Privacy Policy
Last updated: July 6, 2026
VirralOS ("VirralOS", "we") is a service that provides personal and business users with email, calendar, file, social media, and AI-powered content creation from a single platform. This policy explains what data we collect, how we use it, and with whom we share it.
1. Data We Collect
- Account information: Email address and password hash (managed by Supabase Auth).
- Google account data: Email content, calendar events, and Drive files from your connected Google account — processed only to provide assistant features to you.
- X (Twitter) account data: OAuth access token; used for content publishing.
- Strategy and content data: Brand information, goals, and strategy files you enter during onboarding.
- Avatar photo: Face photo you upload if you choose to create a personal avatar.
- Usage data: Job logs (analysis, video production states), quota counters, and audit records.
2. How We Use Your Data
- Providing assistant responses, email summaries, calendar management, and Drive access.
- Brand strategy analysis and personalized content generation.
- Creating avatar identity (from face photo).
- Quota management and maintaining service quality.
- Security: detecting unauthorized access and abuse.
Your data is not used for advertising, not sold to third parties, and not combined with other services to build a profile of you.
3. Third-Party Sharing
Google API Services
Access to Google Gmail, Google Calendar, and Google Drive APIs is used solely to provide assistant features to you. Data obtained through Google API Services is processed only for user-facing features; it is not transferred, sold, or used for advertising purposes. This use complies with the Limited Use requirements of the Google API Services User Data Policy.
Higgsfield AI
If you choose to create a personal avatar, your uploaded reference photo is sent to Higgsfield AI for identity-consistent image and video generation. Higgsfield's privacy policy applies to this transfer. Avatar creation requires your explicit consent.
AI Providers (LLM)
Brand information and brief text are sent to external LLM providers (Qwen, Anthropic Claude, and others) for strategy analysis and content generation. The processed content does not include emails or personal communications; it covers only the business/brand data you enter.
Supabase
All application data is stored on Supabase infrastructure (EU/US data centers). Supabase's privacy policy applies.
4. Data Retention and Deletion
- Google/X tokens: Deleted when you disconnect the account from the Settings page.
- Strategy files and content: Retained until you delete your account.
- Avatar photo: Removed from Supabase Storage when the avatar is deleted. For copies on Higgsfield, deletion must be requested through your own Higgsfield account.
- Account deletion: self-service, immediate — see Data Deletion for instructions.
5. Security
Data is transmitted over TLS. Third-party OAuth tokens are stored encrypted in the database. Supabase Row-Level Security ensures each user can only access their own data. Full security testing has not yet undergone independent audit; please share sensitive business data carefully during the beta period.
6. Children's Privacy
VirralOS is not directed at individuals under 13 and we do not knowingly collect data from this age group.
7. Changes to This Policy
Material changes will be notified to your registered email address. The current policy is always published on this page.
8. Contact
For privacy-related questions: privacy@virralos.com