VBO HQVirtual Back Office
Headquarters

Privacy Policy

Effective date: September 30, 2026

This Privacy Policy explains how VBO HQ, a member of the ARV family of companies (“VBO HQ”, “we”, “us” or “our”), collects, uses, shares and protects personal information when you visit vbohq.net, request access, or use the VBO HQ platform at app.vbohq.net (together, the “Service”). Terms defined in our Terms of Service have the same meaning here.

The short version:

  • We collect what we need to run your account and the Service, and nothing more.
  • Your business owns its data. We process it on your behalf and only to provide the Service.
  • We do not use Customer Data to train AI models.
  • We do not sell personal information, and we do not share it for cross-context behavioural advertising.

1. Our two roles

As a controller. For information about the people who visit our website, request access, hold accounts, or buy a subscription, we decide how the information is used, and this Policy applies in full.

As a processor or service provider. Customer Data (the documents, records, contacts, messages, media and other content a business puts into or connects to the Service) belongs to that business. We process it on the business's behalf and under its instructions, as set out in the Terms of Service. If your information is held in a VBO HQ customer's account, that customer's own privacy notice governs it, and requests about it should go to that customer first. We will help our customers respond.

2. Information we collect

Access requests. When you request access on vbohq.net, we collect your name, work email, company, the number of companies you own (if you tell us), the plan you are considering, the areas you are interested in, and any message you send.

Account information. When your account is created, we collect your name, email address, company, organisation, role, and your sign-in and security settings.

Billing information. Payments are processed by Stripe. Stripe collects your card or bank details directly; we do not receive or store full card numbers. We keep a record of your plan, invoices, payment status, billing contact and billing address.

Customer Data. The content you and your users upload, create or connect, including data synced from the third-party applications you connect. We process it as described in Section 1.

Usage and log data. When you use the Service, our servers record technical information such as IP address, browser and device type, pages and features used, timestamps, errors, and security events. We also meter AI usage (such as agent actions, requests from connected AI, and the credits each action uses) so we can bill accurately, enforce fair-use limits, and show you what your team has spent.

Communications. When you email us or contact support, we keep the correspondence and the details you provide.

3. How we use information

  • To review access requests and to set up, operate and support your account and organisation.
  • To provide the Service, including planning, the knowledge bank, search, Ask, agents, Content Studio, campaigns and integrations you choose to use.
  • To process payments, meter credits and usage, and prevent billing abuse.
  • To secure the Service, detect and prevent fraud and misuse, and keep an audit history.
  • To send service messages, such as sign-in links, approvals, receipts, security alerts and notices of changes.
  • To understand how the Service is used and improve it, using aggregated and de-identified statistics that do not identify you or any individual.
  • To comply with the law, enforce our Terms, and establish or defend legal claims.

We do not use Customer Data to train AI models, whether ours or anyone else's. We send Customer Data to our AI providers only to perform the task you or your team asked for.

4. How we share information

We share personal information only as described here:

  • Service providers (subprocessors) that help us run the Service, under contracts that limit their use of it to providing services to us: Anthropic (Claude), for AI processing; Voyage AI, for search embeddings; DigitalOcean, for hosting in the United States; Resend, for transactional email; and Stripe, for payments.
  • Applications you connect. When you connect an integration, social account, messaging provider or your own AI assistant, we exchange data with it as you direct. Its use of that data is governed by your agreement with its provider.
  • Within your organisation. Information in your organisation is visible to its users according to the roles your organisation assigns, including any advisor you invite.
  • Legal and safety. When we believe in good faith that disclosure is required by law, court order or legal process, or is necessary to protect the rights, property or safety of VBO HQ, our customers or others.
  • Business transfers. In connection with a merger, acquisition, financing, reorganisation or sale of assets, subject to this Policy.

We do not sell personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.

5. Cookies

The platform at app.vbohq.net uses one strictly necessary cookie, vbo_session, to keep you signed in securely. The Service does not work without it, so it cannot be switched off. The marketing site at vbohq.net does not use advertising or cross-site tracking cookies.

6. Retention

  • Access requests are kept for as long as needed to review them and follow up, and are deleted when no longer needed.
  • Account information is kept while your account is active and afterwards for as long as needed for the purposes below.
  • Billing records are kept for as long as tax and accounting law requires.
  • Customer Data is kept while your account is active. After termination it is available for export for 30 days and then deleted, except where the law requires us to keep it. Copies held in backups are deleted as those backups expire.
  • Usage and log data is kept for as long as needed for security, billing, dispute resolution and operation of the Service.

We may keep information longer where needed to comply with the law, resolve disputes or enforce our agreements.

7. Security

We protect information with measures that include encryption in transit (TLS), role-based access controls, hashed session and API tokens, and an audit history of changes. No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorisation. If a breach affects your personal information, we will notify you and the authorities as the law requires.

8. International transfers

The Service is hosted in the United States, and our providers may process information in the United States and other countries. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States, where data protection laws may differ from those in your country. Where the law requires it, we put appropriate safeguards in place for these transfers.

9. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, and receive a portable copy of it. You can update most account information in the Service, and you can make any request by writing to admin@vbohq.net. We will verify your identity before acting on a request, and we will not discriminate against you for exercising your rights. If your information is held in a customer's account, we will refer your request to that customer.

California residents. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, you have the right to know the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. The categories we collect are identifiers and contact details, commercial information (plan and billing history), internet and network activity (usage and log data), and professional information (company and role), from the sources and for the purposes described above. You may use an authorised agent to make a request on your behalf.

EU and UK residents. Where the GDPR or UK GDPR applies, we process personal information as a controller on these legal bases: to perform our contract with you or your business; for our legitimate interests in operating, securing and improving the Service and responding to access requests; to comply with legal obligations; and with your consent where we ask for it, which you may withdraw at any time. In addition to the rights above, you may object to or ask us to restrict processing, and you may lodge a complaint with your local data protection authority.

10. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy on this page with a new effective date and, for material changes, notify account owners by email or in the Service before the changes take effect.

12. Contact

Questions and requests about privacy go to admin@vbohq.net.