Legal framework and controller
This policy describes the personal data processing carried out by VireLyon AI LLC, as data controller, represented by its manager VOAHARINANTENAINA Scofie Nathan, for the virelyon.io website and the VireLyon platform.
VireLyon applies the principles of Regulation (EU) 2016/679 (GDPR) to all its users. For people located in the European Union, the GDPR applies in full, as does the Swiss Federal Act on Data Protection for people located in Switzerland. The data protection laws of each data subject’s country of residence are also respected.
Contact for any personal data question: privacy@virelyon.io
Data collected and purposes
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Demo request form | First and last name, company, work email, phone, message | Respond to the request and arrange the demonstration | Pre-contractual steps at the data subject’s request |
| Customer relationship | Business contact details, exchanges, account history | Account management, support, billing | Performance of the contract |
| B2B outreach | Business contact details | Targeted commercial communications | Legitimate interest, with a right to object at any time |
| Security and logging | IP address, timestamp, user agent | Abuse prevention, rate limiting, traceability | Legitimate interest |
| Audience measurement | Aggregated usage statistics | Site improvement | Consent, where a non-essential tracker is set |
No sensitive data within the meaning of applicable regulations is collected through the site. Free-text form fields must not be used to transmit such data.
Data processed on behalf of Customers
When a Customer uses the Platform, data relating to its own prospects, customers or staff is processed by VireLyon as a processor, on the documented instructions of the Customer, which remains the controller.
This relationship is governed by a separate data processing agreement setting out the nature of the processing, security measures, use of sub-processors and the fate of data at the end of the contract.
Each Customer has a logically isolated space at database level. Isolation is enforced by row-level security policies keyed to a unique customer identifier.
Recipients and sub-processors
Data is accessible only to authorized members of the VireLyon team and to the following technical providers, acting on instructions:
| Provider | Role | Location |
|---|---|---|
| Hostinger | Hosting of the website and automation orchestrator | United Kingdom (Manchester) |
| Supabase | Database, authentication, storage | European Union (Sweden) |
| Anthropic | Language models powering the agents | United States |
| Hunter | Verification and enrichment of business email addresses | European Union |
| Apify | Collection of public data for prospecting | European Union |
| Orange | SMS delivery, where that channel is enabled | Country of the relevant operator |
International transfers
Delivering the service involves transfers of data between several countries, notably the United Kingdom (hosting), the European Union and the United States.
For people located in the European Union, these transfers rely on a European Commission adequacy decision where one exists (United Kingdom, providers certified under the EU-U.S. Data Privacy Framework), or otherwise on appropriate safeguards.
Transfers are governed by the standard contractual clauses included in the relevant providers’ agreements, supplemented where appropriate by additional technical measures such as encryption and minimization of the data transmitted.
Retention periods
| Data | Period |
|---|---|
| Unconverted demo request | 3 years from the last contact |
| Customer account data | Contract term, then 30 days for retrieval |
| Data after termination | Deletion or anonymization at the end of the retrieval period |
| Accounting records and invoices | Applicable statutory retention period |
| Connection and security logs | 12 months |
Beyond these periods, data is irreversibly deleted or anonymized.
Your rights
Every data subject has the following rights:
- right to information about processing concerning them;
- right of access to their data;
- right to rectification of inaccurate or incomplete data;
- right to object to processing on legitimate grounds, and without grounds for direct marketing;
- right to erasure, within the limits of statutory retention obligations;
- for people located in the European Union, additional rights to restriction, portability and not to be subject to a solely automated decision.
These rights can be exercised at privacy@virelyon.io. A response is provided within a maximum of thirty (30) days. Proof of identity may be requested where there is reasonable doubt as to the requester’s identity.
If the response is unsatisfactory, a complaint may be lodged with the data protection authority of the data subject’s country of residence, for example the CNIL in France.
Security
Appropriate technical and organizational measures are implemented:
- encryption in transit (TLS) and at rest;
- per-customer data isolation at database level;
- individual authentication, permission management and least-privilege principle;
- logging of access and of agent actions;
- regular backups and a restoration procedure;
- rate limiting and filtering on public entry points.
In the event of a data breach likely to create a risk to data subjects, the publisher notifies the competent supervisory authority and, where the risk is high, informs the data subjects.
Cookies and trackers
The site operates without advertising trackers or third-party tracking cookies.
Browser local storage is used to remember one display preference: the light or dark theme. This information stays on the visitor’s device, is never sent to a server and allows no identification.
Setting any non-essential analytics tracker will be preceded by obtaining the visitor’s consent, revocable at any time.
Changes to this policy
This policy may be amended to reflect changes to the service or to regulations. The last update date appears at the top of the page. Any substantial change is notified to Customers.