Privacy policy

This policy explains how personal data is handled when you visit virtualcmo.ai, run the free demo, create an account or use a paid VirtualCmo workspace.

Who is responsible for your data

The controller of personal data is the administrator of the virtualcmo.ai service. You can reach the administrator at [email protected] with any question about this policy or your data.

For data that customers bring into a workspace through connections or CSV import (for example CRM contacts or ad account data), the customer is the controller and the administrator of the virtualcmo.ai service acts as a processor on the customer's instructions. A data processing agreement is available on request.

What we collect

Demo data. The website address, revenue target, monthly budget and business model you enter, the generated result, and a one-way hash of your IP address used to limit the free demo to one run per day.
Account data. Your name if you give it, email address, a hashed password, sign-in codes sent by email, workspace name and role.
Billing data. Plan, billing period, invoices and the billing country. Card details are entered on the payment operator's page and never reach our servers.
Workspace data. Revenue goals, budgets, plans, recommendations, agent tasks, reports and the decision log, plus metrics synced from sources you connect.
Technical data. Server logs with IP address, browser type, pages requested and errors, kept for security and troubleshooting.

Why we use it and on what legal basis

To provide the demo, the account and the paid service you asked for (performance of a contract).
To send sign-in codes, service messages, invoices and the weekly CEO report you enabled (performance of a contract).
To keep the service secure, prevent abuse of the free demo and fix errors (legitimate interest).
To keep accounting records required by law (legal obligation).

We do not sell personal data and we do not use workspace data to train AI models shared with other customers.

Who processes data for us

We rely on a small number of service providers, each bound by a data processing agreement and allowed to use the data only to provide their service to us. The categories are:

a hosting and infrastructure provider in the European Union or the United States, depending on the workspace region;
a payment operator that processes card payments and subscriptions;
a transactional email delivery provider for sign-in codes, invoices and reports;
an AI model provider that processes prompts for paid workspaces under terms that forbid training on customer data;
the third-party tools you choose to connect, such as analytics, advertising, CRM and email platforms, under their own terms.

Where data is transferred outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision.

Cookies

The site uses only cookies that are strictly necessary for it to work: a session cookie, a security token that protects forms, and a cookie that remembers your sign-in. We do not use advertising or tracking cookies, so no consent banner is shown. Any visit statistics are counted without cookies.

How long we keep data

Demo results without an account, up to 90 days.
Account and workspace data, for as long as the account exists, then deleted within 30 days of closing it, except backups which roll over within a further 30 days.
Invoices and billing records, for the period required by tax law.
Server logs, up to 30 days.

Your rights

You can ask for access to your data, correction, deletion, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interest. Write to [email protected] from the address on your account. We answer within one month. You can also complain to your local data protection authority.

Security

Data is encrypted in transit and at rest, connection tokens are stored encrypted, connections are read-only by default and access inside a workspace follows roles. More on the security page.

Changes to this policy

If we change this policy in a way that matters, we tell account holders by email before the change takes effect.