Privacy Policy

1. Who we are

Vilura (vilura.se) is operated by [COMPANY LEGAL NAME, e.g. "Vilura AB"], registration number [ORGANISATION NUMBER], registered address [REGISTERED ADDRESS, COUNTRY] ("Vilura", "we", "us"). We build and operate Jarvis, an AI operating system that plans and carries out tasks — text and voice conversation, website building, customer-relationship tools, and an AI receptionist feature — for individuals ("Private customers") and businesses ("Business customers") worldwide.

For the personal data described in this policy, Vilura acts as the data controller — except for data a Business customer enters about their own customers (contacts, leads, conversations handled by their AI receptionist, and similar). For that category, the Business customer is the controller and Vilura acts as their data processor. See our Data Processing Agreement for that relationship.

2. Who this policy covers

• Visitors to vilura.se who haven't created an account.
• Private customers — individuals with a personal Jarvis account.
• Business customers and the individual users they add to their account.
• End customers of a Business customer — for example, someone who calls a Business customer's AI receptionist, or a contact a Business customer stores in their CRM. Vilura processes this data on the Business customer's instructions, as their processor; if you are such an end customer and have a question about your data, you should generally contact the business you interacted with directly, who can also relay requests to us.

3. Data we collect

3.1 Account data

When you register: your email address, a hashed (never plaintext) password, your company or display name, and your chosen plan. We never store your raw password.

3.2 Payment data

Payment card details are entered directly into Stripe's own hosted checkout page and never pass through or get stored on our servers. We receive and store the outcome (plan, subscription status, amounts, currency) and Stripe identifiers needed to manage your subscription — not your card number.

3.3 What you say to Jarvis

Text messages and voice recordings you send are processed to generate a reply. Voice audio is forwarded to our speech-to-text provider for transcription and is not stored by Vilura itself after the request completes — we don't keep an audio archive. The resulting text, and Jarvis's replies, are stored as your conversation history so that Jarvis can refer back to earlier turns in the same conversation, until you delete your account (see Section 12) or ask us to delete a specific conversation.

3.4 Data you enter for your own use of the product

Depending on which features you use: CRM contacts and notes, sales/quote records, AI receptionist configuration and call/chat transcripts, custom agent definitions, files you upload to your workspace, and any third-party account connections you choose to make (see Section 7.3).

3.5 Usage and billing data

Which AI models and voice minutes you use, and the resulting cost, so we can enforce your plan's usage limits and bill you correctly.

3.6 Technical and log data

Standard server logs — IP address, timestamps, request path, error details — kept for security monitoring, abuse prevention, and debugging.

4. Location data

We treat location as sensitive and handle it deliberately narrowly. If you grant your browser's location permission, or if you don't, we fall back to an approximate location derived from your IP address via a third-party lookup (Section 7). Either way, the coordinates are used only for the single request that needs them — for example, "find a restaurant near me" — and are not written to a database or stored against your account. They exist only in server memory for the duration of that one request.

If a conversation you have with Jarvis happens to mention a place or address in the text itself, that text is retained as ordinary conversation content per Section 3.3 — this section is only about the coordinate data used for location-aware features.

5. Why we process it (legal basis)

We do not currently send marketing emails or use your data for advertising. If that changes, we will ask for your consent first and update this policy.

6. How long we keep it

• Account and conversation data: for as long as your account is active, so Jarvis can use your history as context. Deleted immediately on account deletion (Section 12).
• Login sessions: 30 days, or immediately on logout.
• Backups: up to 30 days on a rolling basis, for disaster recovery — see Section 12 for exactly what this means for deletion requests.
• Billing/tax records: retained for the period required by applicable tax law (in Sweden, generally 7 years) even after account deletion, for that data specifically.
• Server logs: a rolling, limited window, kept only as long as useful for security and debugging.

7. Who we share it with

We use a limited number of specialist companies ("subprocessors") to run the service. We don't sell your data to anyone, ever. The table below reflects what is actually configured and running today, verified directly against our production configuration — not a generic list.

7.1 Currently active, for every customer

7.2 Active only if you use a specific feature

7.3 Planned, not yet active

PLANNED Openprovider — for customers who purchase a website through Vilura and want us to register a domain on their behalf. This is built into our roadmap but not yet live. When it launches: domain registration requires submitting the registrant's name, address, and contact details to the domain registry, which are published in the public WHOIS record unless WHOIS privacy protection is available and selected. Before any purchase that includes domain registration, you will be told this explicitly and asked to confirm before payment — this is not something that will happen without your prior, informed agreement. We will offer WHOIS privacy protection by default wherever our registrar supports it for the relevant domain extension.

7.4 Built but not currently in use

Our platform is designed to route between multiple AI model providers for reliability. OpenAI, Google's Gemini models, and ElevenLabs are integrated in our codebase but have no active API credentials configured at the time of writing — they process no customer data today. If we activate any of them, we will update this table first.

8. International transfers

Several of the subprocessors above are based in, or transfer data to, the United States — outside the European Economic Area and the UK. Where that happens, we rely on the relevant provider's Standard Contractual Clauses (SCCs) or an equivalent, recognized transfer mechanism as their safeguard. [LAWYER REVIEW — see the note at the end of this document: each subprocessor's actual, current SCC/DPA status should be verified and referenced by name here, not asserted generically.]

9. Your rights (GDPR / UK GDPR)

If you are in the EEA or UK, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten") — see Section 12 for how, and its one honest limitation.
• Restrict or object to certain processing.
• Port your data to another service in a structured, machine-readable format — see Section 12.
• Withdraw consent at any time, where we rely on consent.
• Complain to your national data protection authority. In Sweden, that's the Integritetsskyddsmyndigheten (IMY). UK residents may contact the ICO.

To exercise any of these, use the self-service tools in your account (Section 12) or contact us (Section 17). We will respond within one month, as required by law.

10. California residents (CCPA/CPRA)

If you are a California resident, you additionally have the right to:

• Know what personal information we collect, use, and disclose (Section 3–7 above answer this directly).
• Delete your personal information (Section 12).
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information — moot here, since we do not sell or share personal information for cross-context behavioral advertising.
• Non-discrimination for exercising any of these rights.

11. Other jurisdictions

Vilura serves customers globally. This policy is written to meet GDPR, UK GDPR, and CCPA/CPRA as a baseline. If you are in a jurisdiction with its own data protection law not listed above (for example Brazil's LGPD, Canada's PIPEDA, or similar laws in other countries), those laws may give you additional or different rights; we intend to honor requests made under them on a good-faith basis even before this policy is formally updated to name them. See the closing note at the end of this document for jurisdictions that may need dedicated legal review before we actively market there.

12. Deletion and export

From your account settings, you can:

• Export your data — download everything associated with your account as structured data, at any time, instantly.
• Delete your account — permanently erases your account, your users and login sessions, your connected-integration credentials, and all of your stored data (conversations, CRM records, sales, receptionist configuration, files) from our live systems, immediately.

13. Security

• All traffic to and from Vilura is encrypted in transit (TLS).
• Passwords are hashed, never stored in plain text.
• Connected third-party credentials (e.g. an SMS or social media account you link) are encrypted at rest.
• Each business customer's data is stored in an isolated data store, separate from every other customer's.
• Access to production systems is limited to what's needed to operate the service.

No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify affected customers and the relevant supervisory authority as required by applicable law.

14. Cookies

We use exactly one cookie: a session cookie that keeps you logged in. It is strictly necessary for the service to function and is not used for tracking, advertising, or analytics. We do not currently run any third-party analytics or advertising scripts on vilura.se.

15. Children's privacy

Vilura is a business and professional tool and is not directed at, or intended for use by, children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

16. Changes to this policy

We'll update the effective date at the top of this page whenever we make a material change, and for significant changes we'll make a reasonable effort to notify active customers directly (e.g. by email) before the change takes effect.

17. Contact us

For any question about this policy or your data, or to exercise a right described above: kontakt@vilura.se.

[Confirm whether a dedicated privacy@ or dpo@ address should be added here instead of, or alongside, the general contact address.]