Last Updated: August 17, 2026

Virstack LLC (“Virstack,” “we,” “us,” or “our”) respects your privacy and is committed to protecting personal information.

This Privacy Policy explains how we collect, use, process, disclose, retain, and protect personal information when you visit Virstack.ai, contact us, request a demonstration, create or administer an account, or use Virstack’s AI voice agents, AI text agents, software, APIs, dashboards, integrations, and related products and services (collectively, the “Services”).

This Privacy Policy also explains how Virstack processes personal information on behalf of its business customers and describes certain privacy rights that may be available under applicable law.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal informationVirstack collects or processes:‍

• Through Virstack.ai and related Virstackwebsites;
• When you contact us or request information or ademonstration;
• When you create or administer a Virstackaccount;
• When you communicate directly with Virstack;
• When you use the Services;
• When our customers use the Services tocommunicate with their customers, prospects, patients, employees, users, orother contacts; and
• through other business interactions withVirstack.

Our business customers may provide, upload, connect, orotherwise make available their own contact databases, CRM records, lead lists,customer records, prospect information, or other information for processingthrough the Services.

When Virstack processes such information on behalf of acustomer, Virstack generally acts as a service provider or processor under thecustomer’s instructions, as described in Section 3 below.

2. Information We Collect and Process

The information Virstack collects or processes dependson how you interact with us and which Services are being used.

2.1 Information You Provide Directly to Virstack 

We may collect information that you provide directly tous, including:

• name;
• company or organization name;
• job title;
• business address;
• email address;
• telephone number;
• account credentials;
• billing and transaction information;
• communications with Virstack;
• information submitted through website forms;
• information provided when requesting orparticipating in a demonstration;
• customer-support information; and
• other information you choose to provide.

2.2 Customer Data Processed Through the Services

Our customers may provide or connect information to theServices so that Virstack can operate AI voice, AI text, and relatedcommunication services on their behalf.

This information (“Customer Data”) may include:

• names;
• telephone numbers;
• email addresses;
• customer, prospect, lead, patient, or other contact records;
• CRM information;
• appointment or scheduling information;
• inbound and outbound call information;
• SMS or other message content;
• call and messaging metadata;
• call recordings, where enabled;
• call transcripts;
• AI agent conversations and responses;
• conversation summaries;
• call dispositions and outcomes;
• customer-provided scripts and prompts;
• knowledge-base information;
• information generated throughcustomer-authorized integrations;
• workflow and transaction information; and
• other information provided by or processed onbehalf of the applicable customer.

The specific information processed depends on thecustomer’s use and configuration of the Services.

2.3 Information Collected Automatically

When you visit our website or use our Services, we may automatically collect certain technical and usage information, including:

• Internet Protocol (IP) address;
• browser type;
• device type;
• operating system;
• referring and exit pages;
• dates and times of access;
• pages viewed;
• interactions with the website or Services;
• approximate location derived from IP address;
• device or browser identifiers;
• cookie and similar technology identifiers; and
• diagnostic, security, performance, and usage information.

2.4 Cookies and Similar Technologies

We may use cookies, web beacons, pixels, local storage,analytics technologies, and similar tools to:

• operate our website and Services;
• maintain security;
• remember preferences;
• understand website usage;
• improve website performance; and
• support marketing activities where permitted by applicable law.

You may be able to manage certain cookies through yourbrowser settings or through privacy controls made available on our website.

3. Customer Data and Information Processed on Behalf of Customers

Virstack provides AI voice, AI text, and relatedcommunications platforms to businesses and organizations.Our customers may provide or connect their own contactdatabases, CRM systems, customer records, prospect records, lead lists, patientrecords, or other information to the Services so that Virstack’s AI agents canperform communications and related services on behalf of those customers.

3.1 Virstack Acts on the Customer’s Instructions

When processing Customer Data through the Services, Virstackacts on behalf of and under the instructions of the applicable customer.

The customer generally determines:

• whose information is provided to Virstack;
• which individuals are contacted;
• why those individuals are contacted;
• whether calls, text messages, or other communications are initiated;
• the timing and frequency of communications;
• the scripts, prompts, knowledge sources, and workflows used by the AI agents;
• which integrations and features are enabled;
• how the AI agent responds or routes communications; and
• what reports, analytics, summaries, or other outputs are generated.

Virstack does not independently select the individuals contained in a customer’s contact database and does not independently determine whom the customer contacts using the Services.

3.2 Limited Use of Customer Data

Virstack processes Customer Data only as reasonablynecessary to provide, operate, maintain, secure, support, and deliver the Services requested by the applicable customer.

This may include:

• enabling AI voice agents to make or receive calls on behalf of the customer;
• enabling AI text agents to send, receive, or respond to messages on behalf of the customer;
• identifying or routing contacts as instructed by the customer;
• performing customer-configured workflows;
• providing lead qualification;
• providing customer service;
• scheduling or confirming appointments;
• performing follow-up communications;
• collecting information requested by the customer;
• integrating with customer-authorized CRM, scheduling, database, telephony, healthcare, or other systems;
• generating call summaries, transcripts, reports, usage information, dashboards, and analytics for the customer;
• providing technical support and troubleshooting;
• maintaining the security, availability, and integrity of the Services; and
• complying with applicable legal and contractual obligations.

Virstack does not use Customer Data or the contact information contained in a customer’s database for Virstack’s own lead generation, direct marketing, advertising, solicitation, or other independent commercial purposes.

Virstack does not independently call, text, email, advertise to, market to, or solicit a customer’s customers, prospects, leads, patients, employees, or other contacts for Virstack’s own purposes.Virstack does not use a customer’s contact database to create or maintain an independent marketing or prospect database for Virstack.

Virstack does not sell Customer Data.

3.3 Customer Analytics and Reporting

Virstack may process Customer Data to generate reports, dashboards, summaries, statistics, and analytics requested by or provided to the applicable customer.

Such analytics may include information relating to:

• call or message volume;
• call duration;
• outcomes and dispositions;
• appointment scheduling;
• lead qualification;
• response rates;
• customer interactions;
• usage of the Services;
• AI agent performance;
• workflow results; and
• other metrics requested by or made available to the applicable customer.

These reports and analytics are generated for purposes of providing and supporting the Services for the applicable customer.

Virstack does not use Customer Data analytics to independently market to or solicit the individuals contained in a customer’s database.

3.4 Customer Responsibility for Customer Data

The applicable customer is responsible for determiningthe purposes and lawful basis for collecting and using Customer Data.

Customers are responsible for:

• determining whether individuals may lawfully be contacted;
• providing required privacy notices;
• obtaining required permissions, authorizations, and consents;
• maintaining applicable consent records;
• complying with applicable calling and texting requirements;
• complying with do-not-call and opt-out requirements;
• determining whether calls may lawfully be recorded or transcribed; and
• complying with applicable privacy, telecommunications, consumer-protection, and industry-specific laws.

Additional requirements regarding Customer Data,calling, texting, consent, and communications compliance are described inVirstack’s Terms of Service and applicable customer agreements.

3.5 Privacy Requests Relating to Customer Data

Where Virstack processes personal information solely on behalf of one of our customers, the applicable customer generally controls that information and is responsible for responding to privacy requests concerning that information.

If you believe Virstack is processing your information on behalf of one of our customers, you should ordinarily submit your privacy request to the organization with which you have the relevant relationship.

If Virstack receives a privacy request concerning Customer Data, we may:

• refer the individual to the applicable customer;
• forward the request to the customer; or
• assist the customer in responding,

as required by applicable law and our contractual obligations.

When Virstack processes information for its own business purposes, such as information concerning visitors to Virstack.ai, prospective Virstack customers, customer account administrators, or persons communicating directly with Virstack, Virstack may act as the applicable business or data controller.

4. How We Use Personal Information

How Virstack uses personal information depends onwhether the information is collected for Virstack’s own business purposes orprocessed on behalf of a customer.

4.1 Information Virstack Collects for Its Own Business Purposes

We may use information relating to website visitors,prospective customers, customer representatives, account administrators, andpersons who communicate directly with Virstack to:

• provide, operate, maintain, and support our website and Services;
• respond to inquiries and demonstration requests;
• create and administer customer accounts;
• communicate with customers and prospective customers;
• provide customer support;
• process transactions and administer subscriptions;
• authenticate users and maintain account security;
• monitor performance and troubleshoot technical issues;
• detect, investigate, and prevent fraud, abuse, and security incidents;
• understand how our website and Services are used;
• develop and improve our website, products, features, and Services;
• send business, product, or marketing communications as permitted by applicable law;
• comply with applicable legal and regulatory requirements;
• establish, exercise, or defend legal claims; and
• protect the rights, safety, security, and property of Virstack, our customers, users, and others.

4.2 Customer Data

Customer Data is processed for the limited purposes described in Section 3, including operating AI voice and text agents, executing customer-configured workflows, providing customer-authorized integrations, supporting the Services, and generating reports and analytics for the applicable customer.

Virstack does not use Customer Data for Virstack’s own marketing, lead generation, solicitation, advertising, or independent commercial targeting of the individuals contained in a customer’s contact database.

5. Legal Bases for Processing

Where applicable privacy law requires a legal basis for processing, Virstack may rely on one or more of the following:

Contractual Necessity

We may process personal information where necessary to provide requested Services or perform our contractual obligations.

Legitimate Interests

We may process information where necessary for legitimate business interests such as operating and securing our Services, communicating with customers, preventing fraud, providing support, and managing our business, provided those interests are not overridden by applicable privacy rights.

Consent

We may process information based on consent where consent is an appropriate or required legal basis.

Where we rely on consent, consent may generally be withdrawn as permitted by applicable law. Withdrawal does not affect the lawfulness of processing conducted before consent was withdrawn.

Legal Obligations

We may process information where necessary to comply with applicable law, regulation, legal process, regulatory requirement, or other legal obligation.

Where Virstack acts solely as a processor or service provider on behalf of a customer, the applicable customer is generally responsible for establishing the legal basis for its collection and use of Customer Data.

6. How We Disclose Personal Information

Virstack may disclose personal information to thirdparties where reasonably necessary to operate our business and provide theServices.

6.1 Service Providers and Subprocessors

We may engage service providers or subprocessors thatprovide services such as:

• cloud infrastructure and hosting;
• telecommunications and telephone services;
• SMS and messaging;
• AI and machine-learning infrastructure;
• data storage and databases;
• CRM and business integrations;
• email and communications;
• cybersecurity;
• analytics;
• customer support;
• payment processing;
• accounting; and
• establish, exercise, or defend legal claims; and

Where these providers process Customer Data, suchprocessing is limited to purposes reasonably necessary to provide and supportthe applicable Services and is subject to applicable contractual and legalrequirements.

6.2 Customer-Directed Integrations

If a customer connects the Services to a CRM,scheduling platform, electronic health record system, database,telecommunications platform, or other third-party application, information maybe exchanged with that system as directed or authorized by the customer.

Use of those third-party systems may also be subject totheir own privacy policies and contractual terms.

6.3 Legal and Regulatory Disclosures

We may disclose personal information where wereasonably believe disclosure is necessary to:

• comply with applicable law or legal process;
• respond to subpoenas, court orders, warrants, or governmental requests;
• cooperate with regulatory or law-enforcement authorities;
• investigate suspected fraud, abuse, security incidents, or unlawful activity;
• protect the rights, property, or safety of Virstack or others; or
• establish, exercise, or defend legal claims.

6.4 Business Transactions

If Virstack is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.

7.AI Voice, Text Messaging, Call Recordings,Transcripts, and Analytics

Virstack operates AI voice, AI text, and related communications technology on behalf of its customers.

Customers may provide or connect their own Contact Data to the Services so that Virstack’s AI agents can communicate with individuals on the customer’s behalf and according to the customer’s instructions.

Depending on the customer’s configuration, the Services may process:

• inbound and outbound telephone calls;
• SMS or other text messages;
• call and messaging metadata;
• call recordings;
• transcripts;
• AI-generated responses;
• conversation summaries;
• disposition and outcome information;
• appointment and workflow information; and
• performance and usage analytics.

Virstack processes this information to provide theServices requested by the applicable customer and to provide that customer withreports, analytics, summaries, and other information relating to its use of theServices.

Virstack does not independently use the contactinformation within a customer’s database to call, text, email, advertise to,market to, or solicit those individuals for Virstack’s own purposes.

Customers control their contact databases, recipientselection, campaign purposes, scripts, prompts, workflows, communicationinstructions, and applicable consent practices.

8. Healthcare Information

Certain Virstack customers may use the Services in healthcare environments.

Where Virstack receives or processes protected health information (“PHI”) as a business associate under the Health Insurance Portability and Accountability Act (“HIPAA”), such processing will also be governed by an applicable Business Associate Agreement and HIPAA requirements.

Virstack processes PHI on behalf of the applicable healthcare customer and only as permitted by the applicable Business Associate Agreement, customer instructions, and applicable law.

This Privacy Policy does not replace or modify any Business Associate Agreement between Virstack and a healthcare customer.

9. Data Retention

Virstack retains personal information only for as long as reasonably necessary for the purposes for which it is processed, including to:

• provide and support the Services;
• maintain customer accounts;
• fulfill contractual obligations;
• comply with legal and regulatory requirements;
• maintain appropriate business and security records;
• investigate security incidents;
• resolve disputes; and
• enforce applicable agreements.

Retention periods may vary based on:

• the type of information;
• the applicable customer’s instructions;
• customer configuration;
• contractual requirements;
• applicable legal obligations;
• security requirements; and
• the purposes for which the information is processed.

Customer Data may be retained or deleted according tothe applicable customer’s instructions and customer agreement, subject tolegal, security, backup, and technical requirements.

When personal information is no longer reasonablynecessary, Virstack may delete, anonymize, or de-identify it as permitted orrequired by applicable law.

10. Data Security

Virstack uses administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction.

Such safeguards may include access controls, authentication, encryption, system monitoring, security policies, infrastructure protections, and other measures appropriate to the nature of the information and Services.

However, no electronic transmission, storage system, telecommunications network, cloud environment, or information-security system can be guaranteed to be completely secure.

Customers are responsible for safeguarding their account credentials, appropriately managing authorized users, and configuring access to the Services.