Privacy Policy
1. Operator and contact
Virafo is the public brand of the project currently operated jointly by its co-founders Gustas Kiškiūnas and Timas Šegžda, identified on our About page. Both are the current operators and joint controllers for processing purposes determined by Virafo. MB Virafo is an intended future company and is not registered yet; it is not the current incorporated provider. The detailed allocation of joint-controller responsibilities still needs to be finalized and made available before publication. Any future transfer to a registered entity will require updated operator disclosures and appropriate notice.
Contact support@virafo.com for support, privacy requests and questions about this policy. No company registration number, VAT number or physical address is represented as verified.
2. Scope and responsibilities
This policy covers virafo.com, app.virafo.com, applicants, owners, platform reviewers and people using cleaner links. For website enquiries, access applications, account administration and service security, the two founders jointly determine the processing purposes. For cleaner details and property evidence supplied on a property operator’s instructions, that property operator normally determines the purposes and Virafo processes that content on its behalf. The founders’ detailed responsibility arrangement and customer processing agreement remain publication requirements.
3. Website and Early Access information
The Alpha Access form collects your first name, email, property-count range, property region, role, current turnover-checking process, readiness to test and optional turnover challenge. Company information is used only if actually supplied; we do not infer missing answers. Historical waitlist records may contain the earlier signup fields. The public waitlist is closed.
We also record submission and acknowledgement times, application status, reviewer decisions and notes, invitation attempts and status, and workspace activation where applicable. Attribution can include the page, referring site, button/entry path and UTM campaign tags. Contact forms collect name, email, topic and message. Support requests may include the account, selected category and message.
Applications use the Firebase intake and admin-review pipeline. Historical records may remain in the former Google Sheets/Apps Script system; optional lead mirroring is supported by the backend. Sheet copies require coordinated cleanup and are not automatically erased by Firestore retention. A human decides access; approval and invitation delivery are separate states.
4. Account, property and cleaner data
Account information includes your name, email, organization, timezone, language, notification preferences, optional profile image, verification and security records. Firebase Authentication handles passwords and authentication tokens; passwords are not stored in Virafo application records. Admin/reviewer permissions are server-issued; an owner may separately hold platform administrator access.
Owners enter property names and addresses, timezones, instructions, rooms, checklists, reference and cover photos, schedules and turnover notes. Cleaner records contain the supplied name and optional phone/email, assignments and access-link settings. Cleaners normally use a scoped link rather than create an owner account; a technical session authorizes the permitted workspace. Link-opening records include timestamps, browser information and a shortened one-way IP hash.
Turnover evidence includes before, after and correction photos, capture/upload times, photo quality results, AI findings, reviewer decisions, correction requests, issues, notifications and activity history. Uploaded images may reveal personal details or contain file metadata. Do not photograph people, identity documents, screens or private belongings unnecessarily, and do not put sensitive personal information in notes. We do not promise automatic removal of every identifying detail or metadata field.
5. AI-assisted analysis and human review
When server entitlements and limits permit, Virafo sends selected reference, turnover and correction images and relevant room/checklist or issue context to OpenAI’s API. Analysis produces possible issues, photo-quality and coverage findings. Names, emails and phone numbers are not required analysis fields, but personal information included in images or free text can be transmitted. Authorized human reviewers assess submitted evidence and decide approval, corrections or escalation. AI does not automatically approve a turnover.
AI and human review can miss problems or be wrong. Findings do not certify cleanliness, safety or legal compliance. OpenAI states that API content is not used for model training by default; standard abuse-monitoring logs can retain content for up to 30 days, with legal/security exceptions. No zero-data-retention arrangement is verified for Virafo. We do not use this workflow for solely automated decisions with legal or similarly significant effects about individuals.
6. Purposes and proposed lawful bases
We process account and service data to provide requested access, manage properties and turnovers, review evidence, send operational notices and handle support: performance of a contract or steps requested before a contract (GDPR Article 6(1)(b)), where the individual is a party. For business contacts who are not personally party to the contract, the proposed basis is the legitimate interest in operating and supporting the service (Article 6(1)(f)).
Application assessment and invitations support your request to join the pilot; abuse prevention, scoped access, security logs and operational diagnostics support our legitimate interests in protecting the service. Legally required records rely on Article 6(1)(c). Property operators must establish their own lawful basis for cleaner/guest data and inform those people. Consent, where genuinely optional and relied upon, can be withdrawn. Form acknowledgement alone is not permission for unrelated marketing; promotional campaigns are not enabled by this policy. Final lawful-basis assessments require operator/legal approval.
7. Providers and recipients
Google/Firebase provides Authentication, Firestore, Storage, Cloud Functions, App Check/reCAPTCHA Enterprise and associated infrastructure. Google Sheets/Apps Script can hold historical or mirrored leads. OpenAI processes selected images/context for analysis. Resend sends account verification, password-reset, application/invitation, review and support emails. Hostinger hosts the marketing website and app frontend. Cloudflare Turnstile protects marketing forms. The support mailbox provider processes correspondence; its contractual identity and retention remain to be confirmed.
Twilio SMS sending is disabled for this release; Virafo does not send WhatsApp messages through Twilio. Copying, rotating or opening the native Share Link chooser does not trigger a Twilio message. When you choose WhatsApp, Messenger, SMS, email or another app in the device’s share sheet, that app receives the link and applies its own terms and privacy rules. Existing SMS delivery records, if any, follow the retention below. Any future paid messaging activation requires a separate configuration and notice review.
Only authorized staff/reviewers and service providers needing the information should access it. Information may also be disclosed where legally required or to address security incidents and legal claims. We do not sell personal data or use third-party advertising trackers. Provider processing terms, the customer processing agreement and transfer safeguards must be finalized before public launch; listing a provider does not certify that paperwork is complete.
8. Cookies, browser storage and security checks
The marketing frontend has no advertising pixels or analytics SDK. It keeps campaign attribution and referring-site information in sessionStorage for the current tab, and language preferences in sessionStorage/localStorage. A language helper can use the browser Accept-Language header; it does not locate you by GPS. Hosting/security services can receive IP addresses, request headers and technical logs.
Firebase Authentication persists sign-in state in browser/device storage. The app uses Firebase App Check with reCAPTCHA Enterprise on the web; marketing forms use Cloudflare Turnstile, which receives browser/network signals and a verification token. These are security checks rather than advertising analytics. Browser permission is requested for camera use; denying it can prevent capture. Clearing storage may sign you out or reset preferences. Provider cookie/storage behavior and any consent or exemption requirements need final legal review; no blanket cookie exemption is claimed.
9. Retention and deletion
Backend retention jobs use the following periods; deletion is asynchronous and is not an exact-to-the-second guarantee. Before/after/correction photo files are scheduled for purge 365 days after turnover closure. Photo audit records can remain marked deleted. Reference, cover and profile photos remain until replaced/deleted or workspace/account deletion, as applicable. Turnover records, findings and activity history can remain while the workspace exists even after evidence photo files expire.
Cleaner link-opening/session records: 395 days from creation. Virafo email-queue/content copies: 90 days from creation. SMS delivery logs, if present: 90 days from creation (masked number/status, not message text). Contact-form messages: 730 days from creation, not from the end of a conversation. Rate-limit counters expire after their window, with a 30-day ceiling in the cleanup job.
Website leads and related application audit records: 730 days after the latest submission, waitlist upgrade or application review/invitation/activation change, except an activated customer’s lead is kept while its workspace exists. Old Sheet copies require manual coordination. Provider logs, support correspondence, production backups and legally necessary records have separate schedules that are not fully verified here; these schedules and transfer/deletion arrangements remain launch disclosures to finalize.
Owners can request permanent workspace/account deletion through the app after recent authentication and confirmation. Access is blocked and a background job removes organization files, records and the Auth account; retries or support may be needed. Minimal deletion-request/lock identifiers remain for accountability and stale-token protection. Delivered emails, processor copies, logs and backups are not instantly erased and follow their separate schedules. Access/export and other privacy requests are handled through support; no instant self-service export is promised.
10. Locations, international transfers and security
Production Firestore is in the US multi-region nam5 and Cloud Functions run in us-central1. Image storage and other providers can process data in the US or other countries; no EU-only residency is promised. Production backup exports exist. Exact provider locations, backup/log schedules, executed processing terms and applicable transfer mechanisms (such as EU standard contractual clauses where required) must be confirmed by the operator before launch. We do not claim that merely choosing a provider establishes lawful international transfers.
Controls include authenticated and organization-scoped access, restricted cleaner sessions, server-authorized reviewer operations, short-lived photo access, rate limits and app/bot verification. MFA is supported for platform administrators and enforced only according to backend policy. App Check registration alone does not prove real-device attestation or enforcement. No internet service is completely secure. Tell support promptly about lost links or suspected unauthorized access.
11. Your rights and requests
Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. These rights have conditions and exceptions. Email support@virafo.com; we may need proportionate identity verification. Under GDPR, requests are normally answered within one month, with a lawful extension for complex requests. You may complain to Lithuania’s State Data Protection Inspectorate (vdai.lrv.lt) or your competent supervisory authority.
Cleaners and other people whose data an owner supplies can contact that owner or Virafo; we will help route the request according to the relevant responsibilities. Required form/account fields are needed to assess access or provide the service; without them we may be unable to do so. Optional fields may be left blank. The service is for adult business users and is not directed at children.
12. Policy updates
This review version is not yet effective. When approved, the published policy will identify its version and effective date. Material changes to processing will be communicated through an appropriate service notice; any consent or other legal step required for a new purpose must happen before that processing begins. A future company registration must be reflected transparently, not treated as already completed.
← Back to Virafo