Privacy Policy

Virelta (“Virelta”, “we”, “us”) is the controller of personal data processed through virelta.io.

• Legal entity: TODO — your name or company name
• Address: TODO — postal address
• Email: privacy@virelta.io

We collect the minimum needed to run the service:

Our product analytics (PostHog) honors the browser Do-Not-Track signal and only creates a persistent profile once you sign in; we do not record transcripts or generated content in analytics, and autocapture is off (we send a small, curated set of events). We do not collect: card numbers (Stripe holds these), precise location, advertising identifiers, or any data from third-party ad trackers.

We use the following sub-processors to run Virelta. Each operates under their own Data Processing Agreement and privacy terms.

Transfers outside the EEA rely on Standard Contractual Clauses (SCCs) as required by GDPR Art. 46.

When you generate content, your transcript is sent to one or more of OpenAI, Anthropic, and Google Gemini under their respective API terms:

• OpenAI API: Does not use inputs for model training.
• Anthropic API: Does not use inputs for model training.
• Google Gemini API: Behavior depends on the API tier we operate. Paid-tier usage does not train Google’s models. Free-tier usage MAY be used by Google to improve their products. Our current tier is shown at the bottom of this section.

Current Virelta operation: Gemini free tier (training-eligible)

If model-training opt-out matters to you (regulated content, NDA material, attorney-client work), wait for our paid-tier transition or run the open-source version on your own keys.

You can save your own API keys (Google Gemini, OpenAI, Anthropic) so your generations run against your provider account instead of ours. When a key is set:

• Storage: encrypted at rest with AES-256-GCM using a server-side key that’s separate from the database itself (in env, not in Postgres).
• Transport: TLS in transit, never written to logs or analytics.
• Read-back: we never return the plaintext key to your browser — only a masked preview like AIza…xyz.
• Use: applied only to your generation requests; routed straight to the provider, no intermediate storage of the request body.
• Deletion: removed instantly when you delete the key in Settings, and wiped along with your account if you delete it.

Your key never leaves our infrastructure to anywhere except the provider you set it for. If a third party (say, OpenAI) ever issued a security advisory affecting their API keys, we’d notify you to rotate.

We use a small number of first-party cookies: strictly-necessary ones for sign-in and your workspace, plus privacy-friendly product-analytics cookies (PostHog) used only to measure how the app is used. We do not use advertising or third-party ad-tracking cookies.

Strictly-necessary cookies do not require consent under ePrivacy Directive Art. 5(3). Our analytics cookies are first-party and privacy-friendly, honor Do-Not-Track, and are not used for advertising. To opt out, enable “Do Not Track” in your browser, or email us to request deletion of your analytics data.

• Active accounts: data is kept while the account exists.
• Inactive accounts: after 24 months with no sign-in, we may email you and then delete the account if you don’t return.
• Deleted accounts: personal data is purged within 30 days, except where retention is legally required (Stripe invoices for tax records, security/audit logs).
• Backup retention: encrypted backups roll off after 30 days.

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access a copy of your data (Art. 15) — built into the app at Settings → Export.
• Rectify inaccurate data (Art. 16) — edit it in Settings or email us.
• Erase your account (Art. 17) — Settings → Delete account, or email us.
• Restrict processing (Art. 18) — email us.
• Object to processing based on legitimate interest (Art. 21) — email us.
• Portability of your data in a structured format (Art. 20) — the export is machine-readable JSON.
• Withdraw consent at any time, where consent is the legal basis.

We respond within 30 days. Email privacy@virelta.io.

Right to complain. If you believe we have mishandled your data, you can lodge a complaint with your local supervisory authority. A list is published at edpb.europa.eu.

You have the right to know what personal information we collect, to delete it, to correct it, and to opt out of any “sale” or “sharing”. We do not sell or share personal information for advertising. To exercise these rights, email privacy@virelta.io.

The Service is not directed to users under 16. If you become aware that a child has provided us with personal data without parental consent, contact us and we will delete it.

Data is encrypted in transit (TLS) and at rest at our infrastructure providers. Passwords are hashed by Supabase (Argon2). We do not have access to your password. If we ever suffer a breach affecting your data, we will notify you in line with GDPR Art. 33-34.

Security reports: security@virelta.io (we publish a /.well-known/security.txt).

Virelta uses AI to generate content suggestions. These are suggestions for you to review and edit. We do not make automated decisions with legal or similarly significant effects on you (GDPR Art. 22 does not apply).

Material changes will be announced in-app or by email at least 7 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Privacy questions: privacy@virelta.io
Security reports: security@virelta.io
Everything else: hello@virelta.io