Data Processing Agreement

For Customer Personal Data, you are the controller and we are your processor. For the data we collect to run your account — such as your login, billing and usage data — we act as an independent controller under our Privacy Policy.

• Subject matter: providing the Service — AI chat, image and audio generation, file analysis, memory and free tools.
• Duration: for as long as you use the Service, plus the deletion periods in section 9.
• Nature and purpose: storing, transmitting and processing content so AI models can generate the results you request.
• Data subjects: any people whose personal data you choose to include in your content.
• Types of data: whatever you include — usually names, contact details and text about people. Please don't include special categories of data (such as health data) unless you need to and have a lawful basis.

We will:

• process Customer Personal Data only on your documented instructions — these Terms, your use of the Service and your settings are your instructions;
• tell you if we believe an instruction breaks data protection law;
• make sure everyone authorised to process the data is bound by confidentiality — and, by design, our staff cannot view chat content or uploaded files in our admin tools;
• implement the security measures in section 5;
• help you, as far as reasonably possible, to respond to data subject requests and to meet your security, breach-notification and impact-assessment obligations;
• delete Customer Personal Data at the end of the Service, as described in section 9;
• make available the information needed to show we comply with this DPA, and allow for reasonable audits as described in section 10.

You confirm that you have a lawful basis to process Customer Personal Data with the Service, that you have given people any required notices, and that your instructions comply with the law.

• Encryption in transit (TLS) and at rest, including encryption of chat content and uploaded files.
• Access to production systems limited to authorised personnel, with two-step verification for administrators.
• Passwords stored as strong one-way hashes; sessions that can be reviewed and revoked.
• Rate limiting, abuse detection and input validation on every endpoint.
• Tamper-sealed records for credits and plans.
• Regular backups and the ability to restore data.
• Logging and monitoring of security-relevant events.

Read more on our Security page.

You authorise us to use the following sub-processors:

We bind every sub-processor to data protection terms at least as protective as this DPA. We'll update this list at least 14 days before adding or replacing a sub-processor that processes Customer Personal Data; you may object on reasonable grounds by emailing support@virtuachat.com, and if we can't resolve the objection you may stop using the Service.

Where Customer Personal Data is transferred outside the EEA, UK or Switzerland to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (Module 2 or 3 as appropriate) and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference.

If we become aware of a personal data breach affecting Customer Personal Data, we'll notify you without undue delay and within 72 hours, with the information you reasonably need to meet your own obligations, and we'll take reasonable steps to contain and fix it.

You can delete content — individual chats, files, images and audio — at any time, or delete your entire account in Settings. Deleted data is removed from live systems promptly and from backups within 30 days, unless the law requires us to keep it. You can export your content before deletion by copying or downloading it from the app, or by asking support@virtuachat.com.

On written request, no more than once a year, we'll answer reasonable security questionnaires and provide information showing compliance with this DPA. On-site audits can be arranged where required by law or a regulator, with reasonable notice, at your cost and subject to confidentiality.

Each party's liability under this DPA is subject to the limits in the Terms of Service, unless the law says otherwise. If this DPA and the Terms conflict on data protection, this DPA wins; if the Standard Contractual Clauses apply and conflict with either, the Clauses win.