VIRBA
Sign inStart free

Privacy Policy

Operator: Haansal Estate Pty Ltd (an Australian company) · Effective date: October 2026 · Last updated: October 2026

1. Scope and Legal Entity

This Privacy Policy describes how Haansal Estate Pty Ltd, an Australian company operating VIRBA ("VIRBA", "we", "us", "our"), collects, uses, discloses, and protects personal information and connected account data when you visit our website at https://virba.ai or use our software and services. It applies to account holders, organization members, visitors, and business contacts.

2. Our Role and Customer Control

VIRBA provides software tools for real estate professionals, builders, and mortgage brokers. Business customers determine what business profiles, marketing drafts, brand assets, and channel connections they enter into VIRBA. As between VIRBA and the customer, the customer maintains ownership and control over their content and connected channel choices. VIRBA processes customer information solely to deliver authorized software services and manage customer accounts.

3. Information We Collect

Depending on how you interact with VIRBA, we may collect:

  • Account and Profile Details: Full name, business email address, job title, phone number, password hash, and organization membership details.
  • Business and Brand Data: Business trading name, website URL, service areas, brand tone/style preferences, logos, and knowledge base items.
  • Content and Drafts: Customer-composed article copy, social post copy, attached media images, scheduling timestamps, and approval history.
  • Connected Platform Data: Connected channel metadata, account names/handles, page identifiers, and encrypted API authorization tokens.
  • Technical and Usage Logs: IP address, browser type, device details, session state tokens, and system activity logs for security and diagnostic purposes.

4. Meta (Facebook & Instagram) Integration Details

VIRBA offers optional integrations with Meta services (Facebook Pages and Instagram professional accounts) to assist customers with content scheduling and social publishing:

A. Customer Authorization & Permissions: Connecting a Meta channel requires explicit user authorization via OAuth. Depending on the customer's selected connection path, requested permissions may include pages_show_list, pages_manage_posts, instagram_basic, and instagram_content_publish.

B. Data Handled via Meta APIs: When authorized, VIRBA processes Meta account identifiers (Facebook Page ID, Instagram Business Account ID, account display names, usernames/handles, and profile photo URLs), customer-approved post copy, attached image assets, and publishing status responses.

C. Secure Handling of Access Tokens: Meta Page access tokens and OAuth credentials are encrypted at rest server-side using AES-256-GCM symmetric encryption. Credentials are never stored in plaintext, never logged, and never exposed to client-side browser scripts.

D. Capability Transparency: Please note that while WordPress publishing, private media storage, and draft composition are active features, automated Facebook Page and Instagram professional account publishing features are currently in development and setup with Meta, and are undergoing Meta App Review. No automated posts occur without explicit customer scheduling and approval.

E. Disconnection and Revocation: Customers can disconnect their Meta accounts at any time via VIRBA Connections (/app/connections) or directly through Meta Business Integrations settings. Disconnecting immediately revokes token usage in VIRBA.

F. Compliance with Meta Terms: VIRBA complies strictly with the Meta Platform Terms and Developer Policies. Data received through Meta APIs is processed exclusively to deliver customer-authorized publishing services and is never sold or used for advertising targeting.

5. How We Use Information

Information is processed to: provide, maintain, and secure your account; enable customer-directed content composition and publishing; process subscription transactions; deliver user support; send operational security alerts; and comply with statutory legal duties under Australian law.

6. AI Assistance and Content Processing

When customers choose to use VIRBA's AI drafting features, prompt briefs and business knowledge items are processed to generate suggested copy or images. AI outputs are suggestions only and must be reviewed and approved by the customer before reliance or publication. For full details, see our AI Disclaimer (/disclaimer).

7. Subprocessors and Disclosure

VIRBA discloses information only to contracted third-party subprocessors providing essential infrastructure services (such as cloud hosting, transactional email delivery, and media storage), connected platform providers selected by the customer, and authorities where required by applicable law. All service providers are bound by confidentiality and security obligations.

8. Information Security

We maintain technical, administrative, and physical safeguards designed to protect personal and connection data against unauthorized access, loss, misuse, or alteration. These include database Row-Level Security (RLS) policies, HTTPS encryption in transit, AES-256-GCM encryption for stored integration credentials, and strict server-side authorization boundaries.

9. Data Retention and Deletion

We retain personal and connected account information for as long as your account remains active or as necessary to fulfill the purposes outlined in this policy. When an organization disconnects a connected channel, access credentials are immediately purged. For complete data deletion instructions or to submit a account deletion request, visit our User Data Deletion Request page (/data-deletion).

10. Access, Correction, and Privacy Rights

Subject to applicable privacy legislation (including the Australian Privacy Act 1988), you have the right to request access to the personal information we hold about you, request corrections to inaccurate data, or request deletion of your information. Contact our privacy team at privacy@virba.ai to submit a request.

11. Cookies and Web Storage

VIRBA uses essential browser storage (cookies and local session tokens) solely for user authentication, session security, and active workspace selection. We do not use third-party tracking cookies for cross-site advertising. For details, view our Cookie Policy (/cookies).

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect service updates or legal requirements. Material updates will be indicated by a revised effective date at the top of this page.

13. Contact Information

Operator Legal Entity: Haansal Estate Pty Ltd (an Australian company)

Privacy Email: privacy@virba.ai

Support Email: support@virba.ai / sales@virba.ai

Data Deletion Instructions: https://virba.ai/data-deletion

← Back to Home