Privacy Policy

Virtual ("Virtual", "we", "us", "our") is an AI-powered video intelligence platform operated by Virtual, Inc. Our registered address and data controller contact is: team@heyvirtual.me.

This policy explains what personal data we collect from creators (people who upload recordings) and viewers (people who watch and ask questions), how we use it, and what rights you have.

2.1 Account data (creators only)

When you sign up via Supabase Auth, we collect your email address and a hashed password (or OAuth token if you use Google/GitHub sign-in). We use this solely to authenticate you and associate your recordings with your account.

2.2 Recording content

When you upload an MP4, we store the file in S3-backed object storage. We derive transcript text (via Whisper-class transcription), video frame descriptions (via GPT-4o-mini vision), and vector embeddings for semantic search. These derived artefacts are tied to your recording and only accessible to you and the viewers you share the link with.

2.3 Viewer questions

When a viewer asks a question on a Virtual viewer link, we store the question text, the timestamp the viewer was watching, and whether our classifier determined it was a content doubt or conversational. This data is associated with the recording, not with the viewer's identity, viewers never create accounts.

2.4 Usage and analytics

We collect aggregate usage metrics (questions asked, recordings uploaded, storage consumed) to enforce plan limits and improve the service. We do not use third-party behavioural tracking (e.g. Google Analytics, Mixpanel) at this time. Server logs may include IP addresses and user-agent strings, retained for up to 30 days for security purposes.

2.5 Billing data

Payments are processed by a third-party payment processor. We do not store card numbers or bank details. We receive only tokenised references and plan-status webhooks.

2.6 Support communications

If you contact us at team@heyvirtual.me, we retain that correspondence to resolve your issue and improve support quality.

• To provide the Virtual service: transcription, AI answering, heatmap computation, and doubt clustering.
• To enforce your plan limits and process billing.
• To send you transactional emails (account creation, plan changes, payment receipts).
• To send you product updates and beta announcements, you can unsubscribe any time.
• To detect and prevent abuse, fraud, and security incidents.

We never sell your personal data. We never use your private recordings or your viewers' questions to train any AI model, ours or anyone else's.

Virtual uses third-party AI APIs to power its core features:

• OpenAI (GPT-4o-mini): Used for video frame description and question classification. Frame images and question text may be sent to OpenAI's API. OpenAI's data-processing agreement applies.
• Anthropic (Claude Sonnet): Used to generate streaming answers to viewer questions. Question context and transcript excerpts may be sent to Anthropic's API. Anthropic's data-processing agreement applies.
• Whisper-class transcription: Audio tracks are processed to generate transcripts. This processing occurs server-side.

These providers are bound by their own privacy and data-processing commitments and do not use customer-submitted data to train their foundation models under their API terms.

Recordings and derived data are stored in Amazon S3 using server-side encryption (AES-256). Access is gated by unguessable presigned URLs that expire. Metadata is stored in a hosted PostgreSQL database (Supabase) with row-level security policies.

We are SOC 2 Type II in progress. While we implement security best practices, no system is 100% secure. If you discover a vulnerability, please report it to team@heyvirtual.me.

During the beta period, your data is retained for as long as your account is active. You can delete individual recordings at any time. You can delete your account and all associated data by emailing team@heyvirtual.me.

We share your data only in the following circumstances:

• With service providers who process data on our behalf (AWS, Supabase, OpenAI, Anthropic, payment processor) under contractual data protection obligations.
• With viewers you share a link with, they see the recording content and can read AI-generated answers. They cannot access your account or other recordings.
• When required by law, if compelled by a valid legal order, we will notify you to the extent permitted.
• In a business transfer, if Virtual is acquired or merged, your data may transfer to the successor entity, who will be bound by this policy.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (right to erasure).
• Restrict or object to certain processing.
• Data portability, receive your data in a machine-readable format.
• Withdraw consent at any time where processing is consent-based.

To exercise any of these rights, email team@heyvirtual.me. We will respond within 30 days.

Virtual uses only essential session cookies set by Supabase Auth to maintain your login state. We do not use advertising cookies, fingerprinting, or cross-site tracking. No cookie consent banner is displayed because we only set strictly necessary cookies.

Virtual is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at team@heyvirtual.me and we will delete it promptly.

We may update this policy as the product evolves, especially during the beta period where features are actively being built. We will indicate the "Last updated" date at the top and, for material changes, notify you by email or in-app banner at least 14 days before the change takes effect.

Questions about this policy: team@heyvirtual.me
General support: team@heyvirtual.me