Virtual Buddy
Back to home
Template notice — this is a starting-point template and has not been reviewed by legal counsel. Replace before commercial launch.

Privacy Policy

This Privacy Policy explains how Virtual Buddy(“we”, “us”) collects, uses, shares, and protects personal data when you use our services at virtualbuddy.app. We act as a data controller for the personal data described here. Where we process customer data on your behalf (for example, data drawn from your connected platforms), we act as a data processor under our Data Processing Addendum.

1. Who we are

Virtual Buddy operates the AI-employee service available at virtualbuddy.app. For any privacy question, or to exercise your rights, contact us at privacy@virtualbuddy.app.

2. Data we collect

Depending on how you use the Service, we may process the following categories of data:

  • Account & identity data — name, email address, and authentication identifiers managed through our authentication provider.
  • Billing data — subscription tier, billing status, and transaction metadata. Card details are handled directly by our payment processor; we do not store full card numbers.
  • Social OAuth tokens — access and refresh tokens issued when you connect a third-party platform. These are stored encrypted and used only to perform the actions you authorize.
  • Content & platform metadata — metadata about your connected accounts and content (for example, post performance, engagement metrics, trend signals, and scheduling information) that the Service analyzes on your behalf.
  • Usage & interaction data — prompts, chats, and instructions you provide to your AI employee, plus product-usage and diagnostic logs.
  • Technical data — IP address, device and browser information, and essential cookies (see our Cookie Policy).

3. How we use data & our lawful basis

Under the GDPR and UK GDPR we rely on the following lawful bases:

  • Performance of a contract — to create and operate your account, connect platforms, generate outputs, and provide support.
  • Legitimate interests — to secure, maintain, and improve the Service, to prevent fraud and abuse, and to communicate about the product, balanced against your rights and freedoms.
  • Legal obligation — to meet accounting, tax, and other legal requirements.
  • Consent — where we ask for it, such as optional communications; you may withdraw consent at any time.

4. AI processing

To generate outputs, relevant prompts and context are sent to our third-party AI model provider (see Sub-processors). We do not permit our model provider to train foundation models on your data through the API, and we transmit only what is needed to fulfil your request.

5. Sharing & sub-processors

We share personal data with vetted service providers that help us run the Service — including hosting, database, authentication, AI, and payment providers — under contracts that require appropriate safeguards. A current list is maintained on our Sub-processors page. We do not sell your personal data.

6. International transfers

Some of our providers process data outside your country, including outside the EEA and UK. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with supplementary measures where required.

7. Retention

We keep personal data only for as long as necessary for the purposes described here. Account and content data is retained while your account is active and for a limited period afterwards to meet legal, security, and operational needs, and is then deleted or anonymized. OAuth tokens are deleted when you disconnect a platform or delete your account. Billing records are retained as required by applicable financial and tax law.

8. Your rights

If you are in the EEA or UK, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office).

9. Exporting & deleting your data

You can request an export of your data and delete your account at any time. Account deletion and data export are available directly from your Settings within the app, or by contacting us at privacy@virtualbuddy.app. When you delete your account, we remove your personal data (including stored OAuth tokens) except where retention is required by law.

10. Security

We use technical and organizational measures to protect personal data, including encryption in transit and at rest and encryption of stored access tokens. See our Security overview for details.

11. Children

The Service is not directed to children and is intended for users aged 18 and over. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice. The date below reflects the latest revision.

13. Contact

For any privacy request or question, contact privacy@virtualbuddy.app.

Last updated: 9 July 2026