Scope
This policy explains how Virgil AI Inc. ("Virgil," "we," "us," or "our") handles information when you use our website, public beta, desktop software, support channels, and related services.
Information we collect
- Account data such as your Auth0 subject, name, email address, and email-verification status.
- Project content, prompts, uploaded references, model responses, settings, and files you choose to save.
- Subscription details from Stripe, including customer and subscription IDs, plan, status, trial dates, and billing events. Virgil does not receive or store your full card number.
- Service and security data such as feature usage, errors, device and browser information, and rate-limit signals.
- Download records containing your account ID, platform, release version, time, outcome, and a one-way hash used for IP-based abuse prevention. Signed download URLs are not stored.
- Information you include in a support request.
How we use information
- Authenticate accounts and enforce beta-seat and trial limits.
- Provide writing, formatting, project, billing, and download features.
- Route prompts and context to the model provider you select.
- Prevent abuse, investigate errors, and secure the service.
- Respond to support requests and required legal process.
- Measure signup and onboarding performance when you have allowed optional analytics.
Service providers
We use Auth0 for identity, Stripe for payments, MongoDB for service records, AWS/S3 for release delivery, PostHog for optional consent-based analytics, and AI providers such as OpenAI, Anthropic, Google, xAI, and providers of open models. We share only the data reasonably needed for each provider to perform its role. Their processing is also governed by their terms and privacy policies.
Prompts and relevant project context are sent to the AI provider you choose to generate a response. Do not submit information you are not authorized to disclose. We do not sell your personal information.
Analytics and cookies
Essential storage is used for authentication, security, and your saved preferences. Optional product analytics remains off until you consent and is also disabled when analytics is not configured. Our events use an anonymous identifier and include public page names, plan or platform values, and broad referral categories such as ChatGPT, Claude, or a search engine. We do not send full referral URLs, search queries, names, email addresses, project content, payment details, or signed URLs in these events. After consent, the referral category is kept in this browser tab for up to 24 hours to connect a visit with signup and trial steps. Referrals may be unknown when a browser or app does not provide them.
Optional analytics is off in this browser.
Retention
Account and project data is generally kept while your account is active. Operational download and security events are normally kept for up to 90 days. Support records may be kept for up to two years. Billing and transaction records may be retained for up to seven years where needed for accounting, disputes, fraud prevention, or legal obligations. Deleted data may remain in encrypted backups for up to 30 additional days. We may retain a minimal record needed to enforce the one-trial eligibility rule. That record can include keyed, one-way identifiers derived from the verified email, account identifier, and Stripe card fingerprint; it does not contain the full card number.
Security
We use access controls, encryption in transit, restricted service credentials, short-lived download links, and monitoring intended to protect your information. No online service can guarantee absolute security, especially during a beta.
Your choices and rights
You can update certain account details, cancel a subscription, or request access, correction, export, or deletion by contacting us. Some records may be retained where required by law or needed for security, billing, dispute resolution, or trial-abuse prevention. Rights vary by location.
International processing and children
Providers may process information in the United States and other countries where they operate. Virgil is not directed to children under 13, and we do not knowingly collect their personal information.
Contact
Privacy or data requests: support@virgil.com.ai.