Privacy Policy

Privacy Policy

Virtik USA, Inc. ("Virtik", "we", "us") provides a software-as-a-service platform for physical security operations. This Privacy Policy explains what personal information we handle, in which capacity, and what choices you have.

Business and legal address: 113 N San Vicente Blvd, Beverly Hills, CA 90211, United States Privacy contact: privacy@virtik.ai Data protection enquiries: privacy@virtik.ai. Where applicable data protection law requires Virtik to designate an EU or UK representative or a data protection officer, Virtik will publish the contact details in this Policy.

1. The distinction this policy is built on

Virtik handles personal information in two fundamentally different capacities, and your rights differ depending on which one applies to you. Most privacy policies blur this. Reading the wrong half will give you the wrong answer.

(a) Where Virtik decides — controller / business. For our website, our marketing, our own account and billing records, and our own security telemetry, Virtik determines why and how information is used. We are the controller (GDPR) and a business (CCPA/CPRA). Sections 3 to 5 and Section 11 apply, and you exercise your rights against us directly. The terms controller, processor, business and service provider name the role that the law uses where it applies; this Policy does not state that every such law applies to every person.

(b) Where our customer decides — processor / service provider. When an organization subscribes to Virtik and uses it to run security operations, that organization decides what cameras exist, what is recorded, who is monitored, what is retained and for how long. They are the controller and business. Virtik is the processor (GDPR) and service provider (CCPA/CPRA), acting on their documented instructions under the Data Processing Addendum (LEG-010). Section 6 applies.

If you are an employee, contractor, visitor or member of the public whose image, location or activity was captured by an organization using Virtik, your request goes to that organization, not to us. We will help them respond, and we will tell you so and point you to them where we can identify the organization concerned. We generally cannot identify you across a customer's data, and searching every customer tenant to look for you would itself be a privacy harm.

2. Who this policy covers

3. What we collect where Virtik is the controller

3.1 Account data

Name, business email, business telephone where provided, employer, job title, role and permissions, organization membership, authentication metadata, multi-factor enrolment status, and the record of terms and consents you have accepted (see LEG-001 §2.4 to §2.6 and §7 below).

3.2 Device and log data

IP address, user agent, device and browser characteristics, operating system, language, timestamps, pages and features used, and error and diagnostic records. Collected when you use the website or the platform.

3.3 Security telemetry

Authentication attempts and outcomes, session events, permission changes, administrative actions, rate-limit and abuse signals, and audit records. We use this to detect and investigate unauthorized access and abuse, and to meet our own security obligations. This is our own legitimate interest in securing the service and we do not treat it as customer-instructed processing.

3.4 Communications

Messages you send us through forms, email, or in-product channels, and our replies. A message sent through the contact, demo, pilot or security form on the website is delivered by email, through an email service provider, to authorized Virtik personnel, and Virtik does not keep a separate database copy of it. A privacy-rights request submitted through the request form is stored as a request record, and a notification that contains no personal data about you is sent by email to authorized personnel. The email providers are listed in the Subprocessor List (LEG-009).

3.5 Support data

The content of a support request, the diagnostic information you choose to attach, and our handling record. Support attachments may contain personal information belonging to your organization's data subjects. Where they do, we handle them as a processor under the DPA even though the request reached us through a support channel.

3.6 Billing data

Organization billing name and address, plan, subscription and invoice records, tax status, and payment status. Card details are collected and held by our payment processor, not by Virtik. We receive a token, the last four digits, card brand and expiry, and the outcome of a charge.

3.7 Recruitment data

Where you apply for a role, the information in your application and our assessment record.

3.8 Website analytics and cookies

See the Cookie Policy (LEG-003). Non-essential analytics run only where you have given consent, and consent is off by default in every jurisdiction — we do not apply a weaker rule in markets that would permit one.

3.9 What we do not collect for our own purposes

We do not collect biometric identifiers about you for our own purposes, do not perform facial recognition on our own behalf, do not buy personal information from data brokers, and do not use your information for automated decisions that have legal effect on you.

4. Why we use it, and our legal basis

We do not use special category data for our own purposes. Where you volunteer it — for example accessibility needs in a support request — we use it only to respond.

5. Who we disclose it to

• Third-party providers. The Subprocessor List (LEG-009), at /legal/subprocessors, classifies them as providers that Virtik manages (subprocessors, infrastructure providers and the payment processor), providers and connectors that a customer supplies with its own account, and services whose use Virtik has not verified. It states no role for a service in the last category, and it states no processing location, agreement or certification for any entry.
• Your organization, where you are an authorized user: your administrators can see your account and activity within their tenant.
• Professional advisers under duty of confidence.
• Authorities, where legally required.
• An acquirer, in a merger or sale, subject to this policy continuing to apply.

We do not sell personal information for monetary consideration. Certain advertising or analytics activity may constitute "sharing" under California law depending on which services are enabled; the controls at /privacy/choices turn those categories off, and they are off until you turn them on.

6. Where Virtik is a processor: customer-controlled data

6.1 What this covers

Camera and video data, audio where a customer enables it, still images, detections and detection metadata, alerts, spatial models and Virtual Sites, personnel and patrol records, geolocation, communications content, incident records, and analytics derived from them — all within a customer's tenant.

6.2 Who decides

The customer. They choose the cameras, the fields of view, whether audio is captured, who is tracked and when, what alerts fire, who can see what, and how long it is kept. Virtik provides the capability; it does not choose the configuration.

6.3 What Virtik does with it

Only what is necessary to provide, secure, support and maintain the service for that customer, plus what law requires. We do not use it for our own marketing, do not sell or share it, and do not use it to train generalized or shared AI models offered to other customers without an express contractual authorization permitting that use. Virtik does not control or represent the data retention or training practices of AI providers whose accounts the customer connects itself.

6.4 Video, audio, images and geolocation

These are the most sensitive categories in the platform and they are treated as such. Access is governed by the customer's role configuration and by our tenant isolation controls. Retention is configured by the customer; Virtik states no period in this Policy (see LEG-022).

6.5 Geolocation specifically

Where a customer enables location features, the platform may process the location of personnel using the mobile application during their duty period. Scope, precision and frequency depend on the customer's configuration.

6.6 AI features

Where a customer enables AI features, inputs may be processed by a third-party model provider. Where the AI feature uses a provider credential that Virtik manages, the provider is a subprocessor; where the customer connects its own provider account, the provider acts for the customer under the customer's own agreement. Outputs are probabilistic decision support, not determinations of fact, and are governed by LEG-007.

6.7 Your rights against customer-controlled data

Direct them to the organization that operates the deployment. We will assist that organization as required by the DPA.

7. Consent and acceptance records

We keep a record of the terms you accepted, the version, the locale, when, and the surface on which you accepted them, and of consents you have given or withdrawn. We keep these because a consent we cannot evidence is a consent we cannot rely on. Marketing consent, SMS consent and contractual acceptance are recorded separately and are never bundled. Your cookie choices on the public website are stored only in your browser (see the Cookie Policy, LEG-003); Virtik does not receive or keep a copy of them.

8. Retention

We keep personal information for as long as needed for the purpose it was collected, then delete or de-identify it, subject to legal retention requirements and to preserving evidence for legal claims.

Virtik states no specific retention periods in this Policy; the Data Retention and Deletion Schedule (LEG-022) states the position. Customer-controlled data is retained according to the customer's configuration, not ours.

9. Where information is processed

Virtik is established in the United States and information may be processed there and in other locations where our subprocessors operate. The Subprocessor List (LEG-009) does not state processing locations, and Virtik makes no commitment about where processing occurs other than that it operates the Service from the United States.

For transfers out of the EEA, UK or Switzerland, the mechanism relied on is set out in the DPA.

10. Security

The security measures that we make representations about are those stated in the Security Addendum (LEG-015): tenant isolation, role-based access control, HTTPS and HTTP Strict Transport Security configured for our web applications, multi-factor authentication that we make available, audit records of certain administrative and security events, least-privilege database grants for the service's client-facing roles, server-side validation of writes, and origin validation and rate limiting on selected endpoints. The Security Addendum also lists matters about which we make no representation, and this policy states no measure beyond it.

Virtik does not currently hold SOC 2 attestation, ISO 27001 certification, HIPAA compliance certification, or FedRAMP authorization, and does not represent that it does. Where your own obligations require a certification we do not hold, you should assess whether the service is appropriate for your use.

No service can be guaranteed secure. If we become aware of a security incident affecting personal information we will act as required by law and, for customer-controlled data, as required by the DPA.

11. Your rights

Depending on where you live and the capacity in which we hold your information, you may have the right to access it, obtain a copy, correct it, delete it, restrict or object to processing, withdraw consent, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising a right.

How to exercise them. Use /privacy/choices for browser-level choices, and the request form at /privacy/ccpa for access, deletion, correction and portability. You may also contact privacy@virtik.ai.

Verification. We may need to verify your identity before acting, and we will ask only for what is reasonably necessary. We will not ask you to create an account in order to exercise a right.

Authorized agents may submit a request on your behalf; we may need to confirm the authorization.

Timing. We respond within the period that applicable law requires, as Section 8 of LEG-005 describes.

Complaints. You may complain to your supervisory authority. In the EEA that is the authority where you live or work.

12. Children

The platform is for organizational use and is not directed to children. We do not knowingly collect personal information from children for our own purposes. Where a customer deploys Virtik at a school or campus, that customer is the controller for any information about minors and is responsible for the notices and consents its jurisdiction requires.

13. Automated decision-making

Virtik does not itself make decisions about you by automated means alone that have legal or similarly significant effect. A payment or verification provider that Virtik uses may screen for fraud or payment risk by automated means under its own policies. Where a customer uses AI features, LEG-007 prohibits configuring the platform so that an output alone causes a consequential decision about a person without human review, and the customer is responsible for honouring any right you have not to be subject to solely automated decisions.

14. Changes

We will post a new version with a version number and effective date, keep prior versions available, and give notice of material changes before they take effect.

15. Contact

Privacy: privacy@virtik.ai Legal: legal@virtik.ai Post: 113 N San Vicente Blvd, Beverly Hills, CA 90211, United States

Language. This Privacy Policy is drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.

Version history

END OF DOCUMENT