Privacy Policy

This Privacy Policy (the «Policy») governs the collection, use, storage, and protection of personal data of users of the VirtuOps platform (hereinafter — «Platform», «we», «us»), accessible at app.virtuops.io.

VirtuOps is a B2B SaaS platform for automating customer support via AI-driven chatbots across WhatsApp, Telegram, Instagram, and a web widget. The Platform is operated by Individual Entrepreneur MAXMUDOV NURMUHAMMAD ERGASH O'G'LI under the VirtuOps trade name and is intended for businesses and individual entrepreneurs located primarily in Uzbekistan and the CIS region.

By registering on the Platform and using its services, you expressly consent to the processing of your personal data in accordance with this Policy and the terms of the Public Offer Agreement.

This Policy is drafted in compliance with the Law of the Republic of Uzbekistan «On Personal Data» (No. ZRU-547, dated 2 July 2019) and other applicable legislation of the Republic of Uzbekistan.

We collect the following categories of personal data:

Registration data: full name, e-mail address. Collected when you create an account on the Platform.

Verification data: mobile phone number. Used for identity verification during registration and two-factor authentication.

Payment data: UzCard, Humo, or Visa card details provided at the time of payment. We do not store the full card number or CVV code. Upon the first successful payment, Paylov (paylov.uz) issues a payment token (card token) that we store in encrypted form for the purpose of recurring subscription charges.

Tax identification: Individual Tax Number (ПИНФЛ / STIR) — collected exclusively for users who receive payouts to a card, and verified via the Paylov API in accordance with the requirements of the Central Bank of the Republic of Uzbekistan.

Message history: conversation logs between end-users (your customers) and AI bots deployed on the Platform, processed to provide the core service functionality.

Instagram account metadata: when you connect an Instagram professional account, we collect its public profile metadata — username and account ID — to identify the connected account and display it in your dashboard.

Instagram media content: when one of your customers shares one of your business's own Instagram posts in a Direct message, we read that post's caption via the Instagram Graph API so the AI assistant can answer questions about the product. Separately, when you set up comment automation we list the posts of your connected account — post ID, caption, thumbnail, permalink, and publication date — so that you can choose the post a rule applies to. Through the Instagram API we access only media owned by your connected Instagram account and never access posts or media owned by other accounts; posts promoted through a connected ad account are covered under «Advertising data» below.

Instagram comments: if you enable comment automation, we receive comments left under the posts of your connected account through Meta's webhook: the text of the comment, its identifier, and the Instagram username and user ID of its author. The text is matched against the keywords you configured; if no rule matches, it is discarded and nothing is stored. Where a matching rule only replies publicly, we retain the comment identifier, the post identifier, and the commenter's Instagram user ID — the minimum required to reply once and to avoid replying to the same person twice under the same post. Where a matching rule also sends a Direct message, that exchange becomes a conversation in your inbox, and the text of the comment together with the author's username is stored as its first message, on the same terms as the message history described above.

Instagram post statistics: for the posts of your connected account we read the aggregate metrics provided by Instagram — views, reach, and total interactions. These are aggregate counters for your own content; they contain no personal data of individual viewers and are shown only to your organisation.

Advertising data (Meta Ads): if you connect a Facebook ad account through Facebook Login for Business, we request only the ads_read permission — read-only access to your ads — and receive the list of ad accounts you chose to share: their ID, name, currency, and time zone. With it we read your ads, the Instagram posts they promote (post ID, caption, thumbnail, permalink), and aggregate statistics about their delivery — spend, impressions, reach, clicks, video watch-through, messaging conversations started, and audience breakdowns by age, gender, and country. These are aggregate figures about your own advertising and contain no personal data of the individual people who saw the ads. A shared ad account may also advertise other Instagram accounts; their promoted posts are read and stored the same way but are shown only for the Instagram account connected in your dashboard. We store the access token (encrypted), your Facebook user ID, the permissions granted and the token's expiry dates, the list of shared ad accounts, and the list of promoted posts; the statistics are requested from Meta when you open the dashboard and cached for no longer than 10 minutes. Disconnecting the ad account in the dashboard, or a data deletion request made through Facebook (Section 8), deletes all of it. When you ask the in-dashboard copilot about your ads, the data it retrieves — figures, ad and campaign names, and captions of promoted posts — is sent to the AI provider (Section 6) to compose the answer and is kept in the history of that copilot conversation; disconnecting the ad account does not remove it from there.

WhatsApp data (via the WhatsApp Business Platform / Cloud API): end-customer phone numbers and WhatsApp profile names of people who message a connected business; message content exchanged with the assistant, including text, images, documents, and voice messages; and metadata of the connected business's WhatsApp Business Account (WABA) and business phone number, together with the access tokens that allow us to send and receive messages on the business's behalf.

For WhatsApp, VirtuOps acts as a Tech Provider: we access and process this data on behalf of our business customers (the WABA owners) so their AI assistant can reply to their end-customers. Business-initiated messages sent outside the 24-hour customer service window are delivered using message templates pre-approved by Meta.

Technical data: IP addresses, browser type and version, device identifiers, access logs, and other technical metadata collected automatically when you use the Platform.

We use the collected data exclusively for the following purposes:

Account management: creating and maintaining your account, authenticating access, and providing Platform features.

Service delivery: operating AI bots, routing messages across connected channels (WhatsApp, Telegram, Instagram, web widget), and providing analytics.

Human operator handoff: when an AI bot hands off a conversation to a human operator or a human operator takes over, authorised members of your organisation may access the relevant message history to reply to the customer and resolve the request. Where the customer's last message is more than 24 hours old, the operator's reply is delivered using Meta's Human Agent tag — it is applied for this case alone, so that a request received outside working hours can be answered by a person rather than by an automated system.

Instagram post-aware replies: reading the caption of your connected account's own Instagram posts so the AI assistant can answer product questions when a customer shares one of those posts in a Direct message. This uses only the connected account's own media.

Comment automation: replying publicly, on your behalf, to a comment that matches the keywords you configured, and sending its author a single Direct message with the information you specified. Both actions occur only under the posts you selected and only for comments that match your keywords. If the person replies to that Direct message, the exchange continues as an ordinary conversation, handled as described in this Policy.

Post statistics: displaying views, reach, and interactions for your own posts inside your VirtuOps dashboard, so that you can see which posts generate customer conversations. These metrics are not used for any other purpose and are not disclosed to third parties.

Ad performance: showing the spend, delivery, and results of your ads in your VirtuOps dashboard next to the conversations those ads started, and letting comment automation apply to posts that exist only as ads. Access to advertising data is read-only: we never create, change, or pause ads.

Subscription billing: processing one-time and recurring payments for the Platform subscription via Paylov. The card token stored by us is transmitted to Paylov on a monthly basis via an automated cron job to charge the subscription fee.

Fiscal compliance: generating and issuing fiscal receipts through the Paylov API in accordance with the requirements of the Tax Code of the Republic of Uzbekistan.

Identity and fraud prevention: verifying user identity (ПИНФЛ / STIR) through Paylov and complying with the anti-fraud requirements of the Central Bank of the Republic of Uzbekistan.

Service improvement: analysing aggregated and anonymised usage data to improve Platform performance, reliability, and feature set.

Legal obligations: complying with requirements of competent authorities of the Republic of Uzbekistan where required by applicable law.

We do not use your personal data for advertising, marketing profiling, or sale to third parties.

All payment transactions on the Platform are processed exclusively through Paylov (paylov.uz) — a licensed payment aggregator certified to PCI DSS standards, holding a licence from the Central Bank of the Republic of Uzbekistan and integrated with the anti-fraud system of the Central Bank.

When you enter your card details to pay for a subscription, those details are transmitted directly to Paylov via an encrypted channel. We never receive, store, or process the full card number or CVV/CVC code.

Upon successful payment, Paylov issues a unique payment token bound to your card. We store this token in encrypted form using the AES-256-GCM algorithm. The token is used solely to initiate recurring subscription charges on a monthly basis via an automated cron process, which transmits only the token to Paylov.

Fiscal receipts (online checks) for each payment are generated through the Paylov API and are available in your dashboard under Settings → Billing → History; if a receipt has not been issued, contact us on Telegram: @VirtuOps_admin. Paylov acts as the fiscal agent (commissioner) for the purpose of issuing fiscal receipts.

By accepting the Public Offer Agreement, you expressly consent to the storage of the payment token and its transmission to Paylov for the purpose of recurring subscription billing, in accordance with the requirements of Paylov's terms of service.

To cancel a subscription and revoke consent to recurring charges, you may do so at any time through your account settings or by contacting our support team.

Your personal data is stored on servers of cloud infrastructure providers located in data centres that comply with international information security standards.

We implement the following technical and organisational security measures:

— Payment tokens are encrypted using AES-256-GCM prior to storage and are accessible only to the automated subscription processing system.

— All data is transmitted over encrypted connections (TLS 1.2 or higher).

— Access to personal data is restricted to authorised personnel who require it to perform their job functions.

— Systems are regularly audited for vulnerabilities.

Conversation history is stored for up to 365 days, counted from the last activity in the conversation — a reply extends the life of the whole conversation, its first message included. Past that period the conversation is deleted in full, together with any files sent in it. This period is the same for every plan; the plan only governs how far back an organisation may look at its own conversations.

A contact record (the person's name, phone number and the channel they wrote from) is deleted, and their leads are anonymised, 2 years (730 days) after the person's own last action — their message, a button tap, a shared post or a comment. Actions of the organisation, such as an operator's replies or its work on a lead, do not extend this period. Leads that have no contact record are anonymised 2 years after the lead was last changed. If the organisation keeps the person as a client in VirtuOps CRM, their channels follow the client's period instead: the client is deleted together with all of their channels, and their deals are anonymised, 2 years after the person's last contact — their own action in any of their channels, or a contact (a call, a visit) that the organisation recorded by hand as a deal.

Anonymising a lead means erasing the name, phone number, answers and anything else that points to the person. Only the lead number and the fact that the lead was made remain, for the organisation's reports. Nothing about the person is left in such a record.

In a conversation that an organisation's staff have with the in-dashboard assistant (Copilot), each exchange — a staff member's message and the assistant's reply to it — is deleted 365 days after that message; a conversation with no messages newer than 365 days is deleted in full.

Copies that have already gone to the organisation's own systems — Google Sheets, Notion, amoCRM, Bitrix24, emails and Telegram notifications — are not deleted by the Platform: the organisation manages them. If the organisation has connected such a spreadsheet or Notion database to its assistant for search, the Platform keeps a copy of it and refreshes it from the source: a row disappears from our copy at the next sync (usually within an hour) after the organisation deletes it on its side. If the spreadsheet or database stays unavailable for 7 days (deleted, or access to it closed), the copy is deleted in full.

When a lead is ready, when a person is waiting for a reply from a human (the conversation has been handed over to an operator, or the assistant's AI replies are switched off), or when a person with an open deal comes back with a new conversation, the Platform notifies the organisation's staff — in Telegram and, if needed, by email. A lead notification contains the person's answers (the values of the lead's fields); a notification that the person is waiting for a human contains their name or username and their last message — up to 200 characters in Telegram, up to 500 in an email — and while an operator handles the conversation, the person's new messages reach that operator's Telegram in the same form; a notification that the person has come back contains up to the first 200 characters of their new message. The Platform does not store the text of these notifications, and deleting the person's data in VirtuOps does not remove them: the messages stay in the staff members' Telegram and mailboxes until they delete them. Our email delivery provider, Resend, keeps the emails and their logs for 30 days, and its backups for up to 7 days more.

If you wrote to the assistant of an organisation that uses VirtuOps and want your data deleted, contact that organisation: its owner or administrator deletes the contact in the «Chats» section or the client in the CRM «Clients» section. This deletes the conversations, files and contact record — also in the organisation's other assistants, if you wrote to them from the same Telegram or Instagram account or the same WhatsApp number, and, if the organisation keeps you as a CRM client, the whole client with every channel linked to it — and anonymises your leads and deals. You can also write to us at support@virtuops.io.

After a deletion on request, the deleted data remains in backups until they expire (up to 30 days). Files that could not be erased from storage remain for up to 365 days, and data that ended up in a Copilot conversation remains until the exchange it ended up in is deleted under the period above.

Upon deletion of your account, all personal data associated with it is permanently deleted within 30 calendar days, except where retention is required by applicable law (e.g. fiscal records subject to mandatory retention periods).

In the event of a personal data breach that poses a risk to your rights and interests, we will notify you as required by applicable legislation.

We do not sell or transfer your personal data to third parties for commercial purposes. Personal data may be shared with the following categories of recipients solely to the extent necessary to provide the Platform's services:

Paylov (paylov.uz): payment processing, fiscal receipt generation, and ПИНФЛ / STIR verification. Paylov processes data in accordance with its own privacy policy and PCI DSS requirements.

Meta Platforms (Instagram, WhatsApp): message content and related metadata are transmitted through Meta's Instagram Messaging API and the WhatsApp Business Platform (Cloud API) to deliver messages to and from the connected accounts. Post captions, the list of the connected account's own posts, comments under them, public replies to those comments, and aggregate post statistics are exchanged through the Instagram Graph API. If you connect an ad account, advertising data is read through the Meta Marketing API with read-only access. For WhatsApp, we receive and store Business Integration System User access tokens scoped to each business customer's WABA, which we use solely to provide the messaging service on that customer's behalf. This data is processed in accordance with Meta's terms and policies.

Telegram: transmission and delivery of messages via the Telegram Bot API. Data is processed in accordance with Telegram's Privacy Policy.

AI / LLM providers (OpenAI, Anthropic): message content, shared images, and voice messages are transmitted to OpenAI (GPT-4o, Whisper) and Anthropic (Claude) APIs to generate AI responses, in-dashboard copilot assistance, and audio transcription. These providers process the data solely to return a response and do not use API data to train their models. Data is transmitted over encrypted connections.

Resend (resend.com): sending the Platform's emails — account emails (verification codes, password reset, team invitations, billing and usage alerts) and notifications to the organisation's staff, which may contain the customer's name, their answers in a lead and an excerpt of their message. Resend keeps the emails and their logs for 30 days, and its backups for up to 7 days more.

Cloud infrastructure providers: hosting, data storage, and computing resources. Providers operate under data processing agreements that include appropriate data protection obligations.

Competent state authorities: personal data may be disclosed to authorised state bodies of the Republic of Uzbekistan upon receipt of a lawful request in accordance with applicable legislation.

All third-party processors are engaged under contractual terms that ensure an adequate level of data protection.

VirtuOps's use and transfer to any other app of information received from Google APIs will adhere to the Google API Service User Data Policy, including the Limited Use requirements.

Our Platform requests access to your Google Sheets to enable AI-driven interactions. Specifically, we use the data to: (1) Read information from your spreadsheets to provide answers via AI bots, and (2) Write or update data in your spreadsheets to record bookings or customer requests as directed by your end-users.

We do not use Google user data for serving advertisements, and we do not sell this data to third parties. We only share Google user data with third-party service providers (such as AI model providers) to the extent necessary to provide the AI response functionality, and only with your explicit consent.

You can revoke the Platform's access to your Google account at any time through your Google Security Settings or by disconnecting the integration in the VirtuOps dashboard.

In accordance with the Law of the Republic of Uzbekistan «On Personal Data», you have the following rights with respect to your personal data:

Right of access: you may request confirmation of whether we process your personal data and obtain a copy of such data.

Right to rectification: you may request correction of inaccurate or incomplete personal data.

Right to erasure: you may request deletion of your personal data. Upon account deletion, data is permanently erased within 30 calendar days.

Meta / Instagram data deletion callback: for data received through Meta or Instagram integrations, we also support Meta's data deletion callback and provide confirmation through https://virtuops.io/data-deletion.

Right to withdraw consent: you may withdraw consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

Right to restrict processing: you may request restriction of the processing of your personal data in cases provided for by law.

Right to object to recurring charges: you may cancel your subscription and revoke consent to recurring card charges at any time through your account settings or by contacting support.

To exercise any of the above rights, please contact us using the contact details provided in Section 9 of this Policy. We will respond to your request within 15 business days.

If you have any questions regarding this Privacy Policy, the processing of your personal data, or the exercise of your rights, please contact us:

Platform: VirtuOps

App: app.virtuops.io

Website: virtuops.io

Address: Tashkent city, Mirzo Ulugbek district, Ulugbek, Korasuv buyi, 131A

Phone: +998900119989

Support: support@virtuops.io

Changes to this Policy will be published on this page with an updated «Last updated» date. Continued use of the Platform after publication of changes constitutes your acceptance of the revised Policy.