Privacy notice
Virtualized is an AI chat assistant that businesses add to their own websites. This notice explains what personal data we handle, why, and your rights. It is provided by [company name] (“we”, “us”), registered in England and Wales under company number [company number], registered office [registered office address]. We are registered with the Information Commissioner's Office under number [ICO registration number]. Contact us about privacy at [contact email address].
1. If you chatted with an assistant on a business's website
Who is responsible for your data
The business whose website you were on decides how your chat and contact details are used; it is the controller. We run the assistant on its behalf as its processor, under a written agreement. The business's own privacy policy applies, and the quickest way to use your rights (for example to see or delete what you said) is to contact the business. If you contact us, we will pass your request to the business and help it respond.
What is collected
- Your messages and the assistant's replies.
- Contact details you choose to give, such as your name, phone number and email address, and a short summary of what you asked for, written for the business. The summary may also note the language you wrote in and whether you said the matter is urgent.
- The page of the website you were on when you started chatting.
- Your internet (IP) address, used briefly in memory to stop abuse such as floods of messages. It is not stored with your chat.
Please do not share sensitive information, such as health details, or payment card details, in the chat. The assistant does not need them.
How it is used
- To answer your questions, using information the business has provided.
- When you leave your contact details, to pass your enquiry to the business, including by email, so a person can follow up.
- To keep the service secure and working, and to count usage for billing the business.
Your messages are processed by an AI model to produce replies. The assistant tells you it is an AI and does not make decisions about you that have legal or similarly significant effects.
Voice
If you use the microphone, your browser usually converts your speech to text, and may send your voice to the browser maker's speech service (for example Google for Chrome, or Apple for Safari) under their terms. We only receive the resulting text. Reading replies aloud usually happens in your browser.
For some languages that phones cannot handle, such as Twi, businesses on our Business plan offer a premium voice. Then your recording is sent to us and passed to Khaya AI (GhanaNLP), or to ElevenLabs if Khaya AI is unavailable, to turn into text, and the assistant's reply is sent to the same service to be read aloud. We do not keep the recording; the text of what you said is kept like any other chat message.
How long it is kept
Chat transcripts are deleted automatically 90 days after the last message. Enquiries (your contact details and summary) are kept for the business until it deletes them or stops using Virtualized, after which we delete them within 30 days. The business can delete them sooner at any time.
Storage on your device
The chat keeps the current conversation in your browser's session storage so it survives moving between pages; it is cleared when you close the tab. We do not use advertising or tracking cookies in the chat.
2. If you are a business using Virtualized
For your account we are the controller. We collect your business name, the email address you sign in with, the addresses you ask us to send enquiries to, your settings and the information you give your assistant, records of your usage, and billing details when payments are set up. We use this to provide the service under our contract with you (our lawful basis is performance of that contract), to keep it secure, to support you, and to meet legal and accounting obligations (legal obligation). We keep account data while you are a customer and for up to 6 years afterwards where needed for tax and legal records, then delete it.
When you sign in we set one cookie that keeps you signed in. It is strictly necessary for the dashboard to work, so no consent banner is needed for it.
3. If you register interest on our website
When you fill in our "register interest" form we collect your name, business name, email address, and anything else you choose to give (phone number, website, preferred plan, message). We are the controller. We use it only to reply to you about Virtualized; our lawful basis is our legitimate interest in responding to your request. If you do not become a customer we delete it within 12 months, or sooner if you ask.
4. Who we share data with
We use the following providers to run the service. They may only use the data to provide their service to us.
| Provider | What they do for us | Where |
|---|---|---|
| Anthropic, PBC | Provides the AI model that reads visitors' messages and writes the assistant's replies. | United States |
| Render Services, Inc. | Hosts the Virtualized website, the chat service and the database where chats and enquiries are stored. | United States |
| Resend, Inc. | Delivers the emails that tell a business about a new enquiry. | United States and Ireland |
| Khaya AI (GhanaNLP) | For businesses on the Business plan, turns visitors' spoken messages into text and reads replies aloud in Ghanaian languages phones cannot handle, such as Twi. | Ghana |
| ElevenLabs, Inc. | Backup for the Business plan premium voice, used if Khaya AI is unavailable. | United States |
We do not sell personal data. We may disclose it if the law requires us to, or to protect people's safety or our legal rights.
5. Transfers outside the UK
Our providers are based in, or process data in, the United States. Where personal data is sent outside the UK, we rely on the UK's data bridge with the United States for providers certified under it, or otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses approved by the Information Commissioner, together with the provider's own security measures.
6. How we protect data
Connections are encrypted (HTTPS). Passwords are stored only as secure one-way hashes. Each business can see only its own chats and enquiries. Sign-in sessions use secure cookies and forms are protected against cross-site requests. Access to the database is limited to the service itself.
7. Your rights
You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable format, in the circumstances set out in UK data protection law. For chats on a business's website, contact that business first. Otherwise contact us at [contact email address]. We will respond within one month.
If you are unhappy with how your data is handled, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.
8. Children
Virtualized is a service for businesses and is not intended for use by children under 13.
9. Changes
We will update this notice when how we handle data changes, and show the new effective date at the top.