1. Scope of application
This document describes the rights that the General Data Protection Regulation (GDPR — EU Regulation 2016/679) grants to individuals located in the European Economic Area (EEA) regarding the processing of their personal data by VuraOs LLC.
Although VuraOs LLC is incorporated in Wyoming, USA, we commit to respecting the principles of the GDPR for all our users, regardless of their geographic location.
2. Data controller
VuraOs LLC
30 N Gould St, Ste R, Sheridan, WY 82801, USA
Privacy contact: privacy@vuraos.com
For B2B relationships and signed processing agreements: Data Processing Agreement (DPA)
3. Legal basis for processing
We process each category of personal data under the most appropriate legal basis according to the GDPR:
| Processing activity | Legal basis | GDPR Art. |
|---|---|---|
| Provision of the VURAOS platform services | Contract | 6.1.b |
| Billing and subscription management | Contract | 6.1.b |
| Technical support and customer service | Contract | 6.1.b |
| Product improvement and anonymized usage analytics | Legitimate interest | 6.1.f |
| Fraud prevention and platform security | Legitimate interest | 6.1.f |
| Marketing communications and product news | Consent | 6.1.a |
| Retention of accounting and tax records | Legal obligation | 6.1.c |
You can withdraw your consent for marketing communications at any time via the unsubscribe link in each email or by sending a message to privacy@vuraos.com.
4. Your rights under the GDPR
Right of access
You can request a copy of the personal data we hold about you and how we use it.
Right to rectification
You can request the correction of inaccurate data or the completion of incomplete data.
Right to erasure
You can request the deletion of your data when it is no longer necessary for the purposes for which it was collected.
Right to portability
You can receive your data in a structured, machine-readable format to transfer it to another provider.
Right to object
You can object to the processing of your data for direct marketing purposes or processing based on legitimate interest.
Right to restriction
You can request that we restrict the processing of your data while we resolve a dispute or verify its accuracy.
5. How to exercise your rights
To exercise any of these rights, send a request to privacy@vuraos.com with the subject "GDPR Request", stating:
- The right you want to exercise (access, erasure, portability, etc.)
- Your email address registered in VURAOS
- A brief description of your request
We respond to all requests within 30 business days of receipt. In more complex cases we may extend this period up to 90 days, notifying you accordingly.
6. Data retention
We retain your personal data only for the time necessary to fulfill the stated purposes. The following table summarizes the retention periods by category:
| Data category | Retention period | Reason |
|---|---|---|
| Account data (name, email) | Duration of the relationship + 90 days | Contract management |
| Billing and payment records | 7 years from the transaction | Tax / accounting obligation |
| Platform activity logs | 12 months | Security and auditing |
| Support conversations | 3 years from ticket closure | Service quality |
| Analytics data (anonymized) | 26 months (GA4 default) | Product improvement |
| Marketing consents | Until withdrawal + 3 years | Proof of consent |
When the contractual relationship ends, we delete or anonymize account data within 90 days of the request, unless we are required by law to retain it.
7. International data transfers
VuraOs LLC is based in the United States. By using our platform, data may be transferred and processed outside the EEA. We guarantee that these transfers are carried out with adequate safeguards:
- Standard Contractual Clauses (SCC) approved by the European Commission (Implementing Decision EU 2021/914).
- EU-US Data Privacy Framework (DPF) for providers certified under that framework.
- Transfer impact assessments (TIA) carried out for each relevant sub-processor.
You can view the full list of sub-processors and the safeguards applied in our Data Processing Agreement.
8. Sub-processors
To provide VURAOS services we work with the following main sub-processors, which may process personal data on your behalf:
| Provider | Service | Processing country |
|---|---|---|
| Supabase Inc. | Database, authentication, storage | US (AWS us-east-1) |
| Amazon Web Services | Cloud infrastructure (via Supabase) | US |
| Stripe Inc. | Payment processing | US / EEA |
| Google LLC | Analytics (anonymized data), Tag Manager | US |
| ElevenLabs Inc. | AI voice synthesis | US |
For the full list of sub-processors with detailed safeguards, see the full DPA. Enterprise Customers can request prior notification of changes to sub-processors.
9. Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the data protection authority of your country of residence, without prejudice to any other administrative or judicial remedy.
- Spain: Spanish Data Protection Agency (AEPD)
- European Union: the supervisory authority of your Member State of residence.
- Argentina: Agency for Access to Public Information (AAIP)
We encourage you to contact us first at privacy@vuraos.com so we can address any concern directly.
10. Data Processing Agreement (DPA)
If you use VURAOS in a business context and process personal data of your customers or employees through our platform, you can request the signing of a bilateral Data Processing Agreement (DPA).
The VURAOS DPA describes in detail the obligations of each party, the technical and organizational security measures, and the conditions for processing data on behalf of the controller. View full DPA →