Privacy Policy

Our Privacy Policy was last updated on 22 September 2026

This Privacy Policy explains how Digiverse B.V. collects and uses personal data when you use Virtua. It should be read together with our Terms and Conditions for Virtua.

1. Who We Are and How to Contact Us

   1. The controller of your personal data is Digiverse B.V., Chamber of Commerce (KvK) number 97844705, RSIN 868256961, registered at Rij A, bak 04 – De BakkeRij, Hendrik Figeeweg 3-F, 2031 BJ Haarlem, The Netherlands.

   2. For anything in this policy, including to exercise your rights, contact us at help@virtuachat.ai or write to us at the address above.

   3. You have the right to lodge a complaint with a supervisory authority. Ours is the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl. You may also complain to the authority in the EU country where you live or work.

2. Scope

   1. This policy covers the Virtua website at virtuachat.ai, the Virtua service, and our communications with you. It applies to users in the European Economic Area and the United Kingdom. Annex A sets out additional information for UK users.

   2. Where the Service links to a third-party site, that site's own privacy policy applies.

3. Information We Collect

   1. Information you provide to us:

      1. Account information: email address, password (stored hashed), and display name.

      2. Where you sign in with Google or Apple: the identifiers and basic profile data those providers pass to us. We do not receive your password.

      3. Billing information: name, billing address, and the payment method you use. Your full card number is handled by our payment service providers and is not stored by us.

      4. Character content: the names, descriptions, personality settings, appearance selections, images and prompts you use to create or customise an AI Character.

      5. Conversation content: the messages you send to an AI Character and the responses generated for you.

      6. Correspondence with our support, moderation and complaints teams.

      7. You can choose not to provide some of this, but it may limit your ability to use the Service.

   2. Information we collect automatically:

      1. IP address, browser type and version, device type, operating system and language settings.

      2. Pages you visit, characters you view, features you use, and the time and date of each.

      3. Diagnostic data such as page load time, response times, error rates and resource usage.

      4. Subscription and billing events, including trial conversion and cancellation.

      5. We use cookies and similar technologies to collect some of this. Section 13 explains how you control them.

   3. Information from third parties:

      1. Our payment service providers, who confirm whether a payment succeeded and may flag suspected fraud.

      2. Analytics providers, which tell us how the Service is used in aggregate.

      3. Advertising and social media platforms, where you reach us through them.

      4. Reports about you from other users or from third parties, where content is reported to us under our Terms.

      5. Each of these acts under its own privacy policy. We tell you here because Article 14 of the GDPR requires us to identify data we did not get from you directly.

4. Sensitive Information in Conversations

   1. Conversations with an AI Character are open-ended, and people often say things to a companion they would not put in a form. Depending on what you write, your messages may reveal information the GDPR treats as a special category under Article 9: information about your health or mental health, sexual orientation, your religious or philosophical beliefs, your political opinions, your racial or ethnic origin, or your trade union membership.

   2. We do not ask you for this information and we do not require it in order to provide the Service. It reaches us only because you chose to write it.

   3. Where we process such information, we rely on your explicit consent under Article 9(2)(a) of the GDPR, which we ask for separately when you first use the chat function. You can withdraw that consent at any time in your account settings. Withdrawing it means we delete the conversation history held under it; it does not affect anything done before you withdrew.

   4. We do not use special category data to target advertising, to build profiles about you or to train AI models.

   5. Access to conversation content inside Digiverse is restricted to staff who need it for safety, moderation, security or support, is logged, and is subject to confidentiality obligations. Section 7 explains how automated systems review conversations for safety.

   6. Please do not share payment card numbers, passwords, government identification numbers or another person's personal data in a conversation.

5. How We Use Your Information, and Our Legal Basis

   1. We only use your personal data where we have a legal basis under Article 6 of the GDPR. The table sets out each purpose and the basis we rely on.

      What we do	Data used	Legal basis
      Create and run your account; generate AI Character responses; store your characters and chat history	Account data, character content, conversation content	Performance of our contract with you - Art. 6(1)(b). Explicit consent for any special category data revealed in conversation - Art. 9(2)(a)
      Take payment, manage your subscription, handle refunds and chargebacks	Billing data, subscription events	Performance of our contract - Art. 6(1)(b)
      Keep accounting and tax records	Billing data, invoices	Legal obligation - Art. 6(1)(c), with the Dutch fiscal retention period
      Moderate content, enforce our Terms, detect and act on prohibited content	Character content, conversation content, public activity, reports	Legal obligation under the Digital Services Act - Art. 6(1)(c); and our legitimate interest in a safe service - Art. 6(1)(f)
      Detect risk of suicide, self-harm or serious harm, and surface crisis support	Conversation content	Our legitimate interest, and the vital interests of the person concerned - Art. 6(1)(d) and (f)
      Confirm that account holders are adults	Account data, payment-instrument signals	Legal obligation and our legitimate interest in keeping minors off an adults-only service - Art. 6(1)(c) and (f)
      Keep the Service secure; prevent fraud and abuse	Technical data, usage data, billing signals	Our legitimate interest in protecting the Service and our users - Art. 6(1)(f)
      Understand how the Service is used and improve it	Usage and diagnostic data, in aggregate where possible	Our legitimate interest in improving what we offer - Art. 6(1)(f)
      Send you service messages: order confirmation, the reminder before your trial converts, changes to the Terms	Account and billing data	Performance of our contract, and legal obligation - Art. 6(1)(b) and (c)
      Send you marketing about Virtua	Account data, usage data	Your consent - Art. 6(1)(a). You can withdraw it in any message or in your settings
      Set non-essential cookies and similar technologies	Technical and usage data	Your consent - Art. 6(1)(a) and art. 11.7a of the Dutch Telecommunications Act
      Establish, exercise or defend legal claims	Whatever is relevant to the claim	Our legitimate interest in defending ourselves - Art. 6(1)(f)

   2. Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that our processing does not override them.

6. AI Model Training

   1. We do not use your character content, your conversations or your interaction data to train, fine-tune or improve AI models.

   2. We do not use special category data to train or improve any model.

   3. Where a third-party model provider processes your data on our behalf, it does so as our processor under a written contract and may not use your data for its own purposes, including its own model training.

7. Automated Decision-Making and Content Moderation

   1. We use automated systems to classify and filter content, to detect prohibited material, to identify safety risks, and to detect fraud. These systems may automatically restrict content, block a character, or suspend an account.

   2. Where an automated decision produces legal effects for you or similarly significantly affects you, for example the termination of your paid account, you have the right under Article 22 of the GDPR to obtain human intervention, to express your point of view and to contest the decision. You can do this by writing to help@virtuachat.ai, and the Terms explain the same right as a content moderation appeal.

   3. Decisions of that kind are not made solely by automated means where you ask for human review.

   4. We do not use automated decision-making based on special category data.

8. Sharing Your Information

   1. We do not sell or rent your personal data. We share it only as set out here.

      1. Service providers acting as our processors: cloud hosting and storage, AI model providers, payment service providers, email and communications providers, analytics providers, content moderation tooling, customer support tooling and age assurance providers.

      2. Legal and regulatory authorities: where we are required by law, or in response to a valid request from a court, regulator or law enforcement. This includes reporting to the authorities where we suspect a criminal offence involving a threat to someone's life or safety, as Article 18 of the Digital Services Act requires.

      3. Professional advisers: our lawyers, auditors and insurers, where necessary.

9. International Data Transfers

   1. Some of our service providers are located outside the European Economic Area. Where we transfer your personal data outside the EEA, we do so only where one of the following applies:

      1. the European Commission has decided the country provides an adequate level of protection; or

      2. the transfer is governed by the European Commission's Standard Contractual Clauses, together with a transfer impact assessment and any additional technical and organisational safeguards that assessment identifies as necessary.

10. How Long We Keep Your Information

    1. We keep personal data only for as long as we need it. The periods below apply unless the law requires us to keep something longer, or we need it to defend a legal claim.

       What	How long
       Account data	For as long as your account is open, then 90 days after you delete it
       Characters and conversation history	For as long as your account is open. You can delete individual characters and conversations at any time. Deleted content is removed from our live systems immediately and from backups within 90 days
       Public characters, likes and comments	Until you remove them or your account is deleted
       Billing records and invoices	7 years, as Dutch tax law requires
       Moderation records and statements of reasons	12 months, and at least as long as the Digital Services Act requires
       Records of a terminated under-18 account	Deleted immediately, except a minimal record that the account was closed, kept to stop it being reopened
       Support correspondence	24 months from the last contact
       Cookie and analytics data	As set out in our cookie declaration, and no longer than 14 months

    2. When we no longer need your data we delete it or anonymise it so you can no longer be identified.

11. Data Security

    1. We use appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, logging of access to conversation content, and staff confidentiality obligations.

    2. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

    3. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, and we will notify the Autoriteit Persoonsgegevens within 72 hours where the GDPR requires it.

12. Your Rights

    1. You have the following rights in relation to your personal data:

       1. Access: to be told whether we process your data and to receive a copy of it.

       2. Rectification: to have inaccurate data corrected and incomplete data completed.

       3. Erasure: to have your data deleted, where one of the grounds in Article 17 applies.

       4. Restriction: to have us limit what we do with your data while a dispute about it is resolved.

       5. Portability: to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible. You can export your characters and chat history from your account settings.

       6. Objection: to object to processing based on our legitimate interests. Where you object to direct marketing, we will stop, with no exceptions.

       7. Human review of an automated decision that significantly affects you, as section 7 explains.

       8. Withdrawal of consent: at any time, for anything we do on the basis of your consent, including marketing and non-essential cookies. Withdrawal does not affect what we did before you withdrew.

       9. Complaint: to the Autoriteit Persoonsgegevens or the supervisory authority where you live, as section 1.4 explains.

    2. To exercise any of these rights, write to help@virtuachat.ai. We will respond within one month. If your request is complex we may extend that by two further months, and we will tell you if we do, and why.

    3. We do not charge for this. If a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse it, and we will explain why.

    4. We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else.

13. Age Restriction

    1. Virtua is for adults. The Service is not directed at anyone under 18 and we do not knowingly collect personal data from anyone under 18.

    2. Under Dutch law, a person under 16 cannot validly consent to an information society service on their own account. Our own age limit is higher: 18.

    3. If we become aware that an account belongs to someone under 18, we will suspend and close it, delete the associated characters, conversations and personal data, and refund any amount paid for the unused period. We will not use any of that data to train or improve a model.

    4. If you believe a person under 18 has given us personal data, please tell us at help@virtuachat.ai and we will act without delay.

14. Marketing

    1. We send marketing about Virtua only with your consent.

    2. Every marketing message carries an unsubscribe link, and you can also change your preferences in your account. Unsubscribing from marketing does not cancel your subscription. The Terms explain how to cancel.

    3. Service messages, including your order confirmation, the reminder before your trial converts, security notices and changes to the Terms, are not marketing and continue while you hold an account.

15. Changes to This Privacy Policy

    1. We may update this policy. We will post the updated version at https://virtuachat.ai/legal/privacy and change the date at the top.

    2. Where a change is material, for example a new purpose or a new legal basis, we will tell you by email before it takes effect, and where the change depends on your consent we will ask you for it.

16. Contact Us

    1. For any privacy question, or to exercise your rights: help@virtuachat.ai.

    2. For general support: help@virtuachat.ai, or by telephone on the numbers listed in the Terms.