Privacy Policy

1

Scope and who this policy covers

This Privacy Policy applies to personal data handled by Virbula through:

• the public Virbula website at www.virbula.com, including demo, sales, contact, documentation, and support pages;
• the Virbula Oncall server and web application when hosted by Virbula under a customer agreement;
• the Virbula Oncall mobile app for iOS and Android;
• Virbula support, security, account administration, and service communications; and
• self-hosted deployments only to the extent information is sent to Virbula, such as through support requests or mobile notification infrastructure.

This policy does not replace a customer organization’s own privacy notice, employment policies, contractual terms, data processing agreement, or notices supplied by third-party integrations. Where a customer organization controls an Oncall deployment, its instructions and privacy notice govern how it uses personal data in that deployment.

2

When Virbula is a controller and when it is a processor

Privacy laws assign different responsibilities depending on who decides why and how personal data is processed. The role depends on the context.

A customer may have privacy obligations to its employees, contractors, customers, and other individuals. Questions about data controlled by a customer should normally be directed to that customer first.

3

Categories of data we handle

The data involved depends on which Virbula services are used, how a customer configures its deployment, and which integrations and notification channels it enables.

Alert details, integration payloads, support descriptions, and other free-form fields can contain information chosen by a customer or user. Virbula does not require customers to place sensitive personal data in those fields.

Data the public website does not currently collect

The public website does not currently collect payment card numbers, use advertising cookies, or use third-party behavioral advertising trackers. Do not submit payment card data, passwords, private keys, authentication tokens, or regulated personal data through website forms.

4

Where data comes from

• Directly from individuals, including website visitors, administrators, responders, and support requesters.
• From customer organizations, including administrators, identity systems, user directories, imported configuration, and authorized account records.
• From customer-configured integrations, such as monitoring systems, email, webhooks, APIs, collaboration tools, and telephony or messaging channels.
• From devices and software, including browsers, the mobile app, server logs, mobile operating systems, and notification delivery services.
• From service providers, such as hosting, communications, security, and support vendors that report delivery, health, or abuse information.

5

How we use personal data

Virbula uses personal data, as applicable, to:

• provide, host, maintain, and secure Virbula services;
• authenticate users and enforce customer-defined access controls;
• create, route, display, escalate, acknowledge, close, and audit alerts;
• deliver customer-configured email, SMS, voice, mobile push, webhook, and collaboration notifications;
• register mobile devices, deliver push notifications, and synchronize alert actions;
• process demo, sales, contact, migration, and support requests;
• detect abuse, investigate incidents, prevent fraud, and enforce legal and contractual requirements;
• monitor reliability, troubleshoot failures, recover service, and improve product performance;
• communicate service, security, administrative, and contractual information;
• comply with law and respond to valid legal process; and
• create aggregated or de-identified information that cannot reasonably identify an individual.

A customer may optionally configure analytics in its own Oncall deployment. When enabled, those analytics are governed by the customer’s configuration, notice, legal basis, and agreement with the analytics provider. The public Virbula website does not currently enable third-party behavioral analytics.

6

Legal bases for processing

Where European Economic Area, United Kingdom, or similar law applies and Virbula acts as controller, we rely on one or more of the following legal bases:

• Contract, where processing is necessary to provide requested services or take steps requested before entering a contract.
• Legitimate interests, including securing and operating services, responding to business inquiries, preventing abuse, supporting customers, and improving reliability, balanced against individual rights.
• Consent, where required for a particular communication, device permission, or optional activity. Consent may be withdrawn without affecting earlier lawful processing.
• Legal obligation, where processing is necessary to comply with applicable law, accounting, security, or valid legal process.
• Protection of vital interests, only in exceptional circumstances recognized by law.

When Virbula acts as processor, the customer determines the legal basis and Virbula processes personal data under the customer’s documented instructions, subject to applicable law.

7

When data is disclosed

We may disclose personal data only as reasonably necessary to:

• The customer organization and authorized users that administer the relevant Oncall deployment or need information for incident response.
• Customer-configured recipients and integrations, when a customer directs Oncall to send an alert, webhook, message, email, SMS, voice call, or mobile notification.
• Service providers and subprocessors that support hosting, databases, content delivery, email, telephony, messaging, mobile push, security, support, and diagnostics, subject to appropriate obligations.
• Professional advisers and transaction parties, where necessary for legal, audit, insurance, financing, acquisition, reorganization, or sale activities and subject to confidentiality requirements where appropriate.
• Authorities or other parties, when required by law, valid legal process, or reasonably necessary to protect rights, safety, service integrity, or prevent abuse.

Third-party communications networks and integrations process data under their own terms and privacy practices. Customers decide which optional integrations and channels to enable.

No sale or behavioral advertising

Virbula does not sell personal data, share it for cross-context behavioral advertising, or use Oncall alert content to create advertising profiles. If these practices change, we will update this policy and provide any legally required choice before the change applies.

8

SMS, voice, and mobile-number privacy

When a user affirmatively enrolls a phone number as an SMS or voice contact method, the customer’s Oncall deployment uses the number to send operational alerts, verification messages, tests, status updates, and escalation communications selected by that customer and user. Message and call frequency varies with active alerts and configured escalation rules. Standard message and data rates may apply.

Virbula does not share mobile numbers, SMS opt-in data, or communications consent with third parties or affiliates for their marketing or promotional purposes. Mobile information is disclosed only to the customer organization, authorized users, and communications providers as necessary to deliver, secure, troubleshoot, or comply with law for the requested operational communications.

Communications providers and carriers may process and monitor message or call content and metadata to transmit communications, prevent spam and fraud, enforce network rules, and comply with law. Users can withdraw SMS consent by replying STOP and can request help by replying HELP. Voice consent can be withdrawn through the call’s opt-out flow when available, by removing the contact method, or by contacting the customer’s Oncall administrator. See the Operational SMS and voice notification terms for program details.

9

Virbula Oncall mobile app

The mobile app is a client for the Oncall server selected by the user or their organization. It does not create a separate consumer social profile.

Data stored on the device

The app stores the selected server URL, session credentials, authentication state, device registration identifiers, user preferences, pending alert actions, and a limited local notification history. Sensitive session and alert information is stored using platform secure-storage facilities where supported. Local data may remain until the user signs out, clears it, or removes the app, subject to operating-system behavior.

Push notifications and permissions

If the user grants notification permission and the customer’s server enables mobile notifications, the app and server process a push token, device registration, delivery state, and alert payload needed to deliver notifications. Push delivery uses mobile platform and notification infrastructure, which may process device identifiers, network information, and notification content. On iOS, users may separately control time-sensitive notification permission. On Android, users may control notification and related alert settings through the operating system.

The app does not request access to the user’s camera, precise location, contacts, photos, or microphone for its current functionality. It does not include advertising SDKs or use a device advertising identifier for tracking.

Signing out and device removal

Signing out attempts to revoke the device registration and push token from the selected Oncall server and clears local session and alert data. If the device is offline, revocation may remain pending until connectivity returns. A customer administrator can also disable a user or registered device at the server.

10

Customer and user responsibilities

Customers determine which users, contact methods, alert sources, notification channels, integrations, and retention settings they configure. Customers are responsible for:

• providing legally required notices and establishing a lawful basis for personal data they enter or connect;
• obtaining any consent required for automated calls, SMS, email, mobile notifications, recording, monitoring, or workforce administration;
• limiting alert and support content to information appropriate for the service and recipient;
• maintaining accurate users, schedules, rotations, contact methods, permissions, and escalation policies;
• protecting credentials, API keys, integration secrets, devices, and administrator accounts;
• reviewing third-party integration terms and configuring access according to least privilege; and
• responding to privacy requests for data under the customer’s control.

11

Retention, deletion, and account closure

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, to follow customer instructions, meet contractual commitments, maintain security, resolve disputes, and comply with law. Retention depends on the type of data, the customer’s configuration, operational need, sensitivity, legal requirements, and whether the data is in an active system, log, or backup.

• Website inquiries and support records are retained as needed to respond, maintain business records, prevent abuse, and resolve follow-up matters.
• Virbula Cloud customer content is retained according to the customer agreement, deployment settings, and documented instructions. Following termination or an authorized deletion request, content is deleted or rendered inaccessible subject to legal obligations and normal backup expiration.
• Self-hosted content is retained and deleted by the customer. Uninstalling software does not automatically delete the customer’s database, backups, logs, or third-party records.
• Mobile data may remain on a device until sign-out, local clearing, app removal, or operating-system cleanup. Server-side device records may be retained for security, audit, and delivery troubleshooting before deletion or de-identification.
• Security and audit records may be retained longer when reasonably necessary to investigate incidents, enforce agreements, or meet legal obligations.

Backup copies may persist for a limited period after deletion and are protected from ordinary use until overwritten or destroyed through the normal backup lifecycle.

12

Security, notification delivery, and service limitations

Virbula uses administrative, technical, and organizational safeguards designed to protect personal data in systems under our control. Depending on the deployment, these safeguards may include transport encryption, role-based access, authenticated sessions, protected secret storage, audit records, input validation, rate limits, backups, health checks, and restricted production access.

Public forms use a first-party browser verification check and rate limiting to reduce automated abuse. The verification does not load a third-party CAPTCHA, advertising, or tracking service.

No system, transmission method, mobile platform, communications carrier, or storage technology is completely secure or continuously available. Notifications can be delayed, filtered, duplicated, rejected, or unavailable because of customer configuration, provider failure, carrier behavior, device settings, network conditions, invalid contact information, or events outside Virbula’s control.

If you believe data or an account has been compromised, contact us promptly using the details in the Contact section and notify the relevant customer administrator.

13

International data transfers

Virbula, customers, and service providers may process data in countries other than where an individual lives. Privacy laws may differ between those countries. Where required, Virbula uses contractual or other recognized safeguards for restricted international transfers. Customers are responsible for selecting an appropriate deployment region and evaluating transfers created by their self-hosted infrastructure and configured integrations.

14

Privacy rights and choices

Depending on location and applicable law, individuals may have rights to request access, correction, deletion, restriction, portability, or objection; withdraw consent; or complain to a supervisory authority. Rights may be limited by legal exceptions, security needs, the rights of others, and Virbula’s role as controller or processor.

Requests involving customer-controlled data

If your account was provided by an employer or another organization, direct the request to that organization first. The organization controls the account and operational content. When Virbula acts as processor, we will assist the customer as required by contract and law but may not act on a request without the customer’s authorization.

Requests involving Virbula-controlled data

Submit a request through the Contact Us page. Describe the relationship, relevant service, and requested action. We may need to verify identity and authority before responding. Authorized agents must provide proof of authority, and we may verify the request directly with the individual.

Users can also manage certain data directly by changing contact methods and notification preferences, disabling permissions in device settings, signing out of the mobile app, or asking their administrator to disable or delete an account.

15

U.S. state privacy notices

Residents of California and other states with applicable comprehensive privacy laws may have rights to know or access personal information, obtain a portable copy, correct inaccuracies, request deletion, opt out of certain sale, sharing, targeted advertising, or profiling, limit certain uses of sensitive personal information, and receive non-discriminatory treatment for exercising rights.

The categories of personal information handled during the preceding 12 months are described in Categories of data we handle. The sources, purposes, disclosures, and retention criteria are described in the corresponding sections of this policy. Virbula does not sell personal information or share it for cross-context behavioral advertising and therefore does not currently provide a “Do Not Sell or Share” link. We do not use sensitive personal information to infer characteristics about individuals.

Where legally required, we recognize valid browser-based opt-out preference signals for practices covered by those signals. Because the public website does not currently engage in sale, sharing, or targeted advertising, such a signal does not change the current website experience.

To exercise a right, use the request process in Privacy rights and choices. We will not unlawfully discriminate against an individual for exercising a privacy right.

16

Children’s privacy

Virbula services are designed for organizations and authorized workforce users, not children. They are not directed to children under 13, and we do not knowingly collect personal data directly from children under 13. Customer organizations must not create accounts for children or submit children’s personal data unless they have established all legally required authority, notices, and protections and Virbula has expressly agreed in writing to that use.

If you believe a child has provided personal data to Virbula contrary to this policy, contact us so we can investigate and take appropriate action.

17

Changes to this policy

We may update this policy to reflect changes in law, products, security practices, service providers, or business operations. The updated policy will be posted at this URL with a revised “Last updated” date. If a change materially affects how we use personal data, we will provide additional notice when required by law or contract.

18

Contact Virbula about privacy

For privacy questions, rights requests, or security concerns:

Select “Other” on the Contact Us page and begin the subject with “Privacy Request.” For customer-controlled Oncall data, also contact the administrator of the organization that provided your account.