In a world where free means you are the product, Virtucom is the alternative. This page is the contract.
The largest platforms have paid billions in privacy fines since 2018, a widely used analytics product has been ruled unlawful in several European countries, and at least one major mailing-list service has admitted scanning its customers’ lists for its own purposes.
Most of the “free” tools your business runs on this week are funded by selling some combination of: who your customers are, what they look at, what they buy, and what their behavior predicts they’ll buy next.
When the regulators catch up, the platform pays the fine. When customers find out, your brand pays the trust cost. We’d rather not be in that pipeline.
Nine of them, from never selling customer data to never hiding a policy change behind a click-through. They are operating constraints we built the company under, and the formal version is further down this page. See the formal version of the nine commitments.
WordPress, your domain, your email accounts, your contact list, your content. All in standard formats. All portable. What “leave with everything” actually looks like.
Free email is funded by ad targeting. The contents of your inbox, who you write to, what you say, what you order, where you bank, are scanned and indexed to build advertiser profiles.
The mail we run for you is paid, business-grade service. You are the customer, not the inventory. Your inbox is yours.
Every Virtucom plan includes paid email accounts. The Assurance plan starts with one mailbox. Executive includes ten.
Independent business owners who built the customer relationship and would prefer to keep it instead of leasing it back from a platform that sells the audience to a competitor.
Hospitality and local services where guests trust you with personal information, and that trust shouldn’t leak through your vendor stack.
Professionals with duty-of-care obligations, lawyers, doctors, financial advisors, therapists, whose client information is privileged and the tools touching it should be too.
And privacy-conscious operators who’ve read the platform terms and don’t want their business to be a feature of someone else’s data product.
Only when you ask us to (a support ticket, a debugging session, an account review). Even then, the access is logged and limited to one named team member at a time. We do not browse client databases for analytics, ML training, or product research.
No. The AI capabilities inside our automation call vendor APIs configured with zero-retention and no-training flags. Your content is sent for inference, the response comes back, the request is not retained or used to improve any model.
WordPress is open-source software you already own. Your hosting account, domain, and email accounts can be ported to any provider. We maintain a written continuity plan that hands every client a migration package within 30 days of any wind-down.
We require a valid subpoena or court order. We notify you within 24 hours unless legally prohibited. We provide only the specific data named in the request, no fishing expeditions, no broad disclosures.
Yes, and CCPA, CAN-SPAM, and the Oregon Consumer Privacy Act. We provide standard data-processing addenda on request. Right-to-deletion requests are honored within 30 days.
Yes, on your own site, with your own consent banner. We won’t install them by default. If you choose to add advertising trackers, we’ll set them up correctly with cookie consent and IP anonymization where supported.
It can be the foundation. Talk to us about moving your business onto infrastructure built around it.
A social platform, more than ten billion dollars in privacy fines since 2018. An analytics product, ruled unlawful in five European countries. A social network, a nine-figure settlement for using security phone numbers in ad targeting. A carrier, a nine-figure class action over breached customer data sold downstream. A mailing-list service, repeated breach disclosures and admitted internal scanning of customer lists.
None of those companies set out to harm their customers. They set out to monetize attention, and the data became the asset. Once it’s the asset, it gets used in ways the original collector didn’t intend.
Every product, every contract, every infrastructure decision is checked against this list before it ships.
If you decide to leave Virtucom, for any reason or no reason, we hand you a complete migration package within 30 days:
Most clients don’t leave. The ones who do, leave with everything intact, and we’ll help the next provider get them set up.
You spent years building the customer relationship, trust, repeat business, word-of-mouth referrals. The platforms you are likely using to manage that relationship are simultaneously selling that audience to anyone willing to pay them.
Privacy-first infrastructure means: your customer list is yours alone, your behavioral data isn’t a product, and your ability to communicate with the people who chose your business doesn’t depend on a platform you don’t control.
Guests give you their names, addresses, payment information, dietary restrictions, travel patterns, family details. They give it to you, not to your booking platform, not to your review aggregator, not to your marketing automation vendor.
Most hospitality tech stacks fragment that information across half a dozen vendors. Each one has its own privacy policy, its own breach history, its own data-sharing agreements. By the time it reaches the third vendor in the chain, the original consent your guest gave is unrecognizable.
Virtucom infrastructure keeps guest information in one place, on systems you control.
If you’re a lawyer, doctor, therapist, financial advisor, or accountant, your client communications carry legal or regulatory privilege. The tools that handle those communications, email, document storage, scheduling, support, should meet the same standard.
Most consumer tools do not. Free email scans your inbox for ad targeting. Free scheduling shares your meeting data. Free file storage reports on how you use it. Each is legal, and each is a way the privilege itself could be weakened in an audit or in discovery.
Virtucom infrastructure starts from a paid, enterprise-grade base. Paid business email, a dedicated server, no third-party telemetry by default.
You’ve read the platform terms of service. You know what “perpetual royalty-free worldwide license” actually means. You know that “to improve our services” covers a lot of ground. You don’t want to be the kind of business owner who finds out, six years in, that everything you put on the platform is also what the platform is selling.
You’re our easiest customer. You already know what you want. We just have to prove we deliver it.
General questions: the contact form.
Security disclosures: the same form, marked “security”. We acknowledge within one business day and we do not publish a reporter’s details.
Virtucom collects only what a feature needs to function, and hard-deletes it on a short clock. We do not keep personal or identifiable data beyond the function it enables.
This is a deliberate design choice: being boring to hack. If we do not hold long-tail personal data, there is nothing to leak.
Only what a feature needs to do the job you asked for.
| Function | Data collected | Why |
|---|---|---|
| Intake form | Name, email, phone (optional), business name, your brief | To reply with a proposal |
| Assistant (Arias) | Conversation messages, account ID | To answer the question. Never sold, never pooled |
| Review replies (GuestNet) | Review platform handles, drafted replies | To reply to reviews |
| Social publishing (SocialBot) | Account credentials (encrypted), post content, schedule | To post on your behalf |
| Newsletter (Praeco) | Subscriber email and tags, with explicit consent | To send what the subscriber asked for |
| Site analytics | Anonymized session metrics, no cross-site tracking | To show you your own site’s performance |
Retention is short. Once the function is delivered, we delete.
| Surface | Draft | Submitted | Final artifact | Audit log |
|---|---|---|---|---|
| Intake form | 24 hours | 14 days | 14 days (the proposal) | 14 days rolling |
| Arias conversation | n/a | 30 days | n/a | 30 days |
| Newsletter subscriber | n/a | Until they unsubscribe | n/a | 90 days |
| SocialBot post archive | n/a | 90 days | n/a | 90 days |
| Server access logs | n/a | 30 days rolling | n/a | 30 days rolling |
Deletes are hard deletes, not hidden flags, and they cascade: uploaded files on disk and anything derived from them go too.
Precise location. Device fingerprinting. Behavioral profiling across products. Third-party tracking pixels. Ad-network identifiers. Any analytics service that holds your customer data outside our infrastructure.
On intake and form pages, nothing identifying is stored in the browser. Only structural choices (which options were picked), never a name, email, phone, business name or free-text answer. A page refresh resets the form. The server has what was submitted; the browser holds nothing.
Every product passes three security gates before it takes public traffic. Form submissions carry CSRF tokens, per-IP and per-email rate limits, file validation by content rather than extension, parameterized SQL and an audit log. Services talk to each other over signed calls. TLS everywhere, HSTS preloaded.
GDPR: the short-retention design means there is little to retain. Right to erasure happens automatically on the clock above.
CCPA: no sale, no sharing, no broker pipeline.
HIPAA: our products are not certified for protected health information. Please do not put it into our forms or services.
PCI: we do not touch card data. Payment runs through a certified processor; cards never reach our servers.
ADA: every browser-facing service we run is built to ADA-compliant standards.
Every account runs its own assistant with its own knowledge base. What we learn about how your business works is held for your account and walled off from every other one, so your pricing, your policies and your internal way of doing things are never the source of an answer given to somebody else Kept Separate By Design This is a structural separation, not a promise about good behavior. General reference material and your own business knowledge are held apart, and the wall between accounts is part of how the system is built. Customer answers → .