Effective Date: July 15, 2026 Last Updated: July 15, 2026
This Privacy Policy explains how Virtually4all ("Virtually4All," "we," "us," or "our") collects, uses, discloses, and protects personal information through the website and platform at https://virtually4all.com/ (the "Platform").
Note: This is a template drafted from the Platform's functionality. It must be reviewed by a qualified attorney before publication — particularly to confirm compliance with the privacy laws of every jurisdiction where you have Clients or VAs (e.g., US state privacy laws such as the CCPA/CPRA, and the Philippines' Data Privacy Act of 2012), and to fill in the bracketed placeholders.
1. Who This Policy Covers
This Policy applies to all users of the Platform: Admin/Agency staff, Clients (businesses), and VAs (independent contractors), worldwide. There is no public account creation — all accounts are created by the Agency and activated by invitation, so this Policy also covers the limited information we collect about a person before their account is activated (name and email, used to send the invite).
2. Information We Collect
2.1 Information you or the Agency provide
Category Examples Who it applies to Account & identity First name, last name, email address (used as username), country All users Profile details Skills, display name, contact details, and other profile fields you complete Clients, VAs Company details Company name, contact name, billing email, billing preferences Clients Work & contract data Contract terms, billing type, task assignments, project status Clients, VAs Time & schedule data Logged hours, timesheets, work schedules, day-off requests VAs (schedules also viewed by Clients, read-only) Billing data Bill rates (Client-facing), pay rates (VA-facing), invoices, payout records Role-restricted (see Section 5) Performance data Ratings and review comments left at the end of a contract Clients (author), VAs (subject), Agency Training data Course progress, quiz scores, certificates VAs, viewable in limited form by Clients and Agency Communications Messages, task notes, comments on timesheet approvals/rejections All users, scoped to relevant contracts
2.2 Information collected automatically
Usage data: pages visited, actions taken, timestamps, and similar log data generated as you use the Platform.
Device/technical data: IP address, browser type, operating system, and similar technical identifiers.
Cookies and similar technologies: used to keep you logged in and remember preferences. See Section 9.
We do not currently collect payment card numbers or bank account details directly through the Platform, as payment processing occurs outside the Platform at this stage (see Section 6 of the Terms and Conditions). If a payment processor (e.g., Stripe) is integrated in the future, this Policy will be updated to reflect what that processor collects on our behalf.
3. How We Use Information
We use personal information to:
Create and manage accounts, and authenticate logins;
Operate core Platform features: contracts, timesheets, approvals, scheduling, invoicing, payout record-keeping, tasks, training, and ratings;
Match VAs with Clients based on skills and profile completeness;
Send transactional communications: invite links, password reset links, notifications about approvals, day-off decisions, invoices, and similar account/service activity;
Maintain the security and integrity of the Platform, including detecting fraud or unauthorized access;
Comply with legal, tax, and accounting obligations related to contracts, invoicing, and payouts;
Improve the Platform (e.g., understanding usage patterns to fix bugs or improve features).
We do not sell personal information. We do not use personal information for third-party advertising.
4. Legal Bases for Processing (where applicable, e.g., for EEA/UK users)
Where applicable law requires a legal basis, we rely on:
Contract necessity — to provide the Platform and fulfill contracts between Clients, VAs, and the Agency;
Legitimate interests — to secure the Platform, prevent fraud, and improve our services;
Legal obligation — to meet tax, accounting, and record-keeping requirements;
Consent — where specifically requested (e.g., certain optional communications).
5. How Information Is Restricted Between Roles
The Platform is built around a strict role-based access model, enforced at the database level:
Clients never see VA pay rates or the Agency's margin. Clients see only the bill rate they are charged.
VAs never see Client bill rates or the Agency's margin. VAs see only their own pay rate.
Clients and VAs each see only data tied to their own contracts — they cannot view another Client's or VA's records.
Quiz answer keys for training courses are never exposed to VAs or Clients.
Only Agency administrators have full visibility across contracts, rates, and margin.
This separation is a core design principle of the Platform, not just a UI setting.
6. How We Share Information
We share personal information only as follows:
Between Clients and VAs, as scoped by role: e.g., a Client sees a VA's profile, skills, hours, and completed training (never pay rate); a VA sees their contract's Client name and assigned tasks (never bill rate).
Service providers: we use third-party infrastructure and software providers to operate the Platform, currently including [INSERT: Supabase (database/authentication hosting), email delivery provider, hosting provider — list actual vendors]. These providers process data on our behalf under appropriate confidentiality and data protection terms.
Legal and safety reasons: if required by law, legal process, or to protect the rights, property, or safety of Virtually4All, our users, or others.
Business transfers: if Virtually4All is involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction, subject to this Policy or a comparable one.
We do not share personal information with third parties for their own marketing purposes.
7. International Data Transfers
Virtually4all is registered at 7702 Farm to Market 1960 Rd STE 220, Humble, Texas 77346, and serves Clients based in the United States, with VAs located worldwide. This means personal information is likely transferred across borders — for example, stored on servers located outside a user's home country, or processed by staff or systems located outside the US. [The specific safeguards used for these transfers (e.g., standard contractual clauses, adequacy determinations) depend on your infrastructure vendors and should be confirmed with counsel and reflected here.]
8. Data Retention
We retain personal information for as long as the account is active, plus an additional period as needed to:
Comply with tax, accounting, and legal record-keeping obligations (contract, invoice, and payout records in particular are often subject to multi-year retention requirements under US and Philippine law);
Resolve disputes;
Enforce our agreements.
[Specific retention periods per data category — e.g., "invoices retained for X years" — should be set based on applicable tax/legal requirements and added here.] When no longer needed, information is securely deleted or anonymized.
9. Cookies
The Platform uses cookies and similar technologies to:
Keep you securely logged in (session/authentication cookies);
Remember basic preferences.
[If analytics or other non-essential cookies are added later, this section must be updated, and a cookie consent banner may be required for EEA/UK/certain US-state visitors.]
10. Your Rights
Depending on your location, you may have rights to:
Access the personal information we hold about you;
Correct inaccurate information (most profile fields are self-editable within the Platform);
Request deletion of your information, subject to our legal retention obligations (e.g., completed contract/invoice records);
Object to or restrict certain processing;
Request a copy of your data in a portable format.
To exercise these rights, contact us at [email protected]. Because accounts are created and managed by the Agency (not self-registered), some requests — such as account deletion — may need to be coordinated with your Agency administrator or Client/VA point of contact.
If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know, delete, and opt out of the sale/sharing of personal information (noting again that we do not sell personal information). [Confirm applicability and add a state-specific rights section if you have a meaningful volume of California — or other state — residents.]
11. Data Security
We use reasonable administrative, technical, and physical safeguards to protect personal information, including role-based access controls and database-level security rules (Row Level Security) that enforce who can see what data. No system is completely secure, and we cannot guarantee absolute security.
12. Children's Privacy
The Platform is not directed to individuals under 18, and we do not knowingly collect personal information from children. If we learn that we have collected information from someone under 18, we will take steps to delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. The "Last Updated" date at the top reflects the most recent revision.
14. Contact Us
For questions about this Privacy Policy or to exercise your privacy rights, contact:
Virtually4all 7702 Farm to Market 1960 Rd STE 220, Humble, Texas 77346 [email protected]