Privacy Policy
1. Who we are and what this policy covers
AI Proposal Generator is operated by [FULL LEGAL NAME OF THE BUSINESS OR PROPRIETOR], trading as Virtufy, at [BUSINESS POSTAL ADDRESS] (“Virtufy”, “we”, “us”). This policy explains how we handle personal information in connection with applications, accounts, proposal generation and support at proposals.virtufy.com.
This product policy does not replace separate notices for unrelated services on the Virtufy website. Privacy questions and requests may be sent through Contact Virtufy or to [MONITORED PRIVACY EMAIL AND RESPONSIBLE CONTACT NAME/ROLE].
2. Information we collect
- Application and account information: name, email address, password hash, applicant type, organisation or trading name, role, country, industry, organisation size, expected proposal volume and intended use. We also collect a company website or personal LinkedIn profile supplied by you, optional phone number and referral source, policy acceptance and verification records.
- Company and proposal content: company background, branding, requirements, RFPs, instructions, Q&A, supporting documents, generated proposals, edits and versions. These materials may contain personal information about your staff, customers or other individuals.
- Support and administration: messages, attachments, application review decisions, company assignments, access approvals, subscription records and email-delivery records.
- Technical and security information: IP addresses, session/device identifiers where used, request times, activity and usage logs, errors, and information needed to detect misuse. AI-generation logs may contain submitted prompts or extracted document content and returned output, not only technical metadata.
3. Why we use this information
We use information to assess access requests, verify email addresses, set up and manage company accounts, generate and store proposals, apply plan limits, provide support, send operational emails, investigate errors, protect the service and meet applicable obligations.
Mandatory application information is needed to assess and administer access. Optional phone and referral fields may be left blank. Providing a website or LinkedIn profile helps us review the application; it does not authorise access to your LinkedIn account. Registration does not by itself constitute consent to unrelated marketing. Any optional marketing activity must be explained separately and offer the choices required by applicable law.
4. AI processing and service providers
When you request generation or regeneration, relevant requirements, extracted document text, selected company background and instructions are sent to the AI service to produce a response. Do not upload material unless you are authorised to share it for this purpose. Remove unnecessary personal information and confidential details before submitting.
Our current service components include OpenAI’s API for proposal generation, BigRock for hosting, Zoho Mail for operational email and Cloudflare Turnstile for bot protection. These providers receive information needed for their respective services. Provider retention, processing locations and permitted uses depend on the applicable agreements and account settings.
[CONFIRM BEFORE PUBLICATION: deployed AI/provider list; provider retention and model-training settings; hosting and backup locations; and any additional analytics, monitoring or payment providers. Insert the verified details here.]
Authorised Virtufy administrators and support personnel may access information as needed for application review, support, security and service operation. Members of your company may access content according to their assigned permissions. Information may also be disclosed when required by applicable law or to address fraud, security incidents or legal claims.
5. Cloudflare Turnstile and cookies
We use Cloudflare Turnstile on registration and verification-email resend forms to help distinguish people from automated traffic. Cloudflare processes technical signals such as IP address, browser information and site origin for bot detection and to improve its detection capabilities. See the Cloudflare Turnstile Privacy Addendum.
The portal uses session cookies for sign-in and may use device identifiers for security and misuse detection. Blocking necessary cookies or security scripts can prevent registration or login. [CONFIRM COOKIE INVENTORY: list actual cookie/identifier names, purposes and lifetimes; disclose any non-essential analytics and implement applicable consent controls before enabling them.]
6. Storage, international processing and retention
Providers may process information outside your country. Applicable safeguards and transfer requirements depend on the processing locations, contracts and law. [CONFIRM PROCESSING COUNTRIES AND APPLICABLE TRANSFER SAFEGUARDS].
Information is retained for the purposes described above, subject to applicable obligations, dispute resolution and security needs. Trial expiry does not itself delete an account, proposals or uploaded files. The following schedule must reflect the actual deletion process, including generation logs, email queues and backups:
| Information | Retention / deletion schedule |
|---|---|
| Unverified, declined or abandoned applications | [PERIOD AND STARTING EVENT] |
| Accounts, uploaded files and proposals after closure or trial expiry | [PERIOD, EXPORT WINDOW AND DELETION PROCESS] |
| Support, security, email and AI-generation logs | [PERIODS BY CATEGORY] |
| Backups and legally required records | [BACKUP EXPIRY AND APPLICABLE RECORD-KEEPING PERIODS] |
7. Security and your choices
The portal uses password hashing, account permissions and server-side verification controls. No online service can guarantee absolute security. Keep your credentials private and report suspected unauthorised access promptly.
Contact us to request access to or correction of your personal information, account closure or deletion, or to raise a privacy complaint. Where applicable, you may also withdraw consent, object to or restrict processing, request portability, or contact the relevant authority. Available rights and exceptions depend on the law that applies to you. We may verify your identity before acting. Withdrawing information needed to operate your account may prevent us from continuing the service.
If your organisation manages your account, some requests may need to be coordinated with its administrator. For personal information your organisation includes in proposals, it is responsible for ensuring that its collection and instructions to us are lawful. Contact us if you believe someone has uploaded your information without authority.
8. Adults, updates and contact
The service is intended for business users aged 18 or over. It is not intended for children. If you believe a child has provided information, contact us so we can investigate and take appropriate action.
We may update this policy to reflect service or operational changes. We will revise the effective date and provide additional notice where required. Material new uses of personal information will be addressed as required by applicable law.
Privacy contact: [MONITORED PRIVACY EMAIL AND RESPONSIBLE CONTACT NAME/ROLE]. Postal address: [BUSINESS POSTAL ADDRESS].