Virmaline is operated by Wani Consulting OÜ, a private limited company registered in Estonia under registry code 16542861, with its registered address at Pärnu mnt 29, 10119 Tallinn, Estonia. You can reach us at info@virmaline.xyz.

This policy covers the website virmaline.xyz, the application at app.virmaline.xyz and the emails we send you about your account. For your account data we are the data controller. For data about prospects that the service researches at your request, your business is the controller and we act as its processor under these terms and, on request, a separate data processing agreement.

• Account data: your work email, your company name and a salted hash of your password. We never store the password itself.
• Workspace content: the company profile, brand messaging, ideal-customer profiles, product descriptions and lead searches you create or that our assistant drafts with you; documents you upload are stored as extracted text only.
• Mailbox connections: if you connect a mailbox for outreach, the SMTP or IMAP credentials or the Google token you grant, encrypted at rest; the emails sent from that mailbox through the service and the replies to them.
• Usage data: a ledger of AI tokens consumed per step, which drives usage limits and billing; application logs with timestamps, your IP address and the actions performed.
• Security data: the Cloudflare Turnstile result at sign-up and short-lived rate-limit counters keyed by IP address and email (deleted after one hour).

The service finds and researches companies that match the targeting you define, and then identifies business contacts at those companies. This data comes from public sources: official business registers (currently the Estonian and Finnish registers), company websites, press and other public web pages found through web search.

• Company data: name, registry code, address, size, financial figures published in registers, website content and news.
• Business contacts: name, role, business email address, public professional profile URL and the public facts that make them relevant to your outreach.
• Derived data: AI-written research summaries, a fit score against your ideal-customer profile and draft emails, all of which you review before anything is sent.
• Replies: if a prospect answers an email sent through a connected mailbox, the reply is stored in your inbox inside the service.

You decide whom to contact and you are responsible for having a lawful basis to do so (see our Terms of Service). We process this data only to provide the service to you and we never sell it or share it between customers. Public web pages fetched during research are cached for up to 14 days in a shared cache that holds only the page content and its URL, with no link to any customer or prospect record.

If you are a prospect and want to know what a customer of ours holds about you, or want it corrected or deleted, write to info@virmaline.xyz. We will act on it ourselves where we can and forward it to the customer concerned where they are the controller.

We do not use your workspace content, your prospects' data or your emails to train AI models, and we do not profile you for advertising.

Research, scoring and drafting are performed by large language models. Anthropic Claude models run through Amazon Bedrock in AWS Stockholm (eu-north-1); some research steps run on open-weight models we host ourselves on short-lived AWS GPU servers in Frankfurt (eu-central-1) that are started for a lead search and terminated afterwards. Under the Bedrock terms, Anthropic does not receive or retain the prompts, and AWS does not use them to train models.

Model output is a draft. It can be wrong, and the service is built so that you check it before it reaches a prospect.

We share data only with providers that process it for us under a contract, and with authorities when the law requires it. Our current providers are:

Customer databases, knowledge files and AI processing stay in the European Union. Where a provider is headquartered outside the EU, transfers rely on the European Commission's standard contractual clauses or an adequacy decision. We will update this list before adding a provider that handles customer content; write to info@virmaline.xyz if you want to be notified.

If you choose to connect a Google account as a sending mailbox, the service receives a token to send email on your behalf and, if you enable inbox access, to read replies and mark them as read. Virmaline's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: that data is used only to provide the mailbox features you enabled, is never used for advertising, and is never transferred to third parties except as needed to provide those features, to comply with the law or as part of a merger or acquisition with notice to you. You can revoke access at any time in your Google account settings or by removing the mailbox in the service.

• Account data and workspace content: for as long as your workspace exists, then deleted within 30 days of closure. Backups are rotated out within a further 30 days.
• Prospect data in your workspace: until you delete the lead, the lead search or the workspace.
• Sign-up verification links: 24 hours. Unverified sign-ups are deleted once the link expires.
• Rate-limit counters: 1 hour. Web-search result cache: 7 days. Public page cache: 14 days.
• Application logs: up to 90 days.
• Invoices and accounting records: 7 years, as Estonian accounting law requires.

All traffic is encrypted in transit. Each customer has its own database and knowledge store, so one workspace can never read another. Passwords are hashed with scrypt; mailbox credentials and tokens are encrypted at rest. Access to production systems is limited to the people who operate the service. No system is perfectly secure; if a breach affects your data we will notify you and, where required, the supervisory authority without undue delay.

Under the GDPR you can ask for access to your personal data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to info@virmaline.xyz; we answer within one month. You can also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the supervisory authority where you live.

We use only strictly necessary cookies and browser storage: the session token that keeps you signed in to the application, and the cookie Cloudflare Turnstile sets to tell people from bots on the sign-up form. Visits to the marketing website are counted with Vercel Web Analytics, which records the page, referrer, country and device class without cookies or any identifier that follows you across sites, and page-load performance is measured with Vercel Speed Insights on the same cookieless basis. There are no advertising or cross-site tracking cookies, so no cookie banner is needed.

The service is for businesses and the people acting for them. It is not directed at anyone under 18 and we do not knowingly collect their data.

We may update this policy as the service changes. The date at the top tells you when it last changed, and we will email workspace owners about material changes before they take effect. Questions go to info@virmaline.xyz or by post to Wani Consulting OÜ, Pärnu mnt 29, 10119 Tallinn, Estonia.