Privacy Policy

Virteche ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. By using our services, you agree to this policy.

We collect information you provide directly when you:

• Continue with email (full name, email address, contact number, password).
• Place an order or update billing details (address, payment method details).
• Contact support or submit a ticket.
• Upload identity verification documents.
• Send messages in request-for-quote threads, or search, on Virteche Global.

When you visit our websites or use the client portal, we also collect technical data automatically:

• IP address, retained in account session records and security event logs.
• Browser type, operating system, and device identifiers.
• Pages visited, referring URL, and session duration.
• Cookies and similar tracking technologies (see our Cookie Policy in settings).

Network and infrastructure data. If you use Virteche Cloud, we collect network flow metadata about the traffic entering and leaving the servers we provide to you. This is recorded at our network infrastructure rather than inside your server, and it is limited to:

• Source and destination IP addresses.
• Source and destination ports.
• Protocol (for example TCP, UDP, or ICMP).
• Byte counts and packet counts.
• Timestamps, including when a network flow started and ended.
• The server and IP address assignment to which the flow is attributed.

We do not capture, inspect, read, store, or reconstruct the contents of your communications. Network flow metadata records that a connection happened and how much data moved; it does not record what was sent. We do not perform deep packet inspection and we do not decrypt traffic. Because you hold full administrative access to your server, we have no visibility into the software, files, or data inside it.

We use this data only to operate, maintain, and secure our network, to detect and act on abuse such as spam, denial-of-service traffic, port scanning and amplification attacks, to protect our rights and property and the other users of the service, and to respond to abuse reports and valid legal process. We do not use it for advertising, marketing, or commercial profiling, and we do not sell it. Retention is described in Section 7, and the terms authorising it are in Terms of Service Section 7.

Firewall totals. If you switch on our firewall for a server, the equipment that enforces it counts the connection attempts it blocks — how many there were, how many distinct source addresses they came from, which ports and protocols they targeted, and which countries and networks they came from — and we show you those totals in your dashboard. The source addresses are used only briefly, on that equipment, to count distinct ones and to look up their country and network in IP databases kept there; they are not stored and are not shown to you or anyone else. You can switch the counting off for any server.

• Service delivery — provisioning VPS, processing payments, sending invoices and receipts.
• Account management — authentication, 2FA, identity verification, and support.
• Security — fraud prevention, abuse detection, network protection, and compliance with legal obligations.
• Communications — transactional emails, service notifications, and (with consent) marketing messages.
• Analytics — aggregate website and product usage statistics to improve our platform. We do not build individual commercial or behavioural profiles from this analytics data. This commitment covers analytics only; it does not limit the security and abuse-prevention uses of network and infrastructure data described in Sections 2 and 3, which are necessarily attributed to a specific account.

We process your personal data on the following legal bases:

• Contract performance — to deliver the services you ordered.
• Legal obligation — tax records, fraud prevention, regulatory requirements.
• Legitimate interests — securing our network, detecting and preventing abuse, and improving the platform.
• Consent — marketing communications, non-essential cookies, and the collection of network flow metadata authorised by our Terms of Service.

We use automated systems to protect our network. Where traffic from a server crosses an abuse or security threshold — for example an outbound denial-of-service flood, large-scale port scanning, or an amplification attack — our systems may automatically rate-limit, filter, or suspend the affected service to protect the network and its other users. Because this action protects other users from harm that is already in progress, it can take effect immediately and without prior review by a member of our staff. You can ask us to review it, as described below.

We do not send the contents of abuse reports, or data about the network traffic of your servers, to third-party artificial-intelligence providers. Where we use artificial intelligence elsewhere in our services, section 6 describes what is shared and with whom.

Automated triage does not by itself decide any lasting adverse action. A member of our staff reviews the matter before we take a lasting adverse action such as terminating an account. If your service is suspended or restricted and you believe the action was mistaken, you may appeal by contacting [email protected], and we will review the decision and tell you the outcome. Where the law gives you a right to obtain human review of an automated decision, to express your point of view, and to contest the decision, you may exercise those rights through the same address.

We do not sell your personal data. We share information only with:

• Payment processors (Stripe, PayPal) to process transactions. They are bound by their own privacy policies.
• Infrastructure providers — server and storage providers under data processing agreements.
• Artificial-intelligence providers (currently OpenAI and Zhipu AI, reached through an API gateway service that relays our requests to them) for features that use artificial intelligence: on Virteche Global, interpreting product and knowledge-base searches, drafting automatic replies in request-for-quote message threads, and preparing product listings; and, for all our services, preparing first drafts of our staff's replies to your support tickets, which a member of staff reviews before anything is sent. For these features we send only what the feature needs: the words you type into the search, or the request for quote, its messages and quote options, together with public product information, or, for a support ticket draft, the ticket's messages, your first name and the status of your orders and servers. We do not send your account details, payment information, or identity documents. These providers process the data to return a result to us; they may process it outside the country you are in. A reply drafted by artificial intelligence never commits us to a price, a delivery date, or any other term: those are confirmed only by our staff or in a quote you accept.
• Law enforcement — when required by valid legal process or to protect rights and safety.
• Upstream network and infrastructure providers — where an abuse report or security incident concerns traffic carried on their network, we may share the limited network flow metadata necessary to investigate and resolve it.

We retain your account data for as long as your account is active plus 5 years for legal and accounting purposes. Identity verification document files are deleted within 30 days after approval or final rejection, and within 7 days after a request is withdrawn or expires. We retain the verification decision and audit history without the document files. You may request earlier deletion where permitted by law.

Website analytics, collected only from visitors who allow it, are kept for 13 months and then reduced to monthly totals that identify no one. See the Cookie Policy.

Network flow metadata (see Section 2) is retained for 14 days and is then deleted. We may keep a particular flow record for longer where it forms part of an open abuse investigation, is needed to respond to a complaint or to legal process, or is subject to a preservation obligation.

Firewall totals (see Section 2) are kept for 30 days and then deleted. They contain counts only — no IP addresses.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion ("right to be forgotten") subject to legal retention requirements.
• Object to or restrict certain processing activities.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time (without affecting prior lawful processing).

These rights apply to personal data about you. Network flow metadata describes a connection between two parties, so a record about your service will also contain the IP address of the person or system at the other end, who is not our customer. Where we provide flow metadata in response to a request, we redact the IP addresses of those third parties. We may also decline to provide information where doing so would reveal personal data about another customer or about a third party, or would compromise an ongoing abuse or security investigation.

To exercise these rights, email [email protected] and we will respond within 30 days.

Subpoenas, court orders, preservation requests, and other legal process should be directed to [email protected], or by mail to Virteche, 228 Park Ave S, PMB 642218, New York, NY 10003-1502.

We review legal process for validity and scope before responding, and we disclose only what the process actually requires. Where a preservation obligation applies to records that would otherwise be deleted on our normal retention schedule, those records are placed on hold and retained until the obligation ends.

Separately, and as required by 18 U.S.C. § 2258A, we report apparent child sexual abuse material to the National Center for Missing & Exploited Children when we obtain actual knowledge of it, and preserve the related material as that section requires. We do not monitor, screen, or scan the contents of customer servers.

We implement industry-standard safeguards including TLS encryption in transit, bcrypt password hashing, access controls on logged data, and two-factor authentication for administrative accounts. No system is 100% secure; please use a strong, unique password and enable 2FA.

We use cookies for authentication sessions, preference storage, and aggregate analytics. You can manage your cookie preferences via the cookie consent banner or in your account settings. Essential cookies required for login cannot be disabled.

Our services are not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it promptly.

Your data may be processed in countries outside your own. Where such transfers occur, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for EU/EEA transfers) to protect your data to the same standard as this policy.

We may update this policy periodically. We will notify you of significant changes via email or a notice in the client portal. The "Last updated" date at the top of this page reflects the most recent revision.

For privacy-related questions or to exercise your rights, contact our Data Protection team at [email protected].