Last Updated: August 17, 2026
Virstack LLC (“Virstack,” “we,” “us,” or “our”) respects your privacy and is committed to protecting personal information.
This Privacy Policy explains how we collect, use, process, disclose, retain, and protect personal information when you visit Virstack.ai, contact us, request a demonstration, create or administer an account, or use Virstack’s AI voice agents, AI text agents, software, APIs, dashboards, integrations, and related products and services (collectively, the “Services”).
This Privacy Policy also explains how Virstack processes personal information on behalf of its business customers and describes certain privacy rights that may be available under applicable law.
1. Scope of This Privacy Policy
This Privacy Policy applies to personal informationVirstack collects or processes:
Our business customers may provide, upload, connect, orotherwise make available their own contact databases, CRM records, lead lists,customer records, prospect information, or other information for processingthrough the Services.
When Virstack processes such information on behalf of acustomer, Virstack generally acts as a service provider or processor under thecustomer’s instructions, as described in Section 3 below.
2. Information We Collect and Process
The information Virstack collects or processes dependson how you interact with us and which Services are being used.
2.1 Information You Provide Directly to Virstack
We may collect information that you provide directly tous, including:
2.2 Customer Data Processed Through the Services
Our customers may provide or connect information to theServices so that Virstack can operate AI voice, AI text, and relatedcommunication services on their behalf.
This information (“Customer Data”) may include:
The specific information processed depends on thecustomer’s use and configuration of the Services.
2.3 Information Collected Automatically
When you visit our website or use our Services, we may automatically collect certain technical and usage information, including:
2.4 Cookies and Similar Technologies
We may use cookies, web beacons, pixels, local storage,analytics technologies, and similar tools to:
You may be able to manage certain cookies through yourbrowser settings or through privacy controls made available on our website.
3. Customer Data and Information Processed on Behalf of Customers
Virstack provides AI voice, AI text, and relatedcommunications platforms to businesses and organizations.Our customers may provide or connect their own contactdatabases, CRM systems, customer records, prospect records, lead lists, patientrecords, or other information to the Services so that Virstack’s AI agents canperform communications and related services on behalf of those customers.
3.1 Virstack Acts on the Customer’s Instructions
When processing Customer Data through the Services, Virstackacts on behalf of and under the instructions of the applicable customer.
The customer generally determines:
Virstack does not independently select the individuals contained in a customer’s contact database and does not independently determine whom the customer contacts using the Services.
3.2 Limited Use of Customer Data
Virstack processes Customer Data only as reasonablynecessary to provide, operate, maintain, secure, support, and deliver the Services requested by the applicable customer.
This may include:
Virstack does not use Customer Data or the contact information contained in a customer’s database for Virstack’s own lead generation, direct marketing, advertising, solicitation, or other independent commercial purposes.
Virstack does not independently call, text, email, advertise to, market to, or solicit a customer’s customers, prospects, leads, patients, employees, or other contacts for Virstack’s own purposes.Virstack does not use a customer’s contact database to create or maintain an independent marketing or prospect database for Virstack.
Virstack does not sell Customer Data.
3.3 Customer Analytics and Reporting
Virstack may process Customer Data to generate reports, dashboards, summaries, statistics, and analytics requested by or provided to the applicable customer.
Such analytics may include information relating to:
These reports and analytics are generated for purposes of providing and supporting the Services for the applicable customer.
Virstack does not use Customer Data analytics to independently market to or solicit the individuals contained in a customer’s database.
3.4 Customer Responsibility for Customer Data
The applicable customer is responsible for determiningthe purposes and lawful basis for collecting and using Customer Data.
Customers are responsible for:
Additional requirements regarding Customer Data,calling, texting, consent, and communications compliance are described inVirstack’s Terms of Service and applicable customer agreements.
3.5 Privacy Requests Relating to Customer Data
Where Virstack processes personal information solely on behalf of one of our customers, the applicable customer generally controls that information and is responsible for responding to privacy requests concerning that information.
If you believe Virstack is processing your information on behalf of one of our customers, you should ordinarily submit your privacy request to the organization with which you have the relevant relationship.
If Virstack receives a privacy request concerning Customer Data, we may:
as required by applicable law and our contractual obligations.
When Virstack processes information for its own business purposes, such as information concerning visitors to Virstack.ai, prospective Virstack customers, customer account administrators, or persons communicating directly with Virstack, Virstack may act as the applicable business or data controller.
4. How We Use Personal Information
How Virstack uses personal information depends onwhether the information is collected for Virstack’s own business purposes orprocessed on behalf of a customer.
4.1 Information Virstack Collects for Its Own Business Purposes
We may use information relating to website visitors,prospective customers, customer representatives, account administrators, andpersons who communicate directly with Virstack to:
4.2 Customer Data
Customer Data is processed for the limited purposes described in Section 3, including operating AI voice and text agents, executing customer-configured workflows, providing customer-authorized integrations, supporting the Services, and generating reports and analytics for the applicable customer.
Virstack does not use Customer Data for Virstack’s own marketing, lead generation, solicitation, advertising, or independent commercial targeting of the individuals contained in a customer’s contact database.
5. Legal Bases for Processing
Where applicable privacy law requires a legal basis for processing, Virstack may rely on one or more of the following:
Contractual Necessity
We may process personal information where necessary to provide requested Services or perform our contractual obligations.
Legitimate Interests
We may process information where necessary for legitimate business interests such as operating and securing our Services, communicating with customers, preventing fraud, providing support, and managing our business, provided those interests are not overridden by applicable privacy rights.
Consent
We may process information based on consent where consent is an appropriate or required legal basis.
Where we rely on consent, consent may generally be withdrawn as permitted by applicable law. Withdrawal does not affect the lawfulness of processing conducted before consent was withdrawn.
Legal Obligations
We may process information where necessary to comply with applicable law, regulation, legal process, regulatory requirement, or other legal obligation.
Where Virstack acts solely as a processor or service provider on behalf of a customer, the applicable customer is generally responsible for establishing the legal basis for its collection and use of Customer Data.
6. How We Disclose Personal Information
Virstack may disclose personal information to thirdparties where reasonably necessary to operate our business and provide theServices.
6.1 Service Providers and Subprocessors
We may engage service providers or subprocessors thatprovide services such as:
Where these providers process Customer Data, suchprocessing is limited to purposes reasonably necessary to provide and supportthe applicable Services and is subject to applicable contractual and legalrequirements.
6.2 Customer-Directed Integrations
If a customer connects the Services to a CRM,scheduling platform, electronic health record system, database,telecommunications platform, or other third-party application, information maybe exchanged with that system as directed or authorized by the customer.
Use of those third-party systems may also be subject totheir own privacy policies and contractual terms.
6.3 Legal and Regulatory Disclosures
We may disclose personal information where wereasonably believe disclosure is necessary to:
6.4 Business Transactions
If Virstack is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.
7.AI Voice, Text Messaging, Call Recordings,Transcripts, and Analytics
Virstack operates AI voice, AI text, and related communications technology on behalf of its customers.
Customers may provide or connect their own Contact Data to the Services so that Virstack’s AI agents can communicate with individuals on the customer’s behalf and according to the customer’s instructions.
Depending on the customer’s configuration, the Services may process:
Virstack processes this information to provide theServices requested by the applicable customer and to provide that customer withreports, analytics, summaries, and other information relating to its use of theServices.
Virstack does not independently use the contactinformation within a customer’s database to call, text, email, advertise to,market to, or solicit those individuals for Virstack’s own purposes.
Customers control their contact databases, recipientselection, campaign purposes, scripts, prompts, workflows, communicationinstructions, and applicable consent practices.
8. Healthcare Information
Certain Virstack customers may use the Services in healthcare environments.
Where Virstack receives or processes protected health information (“PHI”) as a business associate under the Health Insurance Portability and Accountability Act (“HIPAA”), such processing will also be governed by an applicable Business Associate Agreement and HIPAA requirements.
Virstack processes PHI on behalf of the applicable healthcare customer and only as permitted by the applicable Business Associate Agreement, customer instructions, and applicable law.
This Privacy Policy does not replace or modify any Business Associate Agreement between Virstack and a healthcare customer.
9. Data Retention
Virstack retains personal information only for as long as reasonably necessary for the purposes for which it is processed, including to:
Retention periods may vary based on:
Customer Data may be retained or deleted according tothe applicable customer’s instructions and customer agreement, subject tolegal, security, backup, and technical requirements.
When personal information is no longer reasonablynecessary, Virstack may delete, anonymize, or de-identify it as permitted orrequired by applicable law.
10. Data Security
Virstack uses administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction.
Such safeguards may include access controls, authentication, encryption, system monitoring, security policies, infrastructure protections, and other measures appropriate to the nature of the information and Services.
However, no electronic transmission, storage system, telecommunications network, cloud environment, or information-security system can be guaranteed to be completely secure.
Customers are responsible for safeguarding their account credentials, appropriately managing authorized users, and configuring access to the Services.
11. International Data Transfers
Virstack is based in the United States.
Personal information may be processed or stored in the United States or other countries where Virstack or its authorized service providers operate.
Where applicable privacy law requires safeguards for international transfers of personal information, Virstack will use appropriate transfer mechanisms or safeguards as required by applicable law.
12. California Privacy Rights
If the California Consumer Privacy Act, as amended (“CCPA”), applies to Virstack’s processing of your personal information, California residents may have certain rights, subject to applicable exceptions.
These may include the right to:
California law may define certain disclosures for cross-context behavioral advertising as “sharing” even if no money is exchanged.
Virstack does not sell Customer Data provided by customers for processing through the Services.
Virstack also does not use Customer Data for cross-context behavioral advertising directed to the individuals contained in a customer’s contact database.
For personal information Virstack collects directly for its own business purposes, including through Virstack.ai, Virstack will provide any privacy notices, opt-out mechanisms, and other rights required by applicable California law.
Where legally required, Virstack will recognize applicable opt-out preference signals.
We may take reasonable steps to verify your identity before processing certain requests. Authorized agents may submit requests where permitted by applicable law.
Certain personal information processed by Virstack solely as a service provider on behalf of a customer may be subject to different requirements under the CCPA. In those circumstances, privacy requests should generally be directed to the applicable customer.
13. European Economic Area, United Kingdom, and Other Data ProtectionRights
Where the General Data Protection Regulation (“GDPR”),UK GDPR, or similar privacy laws apply, individuals may have rights including:
Right of Access
You may request information about personal informationprocessed about you and, where applicable, a copy of that information.
Right to Rectification
You may request correction of inaccurate or incomplete personal information.
Right to Erasure
You may request deletion of personal information undercircumstances provided by applicable law.
Right to Restriction
You may request restriction of certain processing.
Right to Object
You may object to certain processing, including certainprocessing based on legitimate interests or for direct marketing.
Right to Data Portability
Where applicable, you may request certain personal information in a structured, commonly used, machine-readable format or request that it be transferred to another controller.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent as permitted by applicable law.
Right to Lodge a Complaint
You may have the right to lodge a complaint with an applicable data-protection supervisory authority.
Privacy requests under applicable GDPR requirements are generally processed without charge, except where applicable law permits a reasonable fee or refusal for requests that are manifestly unfounded or excessive.
Where required by applicable law, Virstack will respond to requests without undue delay and generally within one month, subject to legally permitted extensions.
If Virstack processes your information solely on behalf of a customer, the applicable customer generally acts as the controller and should receive your privacy request. Virstack will assist the customer as required by applicable law and applicable contractual arrangements.
14. Other U.S. State Privacy Rights
Residents of certain U.S. states may have additionalprivacy rights under applicable state privacy laws.
Depending on the jurisdiction and circumstances, theserights may include:
Virstack will process applicable privacy requests in accordance with applicable law.
Where Virstack processes information solely on behalf of a customer, requests concerning that information should generally be submitted to the applicable customer.
15. Marketing Communications
Virstack may send business or marketing communications to prospective customers, customers, customer representatives, or other business contacts where permitted by applicable law.
You may opt out of marketing emails by using an unsubscribe mechanism included in the communication or by contacting us.
Opting out of marketing communications does not prevent Virstack from sending non-promotional communications relating to:
This Section relates to Virstack’s own business and marketing communications.
It does not authorize Virstack to use Customer Data or contacts contained in a customer’s database for Virstack’s own marketing purposes.
16. Children’s Privacy
The Virstack.ai website and account-registration process are not directed to children under 13, and Virstack does not knowingly solicit personal information directly from children under 13 through the public website.
Virstack customers may use the Services in contexts involving minors, including healthcare or other services.
Where Virstack processes information concerning minors on behalf of a customer, Virstack does so under the customer’s instructions and subject to applicable contractual and legal requirements.
The applicable customer is responsible for determining and obtaining any parental consent, authorization, notice, or other legal basis required for its collection and use of such information.
17. Third-Party Websites and Services
Our website and Services may contain links to or integrate with websites, applications, telecommunications providers, platforms, and other services operated by third parties.
Virstack is not responsible for the independent privacy practices of third parties where those parties process information for their own purposes.
We encourage you to review applicable third-party privacy notices before providing personal information directly to those third parties.
18. Changes to This Privacy Policy
Virstack may update this Privacy Policy from time totime to reflect changes in:
When we update this Privacy Policy, we will revise the “Last Updated” date at the top of the policy.
Where required by applicable law, we will provide additional notice of material changes.
19. Contact Us and Exercise Your Privacy Rights
If you have questions about this Privacy Policy orwould like to exercise an applicable privacy right, please contact:
Virstack LLC
2102 Business Center Dr
Irvine, CA 92612
USA
Email: info@virstack.com
Phone: 1-800-314-6696
We may request information reasonably necessary to verify your identity or authority before fulfilling certain privacy requests.
If your request concerns information that Virstack processes solely on behalf of one of our customers, we may direct you to the applicable customer, forward the request to that customer, or assist that customer in responding, as appropriate.
Powered By Virstack
