Must Be Viral

Privacy

This page says what mustbeviral.com does with information, as the site is built on 2026-10-02.

Last changed 2026-10-02.

ERLV INC, DBA Must Be Viral, in Houston, Texas. The street address is not yet published. Write to studio@mustbeviral.com or call 713-899-9346.

The home page, the Spanish home page, the pricing page, the software page, the plans page and these pages set no cookie, run no analytics and load no advertising tag. The typefaces are served from this site.

Booking a test shoot is a phone call: the button dials 713-899-9346. Requesting access to the software is an email to studio@mustbeviral.com. There is no contact or sign-up form on the sales and legal pages. The request-access page collects nothing and creates no account.

The browser measures three page-speed numbers for the page it is on (largest contentful paint, interaction to next paint, layout shift). In production nothing sends them anywhere.

People sign in with an email and a password handled by Supabase Auth. Accounts are not created on this site; enrollment is closed.

The sign-in, password-recovery and verification screens each take an email address and pass it to Supabase Auth, and nowhere else. Supabase Auth sends a recovery or verification message to that address when an account exists, and delivers it through Resend.

Signing in, opening a recovery or verification link, or asking for a recovery or verification email sets cookies that Supabase Auth uses: a session, or the code verifier that the link will need. A visitor who does none of these receives none. Signing out from the studio ends the session on every device where that account was signed in.

A signed-in studio’s records include its studios with their members and access grants, brands and brand knowledge, brand locations and onboarding drafts, campaign briefs, uploaded packshots, plans and their revisions, quotes, reservations and ledger entries, runs, receipts, exports, API keys, invitations, the comments and text drafts made on a plan, and an audit log of who did what.

Media is private. It is kept in private object storage and opened through short-lived signed operations, never through a public bucket.

An invitation can be accepted for seven days; after that it is shown as expired and the record stays on the studio’s list. No email is sent for an invitation.

While someone works, the browser keeps the brief draft and the last campaign step, with the identifiers of the records it belonged to, in its session storage. Validating a brief sends its contents to the Core service, which creates the campaign project and its first plan revision from it; the saved step itself is never sent. The sales and legal pages use no browser storage.

Nothing on this site deletes a record held in the database today. A person can delete their own comment, or clear their own text draft, on a plan; that removes it from the collaboration service. A brand or a location can be archived by anyone with write access to it, and its saved records remain available for reference; an invitation or an access grant can be revoked. Plan revisions are immutable records of each plan, and receipts are immutable records of what ran. Questions about the records a studio holds: write to studio@mustbeviral.com.

Vercel serves the site. Supabase holds the database and runs sign-in. Cloudflare runs the Core service, the collaboration service that, when it runs, holds the comments and text drafts made on a plan, and the private media store; the Core service writes its request logs to Cloudflare Workers Logs. When configured, the Core service reports errors to Sentry and traces to an OpenTelemetry endpoint.

No generation provider receives anything from this site today: on mustbeviral.com, generation, provider calls, queues and charging are switched off, and no run starts without a confirmed quote. Nothing on this site connects a social account or posts anywhere, and Google Drive is not connected to anything on this site today. The web app sends no mail. The Core service can send one message through Resend, a notice to the operator after a Stripe wallet credit, and only when a Resend key and from-address are configured on that service. A second mail adapter in the code is never called.

This page describes the site as built on 2026-10-02. The date above is when it last changed.