information it has collected about that consumer.

To make such a request, please contact us at the contact information below.

Do Not Sell My Personal Information. We are not data brokers and we do not sell your data on the open market. However, under California’s new privacy law, the California Consumer Privacy Act, some of the ways we share information may constitute a “sale.”

- If you are an Influencer, we may share public information about you with Brands that you already follow or buy from. You may also opt-in with us directly to discover new Brands. To remove your profile from Carro, or to make a privacy request, please contact us at the contact information below or submit a request online.

- If you are a website visitor, we use third party cookies on our website in order to serve you relevant ads on other websites. You may opt out of such cookies through our cookie banner or through your browser settings. See our Cookie Policy for more information.

c. EEA Residents

EEA Privacy Rights. If you are from the European Economic Area, you have the right, under certain circumstances, to:

- Access your Personal Information;

- Correct inaccurate Personal Information;

- Request erasure of your Personal Information without undue delay;

- Request the restricted processing of your Personal Information;

- Request portability of the Personal Information that you have given us; and

- To object to the processing of your Personal Information, including the ability to object to automated processing and/or profiling.

If you are from the European Economic Area, you also have the right to lodge a complaint with a supervisory authority, under certain circumstances.

You may contact us at the contact information below for more information, or to exercise your rights.

International Transfers

Any data that you provide to us may be accessed, shared or processed by our offices, located in the United States, and service providers located in the United States and abroad, if such data transfer is necessary for the specific purpose for which you submitted your data (such as the provision of goods or services under a written contract). This may entail a transfer of your Personal Information across international borders, including, but not limited to, transfers from within the European Economic Area (the “EEA”) to the United States. The data protections standards may differ and be lower than the standards enforced in your jurisdiction. We maintain appropriate safeguards as required by applicable law for any Personal Information transferred internationally, and as required by applicable law, will seek your consent prior to such transfers.

Children's Privacy

This website is not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with Personal Information, please contact us at the Contact Information below. If we become aware that a child under 16 has provided us with Personal Information, we will take steps to delete such information.

In accordance with our Additional Terms for Brands, Brands are also required to implement age-gating techniques appropriate to the products and services they provide. If you become aware that an individual or Brand has provided us with Personal Information in violation of these Additional Terms (e.g. Personal Information from individuals under 18 for tobacco products or adult services), please contact us at the Contact Information below.

Do Not Track

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. DNT is a way for users to inform websites and services that they do not want certain information about their webpage visits collected over time and across websites or online services. We do not recognize or respond to browser-initiated DNT signals, as the Internet industry is currently still working toward defining exactly what DNT means, what it means to comply with DNT, and a common approach to responding to DNT.

Cookie Policy

To make our Websites and Services work properly, and to provide tailored advertising, we sometimes place small data files called cookies on your device. A cookie is a small text file that a website saves on your computer or mobile device when you visit the site. It enables the website to remember your actions and preferences (such as login, shopping cart, or other preferences) over a period of time, so you don’t have to keep re-entering them whenever you come back to the site or browse from one page to another. To learn more, please see our Cookie Policy.

Change of Control

Personal information may be transferred to a third party as a result of a sale, acquisition, merger, reorganization or other change in control. If we sell, merge or transfer any part of the business, part of the sale may include your Personal Information.

Data Retention

Our retention periods will vary depending on the type of data involved, but, generally, we’ll refer to these criteria in order to determine the appropriate retention period:

- Whether we have a legal or contractual need to retain the data.

- Whether the data is necessary to provide our Services.

- Whether our Brands have the ability to access and delete the data within their GoVyrl accounts.

- Whether our Brands would reasonably expect that we would retain the data until they remove it or until their GoVyrl accounts are closed or terminated.

When we have no ongoing lawful basis to process your Personal Information, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible.

Security Protections

We take appropriate and reasonable technical and organizational measures to protect Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the Personal Information.

GoVyrl accounts require a username and password, or social media authentication, to log in. Account holders must keep their username and password secure, and never disclose it to a third party in accordance with our Terms.

Policy Changes

We may change this privacy policy at any time and from time to time. The most recent version of the privacy policy is reflected by the date located at the top of this privacy policy. All updates and amendments are effective immediately upon notice, which we may give by any means, including, but not limited to, by posting a revised version of this privacy policy or other notice on the Websites. We encourage you to review this privacy policy often to stay informed of changes that may affect you. Our electronically or otherwise properly stored copies of this privacy policy are each deemed to be the true, complete, valid, authentic, and enforceable copy of the version of this privacy policy that was in effect on each respective date you visited the Websites.

Contact Information

If you have any questions or comments, or if you have a concern about the way in which we have handled any privacy matter, please contact us by postal mail or email at:

For EEA Residents:
GoVyrl’s Data Protection Officer can be contacted at privacy@getcarro.com.

For Non-EEA Residents:
GoVyrl, Inc.
Attn. Privacy Officer
privacy@getcarro.com
2372 Morse Avenue, Ste. 128
Irvine, California 92614