Privacy Policy
Effective November 16, 2026
At a glance
- Who we are. Virbe sp. z o.o. in Lublin, Poland, makes a platform that businesses use to build conversational AI assistants ("virtual beings"). Contact us at [email protected].
- When this policy applies. It applies when we decide how and why your personal data is used: when you visit our websites, talk to the assistant on our website, contact us, sign up for news or our waitlist, use the Virbe Dashboard on behalf of your organisation, buy from us, apply for a job or follow us on social media.
- When it doesn't. If you talked to an assistant on another company's website, app or kiosk that is built with Virbe, that company decides how your data is used and its privacy notice applies. We process that data only on its behalf (see Section 9).
- AI. Our own website assistant is an AI system and tells you so. We do not use your conversations or our customers' data to train AI models, and we make no decisions about you that are based solely on automated processing and have legal or similarly significant effects.
- Your rights. You can access, correct or delete your data, object to its use, withdraw consent at any time and complain to the Polish data protection authority (UODO). You can always object to direct marketing.
1. Controller and contact
1.1. The controller of your personal data is Virbe sp. z o.o., ul. Tomasza Zana 11A, 20-601 Lublin, Poland, entered in the register of entrepreneurs of the National Court Register under KRS number 0000780459, NIP 9462687906, REGON 383015364 ("Virbe", "we", "us").
1.2. For any questions about your data or to exercise your rights, contact us at [email protected] (or [email protected]) or by post at the address above. We have not appointed a data protection officer because we are not required to; [email protected] reaches the person responsible for data protection at Virbe.
2. What data we use, why, on what basis and for how long
We process personal data in line with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Polish law. The table below shows each situation in which we process your data. Where we rely on our legitimate interests, the interest is described in the table; you can object to such processing (Section 7).
| Situation | Data | Purposes | Legal basis | Retention |
|---|---|---|---|---|
| Visiting our websites (virbe.ai, docs.virbe.ai) | IP address, browser and device information, pages visited, date and time, referring page | Delivering the website, security and preventing abuse, troubleshooting | Legitimate interest in operating and securing our websites (Art. 6(1)(f) GDPR) | Server logs up to 90 days |
| Analytics and advertising cookies (only if you agree) | Cookie identifiers, interactions with the website, approximate location, campaign data | Statistics, measuring campaigns, showing relevant ads | Consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law) | See the Cookie Policy; until you withdraw consent |
| Talking to the assistant on our website | Your messages (text or voice), the assistant's answers, technical data of the session, any contact details you choose to give | Answering your questions, presenting our product, improving our website content, security | Legitimate interest in informing about and demonstrating our products (Art. 6(1)(f) GDPR); steps at your request before a contract (Art. 6(1)(b) GDPR) if you ask for an offer | Conversations up to 6 months, unless they lead to a business contact (then as for business contacts) |
| Contact and demo requests, forms | Name, e-mail, phone, company, role, message, answers in the form, the page and campaign through which you reached us | Answering your request, arranging demos, preparing offers | Steps at your request before a contract (Art. 6(1)(b) GDPR); legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR) | Up to 3 years after our last contact |
| Waitlist | E-mail, name, company, form answers, campaign data | Informing you when access is available, inviting you to the product | Steps at your request before a contract (Art. 6(1)(b) GDPR) | Until you get access or leave the waitlist, at most 24 months |
| Newsletter and marketing e-mails | E-mail, name, preferences, whether you open e-mails or click links | Sending news about Virbe and our products, measuring their effectiveness | Consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law) | Until you unsubscribe; proof of consent for 3 years afterwards |
| Business contacts and prospects | Name, business contact details, company, role, history of our contacts, data from public professional sources (e.g. LinkedIn, company websites) or from events | Maintaining business relationships, B2B marketing, sales; marketing by e-mail or phone only with your consent | Legitimate interest in developing our business (Art. 6(1)(f) GDPR); consent for e-mail and telephone marketing (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law) | Up to 3 years after our last contact |
| Using the Virbe Dashboard (Authorized Users of our customers) | Name, e-mail, sign-in data (including your Google account profile if you sign in with Google), organisation, role, consents and accepted document versions, activity and security logs | Providing the account and the Services to your organisation, security, recording acceptance of our terms, product notices | Legitimate interest in performing our contract with your organisation and securing the Services (Art. 6(1)(f) GDPR); performance of a contract where you are our customer yourself (Art. 6(1)(b) GDPR); legal obligation to demonstrate compliance (Art. 6(1)(c) GDPR) | For the duration of the account and up to 3 years afterwards; security logs up to 90 days |
| Product usage in the Dashboard | Usage events and technical data | Operating, securing and improving the Services; aggregated statistics | Legitimate interest in providing and improving the Services (Art. 6(1)(f) GDPR) | Up to 24 months, then aggregated |
| Purchases, billing and payments | Company and billing details, VAT number, billing contact, invoices, payment history, payment method (stored by our payment provider) | Concluding and performing the contract, invoicing, collecting payments, accounting and tax | Performance of a contract (Art. 6(1)(b) GDPR); legal obligations under accounting and tax law (Art. 6(1)(c) GDPR) | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Support | Contact details, content of requests, screenshots and logs you send | Handling support requests and complaints | Performance of a contract or legitimate interest in supporting our customers (Art. 6(1)(b) or (f) GDPR) | Up to 3 years after the request is closed |
| Job applications | CV data, contact details, information you provide in the application and interviews | Recruitment for the role you applied for; future recruitments if you agree | Steps before an employment or civil-law contract (Art. 6(1)(b) GDPR) and Art. 22¹ of the Polish Labour Code; consent for other data you provide and for future recruitments (Art. 6(1)(a) GDPR) | Until the end of the recruitment; with consent for future recruitments, 12 months |
| Social media and community (LinkedIn, YouTube, X, Discord) | Your public profile, comments, messages and interactions with our pages and community | Communicating with you, running our pages and community, statistics | Legitimate interest in communicating and building a community (Art. 6(1)(f) GDPR) | As long as the content stays on the platform, or until you object |
| Reports of illegal content, abuse or vulnerabilities | Your contact details, the content of your report and related communication | Handling notices under the Digital Services Act, preventing abuse of our services, fixing vulnerabilities | Legal obligation (Art. 6(1)(c) GDPR); legitimate interest in securing our services (Art. 6(1)(f) GDPR) | Up to 3 years after the report is closed |
| Legal claims and compliance | Data relevant to a claim or legal obligation | Establishing, exercising or defending legal claims; responding to authorities | Legitimate interest (Art. 6(1)(f) GDPR); legal obligation (Art. 6(1)(c) GDPR) | Until the claims become time-barred (generally 3 to 6 years under the Polish Civil Code) |
Where we have collected data from someone other than you (for example from your employer who invited you to the Dashboard, or from public professional sources), the table shows the categories and sources. Providing data is voluntary, but without some of it we cannot answer your request, give you access to the Dashboard, conclude a contract with your organisation or consider your application.
3. Our use of AI
3.1. Our website assistant. The assistant on our website is an AI system built with our own platform. It tells you that it is AI at the start of the conversation. Your messages and, if you use voice, your audio are processed by AI model and speech providers that act as our processors to generate answers. The assistant may make mistakes; please do not rely on its answers for important decisions and do not share sensitive personal data, passwords or payment details with it.
3.2. No training on your data. We do not use your conversations, or data that our customers process with our platform, to train AI models, and the AI providers we engage are contractually prohibited from doing so.
3.3. No automated decisions. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
4. Who receives your data
4.1. We share personal data only as needed for the purposes above with:
- service providers acting on our behalf (processors), bound by data processing agreements: hosting (OVHcloud), authentication (Google Firebase), e-mail delivery (Twilio SendGrid), customer relationship management (HubSpot), AI model and speech providers for our website assistant, analytics and advertising services (only with your consent) and IT support;
- independent controllers, where they decide on the processing themselves: payment providers (Stripe; Chargebee during our migration), Microsoft for purchases via Azure Marketplace, banks, couriers, our professional advisers (lawyers, accountants, auditors), and social media platforms;
- joint controllers: for statistics about our LinkedIn page (Page Insights), we are joint controllers with LinkedIn Ireland Unlimited Company; for data collected by the Meta pixel on our websites (only with your consent), we are joint controllers with Meta Platforms Ireland Limited for the collection and transmission of the data. The essence of these arrangements is available from LinkedIn and Meta, and you can exercise your rights with either party;
- public authorities, courts and other bodies, when required by law;
- a buyer or successor of our business, in the event of a merger, acquisition or sale of assets, subject to equivalent protection of your data.
4.2. A detailed list of the providers that process our customers' data is available at https://virbe.ai/legal/subprocessors.
5. Transfers outside the EEA
Some of our providers (or their sub-processors) are located, or may access data, outside the European Economic Area, in particular in the United States. In such cases we ensure an adequate level of protection by relying on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies) or on the Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where needed. You can obtain a copy of the relevant safeguards by writing to [email protected].
6. Security
We protect personal data with appropriate technical and organisational measures, such as encryption in transit, access control with multi-factor authentication, logging and regular security testing. No method of transmission over the internet is completely secure; if you believe your data has been compromised, please contact us at [email protected] or [email protected].
7. Your rights
7.1. Under the GDPR you have the right to:
- access your data and receive a copy (Art. 15);
- rectify inaccurate or incomplete data (Art. 16);
- erase your data, for example where it is no longer needed or you withdraw consent (Art. 17);
- restrict processing in certain cases (Art. 18);
- data portability for data you provided to us that we process by automated means on the basis of consent or a contract (Art. 20);
- object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21(1));
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)) — for example by clicking "unsubscribe" in our e-mails or changing your cookie settings.
7.2. Right to object to direct marketing. You can object at any time to the use of your data for direct marketing, including profiling related to it. If you object, we will stop using your data for this purpose (Art. 21(2) and (3) GDPR).
7.3. To exercise your rights, write to [email protected]. We will respond within one month, which may be extended by two further months for complex requests, in which case we will inform you. We may ask for information to confirm your identity.
7.4. You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl, or with the supervisory authority in your country of residence or work.
8. Children
Our websites and Services are intended for businesses and are not directed at children. We do not knowingly collect personal data of children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
9. If you used an assistant built with Virbe on another company's website, app or kiosk
9.1. Companies that use our platform (our customers) decide how their assistants work and what data they collect. For the data processed in those conversations, the company is the controller, and we act as its processor under a data processing agreement. Please read that company's privacy notice and contact it to exercise your rights. If you contact us, we will forward your request to the company.
9.2. Some of our customers use kiosks with optional camera features (such as detecting that someone is standing in front of the kiosk or estimating age range or gender). These features process camera images locally on the kiosk and only aggregated statistics are sent to our platform; the kiosk operator must inform you about them with a notice on site.
10. Changes to this Privacy Policy
We update this Privacy Policy when our processing changes or when the law requires it. We publish each version with its effective date at https://virbe.ai/legal/privacy-policy, where previous versions remain available, and we inform registered users of material changes by e-mail or in the Dashboard.
Cookies and similar technologies are described in our Cookie Policy (https://virbe.ai/legal/cookie-policy).