Privacy notice

VirtualPA is run by Hemant Sain, trading as Braivex, a sole proprietor in India.
Braivex is the controller of the personal data described in this notice, unless it says otherwise.

• Legal name: Hemant Sain, trading as Braivex.
• Address: Yog Nagar, 60 Feet Road, Alwar, Rajasthan 301001, India.
• Email: support@braivex.com, with "Privacy" in the subject line.
• Customer care phone: +91 80585 89200.

• Account: your name, email address and password.
  We store the password only as a hash.
• Workspace: your business name and industry, and the email addresses and roles of the team members you invite.
• Connected accounts: access tokens for the services you connect, such as Shopify, Meta, Klaviyo, Amazon, Google, Gmail, Outlook, TikTok, HubSpot, Zendesk, Freshdesk, Intercom and Gorgias.
  We store these tokens encrypted.
• Business data from those accounts: sales, orders, stock, advertising results, email marketing results, inbox messages, calendar events, support tickets, and CRM contacts and deals.
• Public data: posts and trends from Instagram, TikTok, Facebook pages, Reddit, news sources, Google Trends, RSS feeds and the Meta Ad Library, and company information from Apollo.
• AI features: your briefs, the questions you ask the AI Guru, its answers, what it remembers for you, and support reply drafts.
• Email settings: which briefs and alerts you receive.
• Billing: your plan, subscription status, credit balance and the credits each feature used.
• Device and usage: your IP address and browser details, which our host logs, and a record of changes made in your workspace.

When you connect a store, inbox, help desk or CRM, VirtualPA handles personal data about your customers and contacts.
For that data, your business is the controller and we act as its processor.
We use it only to provide VirtualPA to you, on your instructions.
Order records hold a hashed email address, not the address itself.
Contact details from help desks and CRMs are stored encrypted, and contacts are matched by a hashed email address.
Your business must have a lawful basis for that data and must tell the people concerned how it uses it.
Business customers can ask for our data processing terms at support@braivex.com.

VirtualPA collects public posts and trends from Instagram, TikTok and Facebook pages through Apify.
It also reads public posts from Reddit, news from GDELT, Google Trends, RSS feeds and the Meta Ad Library, and company information from Apollo.
A public post can include the author's name or handle and what they wrote.
We use this data only to build briefs and alerts for our customers, and we do not sell it.
To have your data removed from VirtualPA, email support@braivex.com with "Public data" in the subject line.

• To run your account and workspace and sign you in: contract.
• To pull data from the accounts you connect and build your briefs, alerts and drafts: contract.
• To send the briefs and alerts you choose: contract.
  Every email has an unsubscribe link.
• To take payments, handle refunds and keep billing records: contract and legal obligation.
• To keep VirtualPA secure and prevent misuse: legitimate interests.
• To collect public data: legitimate interests, in providing the service our customers ask for.

Section 4 of the Braivex Privacy Policy explains each lawful basis, and you can ask us how we balanced our interests against yours.

VirtualPA uses AI models from Anthropic to write briefs, answer AI Guru questions and draft support replies.
We send a model only the content the feature needs.
The figures in a brief come from your connected accounts, and the AI writes about them but does not calculate them.
We do not use your content to train AI models.
AI output can be wrong, so check it before you rely on it.

We do not sell your personal data.
These providers process it for us, only to run VirtualPA:

• Railway: hosts the VirtualPA app.
• Braivex billing and Dodo Payments: plans, payments, refunds and invoices.
• Anthropic: AI models.
• Nango: manages the connections to the accounts you connect.
• Apify: collects public social media posts.
• Apollo: provides company information.
• Resend: sends sign-in, brief and alert emails.

The services you connect, such as Shopify or Meta, send us data under their own terms.
We also share data with authorities where the law requires it, and with our professional advisers.

Dodo Payments is the merchant of record for VirtualPA plans and credit packs.
It takes the payment, issues the invoice and handles VAT or sales tax.
It is a separate controller for the payment data it collects, under its own privacy policy.
VirtualPA gets your plan, subscription status and credit balance from the Braivex billing service at billing.braivex.com.
We never see or store your full card number.

VirtualPA uses only the cookies it needs to keep you signed in and secure.
It uses no analytics or advertising cookies.
Our cookie notice gives the details.

Braivex is based in India, and Railway hosts the VirtualPA app in the United States.
Our other providers may also process data in other countries.
Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.
Section 14 of the Braivex Privacy Policy explains this in more detail.

• Account, workspace and data from connected accounts: while your account is open.
  After you close it, we keep data only as long as we need to settle final payments, questions or claims, or as the law requires.
• Connected-account tokens: until you disconnect the account in Settings.
• Payment, invoice and refund records: as long as Indian tax and accounting law requires.

A workspace admin can export or delete the workspace in Settings.
Our data deletion page explains what is deleted and how to ask us to do it.

Depending on where you live, you can ask for a copy of your data, or ask us to correct or delete it.
You can also ask us to restrict how we use it, or to send you the data you gave us in a machine-readable format.
You can withdraw a consent you gave us at any time.
To make a request, email support@braivex.com with "Privacy request" in the subject line.
We may ask you to confirm your identity.
We reply within one month of receiving your request.
Section 16 of the Braivex Privacy Policy explains each right.

To complain, email support@braivex.com with "Data protection complaint" in the subject line, or write to the address above.
We acknowledge your complaint within 48 hours and give you our answer within one month.

• Grievance officer: Hemant Sain, Proprietor.
• Email: hemant@braivex.com.
• Phone: +91 80585 89200.
• Address: as in "Who we are" above.

The grievance officer acknowledges each complaint within 48 hours and resolves it within one month.

• UK: you can complain to the Information Commission, still known as the ICO, at ico.org.uk.
• EU and EEA: you can complain to the data protection authority in the country where you live or work.
• India: once you have used our grievance process, you can complain to the Data Protection Board of India.

When we change this notice, we update the date at the top.
If a change materially affects you, we email account holders before it takes effect.