This Privacy Policy explains how Whatap Global Inc. ("WhaTap," "we," "us") collects and uses personal information when you visit virca.ai, create or use a Virca account, or contact us. Virca is offered to organizations in the United States.
What this policy does not cover. When your organization uses Virca, the Virca Worker collects operational data from your organization's own servers — resource metrics, process and service state, log lines, database query text, and the record of every action it ran. We process that data on your organization's behalf, as its service provider, under our agreement with it. If your personal information is in that data, please contact the organization, which decides how it is used; we will help it respond.
One thing to know about that data. Command lines of running processes, file paths, logs, and network connection details contain whatever your own systems put there. If a secret or a personal identifier is passed as a command-line argument or written to a log on a monitored server, it can end up in what the Worker collects. Please keep secrets out of command-line arguments and logs on servers you connect.
1. What we collect
When you browse the website. Pages viewed, links followed, referring pages, approximate location derived from your IP address, browser and device type, and the time of your visit, collected through Google Analytics 4 (see Section 6).
When you contact us. Whatever you send — your name, email address, company, role, and the content of your message.
When you create an account. The name and work email address of the people on your account, your organization and workspace names, the domain you sign up with, your password, and your acceptance of our terms. If your organization's administrator invites you, we receive your email address from them. If you sign in through your organization's single sign-on provider, we receive the identity information it sends.
When you use the console. What you do in it, including approvals of actions, which are recorded with your identity in your organization's audit record; device and browser information; IP address; and log data.
What we do not collect. We do not currently collect payment card details. We do not run advertising trackers.
2. Why we use it
To run the Service — to operate your account, raise events, run the actions your organization approved, keep the record of what was done, and show that record to you.
To operate and improve the site and the product — to see which pages are read, find broken things, and decide what to build, using aggregated information where we can.
To talk to you — to answer what you send us, to send service and security notices, and, if you asked for them, to send product updates. You can opt out of product updates at any time; service and security notices are not optional while your account exists.
To meet legal obligations and to protect our rights and yours.
We do not use personal information to train AI models.
3. Aggregated data
We may derive statistics from data across all customers, aggregated and de-identified so that no customer, person, or server can reasonably be identified, and use them for product work. We do not attempt to re-identify that data.
4. Who else receives it
We use a small number of service providers, and they are bound by contract to use personal information only to provide services to us:
Amazon Web Services, Inc. — cloud infrastructure, where the Service runs and data is stored.
Google LLC — Google Analytics 4, website analytics.
Ollama Inc. — AI inference. AI processing in Virca runs on this third-party inference service, not entirely on infrastructure we own. What reaches it is what the feature you used needs in order to answer. Ollama processes requests primarily in the United States and may route them to Europe or Singapore for capacity.
Email delivery — sending service notices, notifications, and approval requests.
We also share personal information with your organization, if you use Virca through its account (for example, your approvals are visible to its administrators); with third-party services you connect, such as team-chat tools, at your direction; with our affiliate WhaTap Labs in the Republic of Korea, which helps develop and support Virca, under this policy; where the law requires it or it is needed to protect rights, safety, or the Service; and, if Virca is ever acquired or merged, with the acquiring party under the same protections — we will tell you if that happens.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not disclose it to third parties for their own direct marketing, as those terms are used in California law.
5. How long we keep it
We keep data for as long as we need it for the purpose we collected it, and no longer. In practice: website analytics for as long as it is useful for understanding traffic, and then it ages out; what you send us for as long as the conversation is live, and afterwards for our own records; your account information for as long as your account is open; and anything the law requires us to keep, for as long as it requires.
We deliberately do not publish a fixed retention schedule at this time, because we would rather tell you the truth about how long data lives than publish a number we cannot yet guarantee. You can ask us to delete your data at any time (see Section 8), and we will, except where the law requires us to keep it.
6. Cookies, Do Not Track, and third-party tracking
The website uses Google Analytics 4 to understand how the site is used. It is the only analytics tool on the site, and it sets cookies in your browser (_ga, _ga_*). The console also uses strictly necessary cookies to keep you signed in and protect against abuse. We do not use advertising cookies, and we do not share site data with ad networks.
A banner asks for your choice: Accept all turns analytics cookies on, Essential only leaves them off and deletes any already set. The Cookie settings link at the bottom of every page changes the choice later. In the European Economic Area, the United Kingdom and Switzerland, analytics cookies stay off until you accept. Elsewhere they are on until you refuse, and a Global Privacy Control signal from your browser is treated as a refusal.
You can block or delete cookies in your browser, or install Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout). You can also write to ask@virca.ai and we will exclude you.
Do Not Track. Our website does not currently respond differently to browser "Do Not Track" signals.
Third-party tracking. Google collects information about your use of our website through Google Analytics and may collect information about your online activities over time and across different websites. Other than Google Analytics, we do not knowingly allow third parties to collect information about your online activities on our website.
7. Where it is kept, and how it is protected
Virca runs in the United States on Amazon Web Services, and data is stored in AWS US regions. Our affiliate WhaTap Labs may access it from the Republic of Korea to develop and support Virca, and our AI inference provider may process AI requests outside the United States as described in Section 4. If you access Virca from outside the United States, your data is transferred to and processed in the United States.
We apply access controls to our own systems and restrict who can reach customer data. Credentials the Worker uses to run commands on your servers stay on your servers and are not stored on our systems. The Worker opens a single outbound connection to Virca, and nothing listens for inbound traffic on your side.
No security measure is perfect. We do not promise that the Service will be free from unauthorized access or disruption. The security of your own servers, networks, and credentials remains yours. If we discover a security incident affecting your personal information, we will tell you without undue delay, describe what we know, and cooperate with what you have to do about it.
8. Your choices and rights
You can ask us to tell you what personal information we hold about you; to correct it; to delete it; to send you a copy in a portable form; to stop or limit certain uses of it; or to stop sending you marketing email — every marketing email also carries an unsubscribe link. You can update your account information in the Virca console.
If you are in California, you also have the right to know what we collect and how it is used and disclosed, to opt out of any sale or sharing of personal information (we do neither), to limit the use of sensitive personal information where that right applies, and not to be treated differently for exercising any of these rights. Residents of other states may have similar rights under their state laws.
How to ask: write to ask@virca.ai. We will verify who you are before acting on a request about someone's personal information, you may use an authorized agent where the law allows, and we will respond within the time applicable law requires. If we decline your request, you may appeal by replying to our decision.
9. Children
Virca is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18.
10. Commercial email
Our postal address for commercial email is Whatap Global Inc., c/o A Registered Agent, Inc., 8 The Green, Ste A, Dover, DE 19901, USA.
11. Changes, governing law, contact
We review this policy at least once every 12 months. When we change it, we update the date at the top; if a change materially affects how we handle your data, we will also tell account holders by email or in the Service before it takes effect.
This policy is governed by the laws of the State of California, without regard to its conflict-of-law principles. Disputes are handled as described in the Virca Terms of Use. Questions: ask@virca.ai.