Privacy notice

In short

• The Virtum platform and its databases run on servers Virtum operates in England.
• Virtum's AI features run on models hosted on hardware Virtum operates in the UK. We do not send your prompts or data to third-party AI providers unless your organisation connects its own, and we do not use your data to train AI models.
• We do not sell personal data, and this website uses no advertising or analytics cookies.
• Every early access request and application is decided by a person.
• You can object to marketing at any time, and we will stop.

Who we are

Virtum Cloud Ltd, registered in England and Wales, company number 17239759. Registered office: 38 Beechfield House, Macclesfield, Cheshire, SK11 0LP, United Kingdom. In this notice, "Virtum", "we" and "us" mean Virtum Cloud Ltd.

You can contact us at sales@virtum.cloud, or about your personal data at privacy@virtum.cloud.

We are the controller of the personal data described in this notice: we decide why and how it is used. We have not appointed a data protection officer, as the law does not require one for a business like ours; privacy@virtum.cloud reaches the people responsible for data protection at Virtum.

When we act for a customer instead

When an organisation uses the Virtum platform, the content it and its people put into its workspaces (documents, tasks, tickets, code, device and system records, AI conversations and so on) belongs to that organisation. The organisation is the controller of any personal data in that content, and we process it on its behalf under our data processing terms. The same applies to the visitors and customers of a website we build or run for a customer. If you want to use your data protection rights over that content, please contact the organisation concerned; we will help them respond.

The rest of this notice covers the personal data we decide about ourselves.

Connected social media and advertising accounts

An organisation can connect its own Facebook Pages, Instagram, Threads, LinkedIn, X, TikTok, YouTube and Google Business Profile accounts, and its Meta ad accounts, to Virtum. Each connection is made by someone at that organisation signing in on the network's own page; Virtum never sees their password.

What we receive: the access tokens the network issues; the identifiers, names, handles and profile links of the accounts, Pages and channels chosen; and statistics for those accounts and the posts Virtum publishes to them (followers, views, reach, likes, comments, shares, saves and clicks). For a connected ad account, its identifier, name, currency and the performance of campaigns run through Virtum.

What we use it for: only to publish the posts and adverts the organisation has approved, at the times it chose, and to show that organisation the statistics of its own accounts. We do not use this data for advertising or profiling, we do not sell it or share it with anyone except the network it came from, and we do not use it to train AI models.

How it is kept: access tokens are stored encrypted in our secrets vault, never in the application database, and are read only to make a request the organisation has asked for. The organisation is the controller of this data and we process it on its behalf.

How long: until the account is disconnected. Disconnecting deletes the access tokens immediately; the account details and statistics are deleted when the organisation removes the account, asks us to, or closes its Virtum account (within 30 days).

Google accounts: when a business connects Google, Virtum receives access only to the YouTube channels, Business Profile locations and Search Console properties it chooses, and uses that access only to publish what the business approved and to show it its own results. Virtum's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, not used for advertising, not used to train AI models, and never used to create or alter images or video of people, including AI-generated non-consensual intimate imagery.

Removing access and deleting data:

• In Virtum: Marketing › Social › Connected accounts › Disconnect.
• On the network: remove Virtum from Facebook (Settings › Apps and websites), Instagram (Settings › Apps and websites), Threads (Settings › Account › Website permissions) or the equivalent page of the other networks. Facebook, Instagram and Threads tell us automatically; we then delete the tokens, the connected accounts and their statistics, and give you a confirmation code you can check at a status page.
• Or email privacy@virtum.cloud with the subject "Data deletion" and the account concerned, and we will delete it within 30 days.

What we collect, why, and our lawful basis

Your Virtum account

What: your name, email address and password (stored only as a secure one-way hash), or, if you sign in with Google, Microsoft or GitHub, the name, email address and account identifier that provider shares with us; your two-factor sign-in settings; the organisations and workspaces you belong to and your role in them; and security records such as when and from which IP address and browser you signed in.

Why: to create and run your account, keep it secure and let you sign in across Virtum's services.

Lawful basis: performing our contract with you. Where you use Virtum as part of an organisation, our legitimate interest in providing the service that organisation has asked for. Security records rely on our legitimate interest in keeping accounts and the service secure.

Early access requests

What: what you tell us when you request access, such as your organisation, role and what you would like to use Virtum for, and our decision and notes on it.

Why: to decide whether, when and how to open the platform to you. Every request is reviewed and decided by a person; nothing is decided automatically.

Lawful basis: taking steps you have asked for before entering into a contract, and our legitimate interest in opening the platform gradually to the people it suits.

Providing and supporting the service

What: records of what you do in Virtum that we need to run the service, such as approvals, changes and the actions you or the assistant took; messages you send us for support; and the service emails we send you (for example sign-in, password reset, invitations, early access decisions and security alerts).

Why: to provide the service, answer your questions, fix problems and tell you about things that affect your account.

Lawful basis: performing our contract with you or your organisation, and our legitimate interest in running a reliable, accountable service.

Enquiries and applications

What: when you enquire about a managed website, apply to the design partner programme or email us: your name, email address and phone number, your role, your organisation's name, size, website and location, and what you tell us about your needs, tools, timescale and budget. When we take an enquiry forward, we may also look at public information about your organisation, such as its website and its record at Companies House.

Why: to reply, understand what you need, and prepare a recommendation, quote or proposal.

Lawful basis: taking steps you have asked for before entering into a contract, and our legitimate interest in responding properly to people who contact us.

Contacting businesses about our services

This part explains how we use information we did not collect from you directly.

• Sources: the public register at Companies House, and businesses' own websites and other public business sources.
• What: names and roles of people at a business (for example a director, owner or IT lead); business contact details, such as a work email address, work phone number and business address; information about the business, such as its name, company number, sector, size and website; and a record of any contact we have had with you, including any objection.
• Why: to find businesses that may benefit from Virtum's services and contact the relevant person about them.
• Lawful basis: our legitimate interest in telling businesses about services relevant to them. We consider this fair because we use only business information, contact people about matters relevant to their role, keep contact limited, and stop as soon as anyone objects.
• Email marketing: we send unsolicited marketing emails only to corporate subscribers, meaning companies, limited liability partnerships, public bodies and similar organisations, at their business addresses. We do not send them to sole traders or ordinary partnerships unless they have agreed to receive them. Every email says who we are and gives you a simple way to opt out, and a person reviews every first message before it is sent.
• Your right to object: you can tell us at any time to stop contacting you, by replying to any message or emailing privacy@virtum.cloud. Your right to object to direct marketing is absolute: we stop straight away, delete your prospect record within 30 days, and keep only what we need (such as your email address) on a suppression list so that we do not contact you again.
• Retention: if we have not contacted you, or you have not engaged with us, within 24 months of adding your details, we delete them.

When we first contact you, we tell you where we got your details and link to this notice.

Keeping the website and service secure

What: your IP address, browser details, the pages and addresses you request and when, which our web application firewall inspects and our servers record in their logs; and checks on our forms that filter out automated spam, run on our own servers without a third-party captcha.

Why: to keep the website and service working and secure, and to detect and prevent abuse.

Lawful basis: our legitimate interest in keeping our systems and the people who use them safe.

Billing

What: for managed services we invoice ourselves: the billing contact's name, email address and business details, and our invoices and payment records. When paid platform plans go on sale, they will be sold through Paddle, which collects payment details itself (see who else handles your data).

Why: to bill for services, keep accounts and meet tax obligations.

Lawful basis: performing our contract with you, and legal obligation for the records tax and company law require us to keep.

Legal obligations and disputes

We may use any of the information above where the law requires it, for example to respond to a valid request from a regulator, a court or law enforcement (legal obligation), or where we need it to establish, exercise or defend a legal claim (our legitimate interest).

Keeping you informed

If you are a customer or have asked us about our services, we may email you about similar Virtum services. Every such email lets you opt out, and you can opt out at any time. We rely on our legitimate interest, and on your consent where the law requires it.

Do you have to give us your data?

No law requires you to give us personal data. But we need your name and email address to create an account, and enough detail to answer an enquiry or decide an early access request; without them we cannot provide those things.

AI and automated decisions

The AI features in the Virtum platform, and the AI we use to research businesses and draft messages, run on models hosted on hardware Virtum operates in the UK. Your prompts and data are not sent to third-party AI providers, and we do not use personal data or customer content to train AI models. The one exception is an AI provider your own organisation chooses to connect, for example for coding sessions: content sent through that connection goes to that provider under your organisation's agreement with it.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Every early access request and application is decided by a person, and a person approves every sales message before we send it.

Who else handles your data

We share personal data only where we need to. These service providers process it on our behalf, under contracts that require them to act only on our instructions and keep it secure:

These receive personal data as separate controllers, under their own privacy notices:

• Paddle. When paid platform plans go on sale, Paddle (Paddle.com Market Ltd) sells them as our reseller and Merchant of Record: it runs the checkout, takes payment, charges any VAT or sales tax and issues the invoice. Paddle is a separate controller for the payment data it collects, under its own privacy notice. We receive your name, email address, business details and the state of your subscription, never your full card details.
• Google, Microsoft and GitHub. Only if you choose to sign in with one of them. The provider confirms who you are and shares your name and email address with us. Each is a separate controller under its own privacy notice.
• AI providers you connect. If your organisation connects its own account with an AI provider (for example for coding sessions), the content those features send goes to that provider under your organisation's own agreement with it.
• Professional advisers, such as our accountants, lawyers and insurers, where they need it to advise us.
• Regulators, courts and law enforcement, where the law requires it.
• A buyer of our business, if Virtum Cloud Ltd or its business is ever sold or reorganised, who would have to use your data in line with this notice.

The current list of providers that process customer data in the platform is on our sub-processors page.

Transfers outside the UK

The Virtum platform, its databases and its backups are hosted in the UK. Some of the providers above can process personal data outside the UK: AWS's global edge network handles requests at the location nearest the person making them, Microsoft may process data in other countries, Tailscale processes connection details in the United States, and Google, Microsoft and GitHub process sign-in data under their own terms.

Where we transfer personal data outside the UK, we rely on UK adequacy regulations (for example for the European Economic Area, or the UK–US data bridge for US organisations certified under it), or on the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, included in the provider's data processing terms. Email privacy@virtum.cloud to ask which safeguard applies to a particular provider and for a copy of it.

How long we keep it

Keeping it safe

Data is encrypted in transit between your browser and our servers, including over the connection between our network edge and our servers. Access to personal data is limited to the people who need it, and administrative actions in the platform are recorded. Passwords are stored only as one-way hashes, and two-factor sign-in is available. Our databases are backed up every night to storage Virtum operates in the UK, with an encrypted copy in AWS's London region, and we test restoring them every week.

Your rights

You have the right to:

• Access the personal data we hold about you and get a copy of it.
• Correct data that is wrong or incomplete.
• Erase your data, where we no longer have a good reason to keep it.
• Restrict how we use your data while a concern is being looked into.
• Object to how we use your data where we rely on our legitimate interests. We will stop unless we have compelling grounds to continue. You can always object to direct marketing, and then we will always stop.
• Portability: receive data you gave us, which we use under a contract or with your consent, in a structured, machine-readable format, or have it sent to another organisation.
• Withdraw consent at any time, where we rely on it. This does not affect what we did before.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (we do not make any).

To use any of these rights, email privacy@virtum.cloud. It is free. We may need to confirm who you are before we act, and we respond within one month; if a request is complex we may need up to two more months, and we will tell you why within the first month.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at privacy@virtum.cloud. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.

Cookies

Virtum uses only the cookies needed for the website and sign-in to work, and, once you sign in, two that remember how the app is laid out. There are no advertising or analytics cookies. See our cookie policy.

Business use only

Virtum's services are for businesses and other organisations, not for personal or household use, and are not aimed at children.

Changes to this notice

When we change this notice we update the date at the top of the page. If a change significantly affects how we use personal data you have already given us, we will tell you before it takes effect.