Privacy Policy

VirtuaChat is the controller of the personal data described in this policy. You can reach us about anything privacy-related at support@virtuachat.com.

If you use VirtuaChat on behalf of an organisation and process other people's personal data through it, our Data Processing Agreement also applies.

• Your chats are private. Conversations are encrypted at rest and are never shown to our staff — not even in our admin tools.
• AI providers process your prompts only to answer them. We send what you type (and files you attach) to the AI model you choose so it can generate a reply.
• We never sell your personal data and we don't use your conversations for advertising.
• Analytics and marketing cookies are optional. They only run if you allow them.
• You're in control. You can delete any chat, file, image or audio clip, or your whole account, at any time.

Account details. Your name, email address, password (stored only as a secure one-way hash, never in readable form), profile picture if you sign in with Google, and your settings — such as theme, custom instructions and whether you want marketing emails.

Sign-in and security data. Login sessions (device type, browser, approximate location from your IP address, and when each session was last used), verification and password-reset codes, and security events. You can see and sign out your devices in Settings → Security.

Visitor data for guests. If you use VirtuaChat without an account, we set a random visitor identifier so your free guest credits and conversations stay with your browser. To stop people claiming free credits or trials over and over, we also record limited technical signals such as IP address, screen size, time zone, language and platform.

Your content. Messages you send, the replies you receive, files you upload, images and audio you generate, memories VirtuaChat saves for you and your custom instructions ("content").

Usage data. How many credits each action used, which model or tool was used, generation counts and errors — but never the text of your conversations. We also record page visits (the page address, never the query string), the referring website and campaign tags such as utm_source.

Payment data. Payments are handled by Stripe and PayPal. We receive your billing name, country, the card brand, the last four digits and expiry date, and a card fingerprint used to apply our one-trial-per-card rule — never your full card number or security code. We keep a record of your plan, invoices, payments and subscription changes.

Communications. Messages you send to support, feedback ratings and comments, and whether you open or click our emails.

• To provide the service (performance of our contract with you): creating your account, keeping you signed in, running chats, tools and generations, saving your history, applying your plan and credits.
• To keep VirtuaChat safe (our legitimate interests): preventing fraud, abuse, spam and credit farming, enforcing our Acceptable Use Policy, and securing accounts.
• To process payments and keep records (contract and legal obligation): billing, invoices, tax and accounting.
• To improve VirtuaChat (legitimate interests, and consent where required): understanding which pages and features are used, measuring performance and fixing problems — using usage data, not the content of your chats.
• To talk to you: essential service emails such as verification codes, receipts and security alerts (contract); and, if you agree, tips, product news and offers (consent — you can withdraw it at any time).
• To meet legal requirements: responding to lawful requests and protecting our rights.

Your conversations, uploaded files and saved memories are encrypted at rest in our database and storage. Our admin tools are deliberately built so that staff cannot read your messages, prompts, generated content or uploaded files. We only see counts and totals, such as how many messages were sent or how many credits were used.

In rare cases we may be legally required to provide data to authorities. We will only do so when the request is valid and, where allowed, we will tell you first.

We do not use your conversations to train our own models or sell them to anyone.

To generate answers, images and audio, we send the necessary content to the AI provider behind the model or feature you use:

• DeepSeek — powers Virtua, our default model, and some free tools.
• OpenAI — GPT models, image generation, text-to-speech audio and voice transcription.
• Google — Gemini models.
• A web search provider — when web search is used, the search query (not your whole conversation) is sent to retrieve results.

These providers process your content only to return a result to us, under their API terms and data-processing commitments. Their API services are not used to show you ads. Depending on the provider, inputs may be retained for a limited period for abuse monitoring. Please don't include sensitive information — such as health data, passwords or payment details — in your prompts unless you need to.

Images and audio you generate, and files you upload, are stored on our servers and content delivery network so you can view, play and download them from your library.

• They are private by default. An image is only visible to others if you choose to share it publicly (for example in the public gallery), and you can make it private again at any time.
• When you delete an item, it is removed from your library immediately and deleted from our storage shortly after (usually within 30 days, including backups).
• When you delete your account, all of your images, audio, files and chats are deleted.

We use three categories of cookies and similar technologies:

• Necessary — keep you signed in, protect against abuse (your visitor identifier and guest credits), remember your cookie choice and make checkout work. These are always on because the site can't work without them.
• Analytics — help us understand how VirtuaChat is used, for example with Google Analytics. Only with your consent.
• Marketing — measure whether our ads work, for example Google Ads conversion tracking. Only with your consent.

You can change your choice at any time with Cookie settings at the bottom of every page. See our Cookie Policy for the full list.

Payments are processed by Stripe (cards, Apple Pay, Google Pay) and PayPal. They handle your payment details under their own privacy policies and the PCI-DSS security standard. We never receive or store your full card number or security code.

We keep billing records — plan, amounts, dates, invoices and the limited card details listed above — for as long as tax and accounting laws require.

We send service emails that you can't opt out of while you have an account, because they're part of the service: verification codes, password resets, receipts, payment problems, security alerts and important changes to these terms.

With your permission we also send helpful and marketing emails — getting-started tips, reminders when your credits are running low, product news and occasional offers. Every one of these has an unsubscribe link, and you can switch them off any time in Settings → Notifications. We measure opens and clicks to improve our emails.

We share personal data only with service providers that help us run VirtuaChat, and only what each needs:

• Hosting and storage — the servers and CDN that run the website, database and media files.
• AI providers — DeepSeek, OpenAI and Google, as described in section 6.
• Payments — Stripe and PayPal.
• Sign-in — Google, if you choose "Continue with Google".
• Email delivery — to send service and marketing emails.
• Analytics and advertising — Google Analytics and Google Ads, only if you consent.

We may also disclose data if required by law, to protect people's safety, or as part of a merger or acquisition (in which case this policy will continue to apply). We never sell your personal data, and we don't "share" it for cross-context behavioural advertising as defined by Californian law without your consent.

Some of our providers are located outside your country, including in the United States. Where personal data from the EEA, UK or Switzerland is transferred, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK addendum), together with additional safeguards where needed.

• Account data — while your account is open. When you delete your account, we delete your profile, chats, files, memories, images and audio within 30 days (backups roll off within a further 30 days).
• Guest data — conversations and guest credits tied to a visitor identifier are deleted after a long period of inactivity.
• Security logs and sessions — up to 12 months.
• Billing records — as long as tax law requires (usually 6–10 years). They're kept separately and anonymised from your deleted account where possible.
• Support messages — up to 3 years after the conversation is closed.
• Analytics data — up to 26 months.

Depending on where you live (for example under the GDPR, UK GDPR or Californian law, including the CCPA/CPRA), you have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data — you can delete your account yourself in Settings → Danger zone;
• object to or restrict certain processing, including direct marketing;
• data portability — receive your data in a common format;
• withdraw consent at any time, for example for marketing emails or cookies;
• opt out of the sale or sharing of personal data (we don't sell it) and limit the use of sensitive data;
• not be discriminated against for using your rights.

To use any of these rights, email support@virtuachat.com from the address on your account. We'll reply within one month (45 days in California). You also have the right to complain to your local data protection authority.

We protect your data with encryption in transit (HTTPS) and at rest, hashed passwords, strict access controls, rate limiting and monitoring. Read more on our Security page. No online service can be 100% secure, so please use a strong, unique password and tell us straight away at support@virtuachat.com if you suspect unauthorised access to your account.

VirtuaChat is not intended for children. You must be at least 13 years old to use it — or older if the law in your country requires (for example 16 in some EU countries) — and users under 18 need permission from a parent or guardian. If you believe a child has given us personal data, contact us and we'll delete it.

We'll update this policy when our practices change. If the changes are significant, we'll tell you by email or with a notice in the app before they take effect. The date at the top always shows the latest version.

Questions, requests or complaints about privacy: support@virtuachat.com, or use our contact form. We're happy to help.