Privacy Notice
The short version
We collect the least we can: an email address so you can sign in, a name if you give one, and the records of what happens inside the organizations you are part of. We do not sell it, we do not advertise to you, and we do not track you across other websites.
Who we are
VirtuBank is the data controller for the information described here. Reach us at privacy@virtubank.ca.
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Email address | To sign you in, and to send verification codes and invitations | Performance of a contract |
| Display name, if you give one | So other people in your organization can recognise you | Performance of a contract |
| First and last name, if you give them | So the account has a real name on it, separate from whatever you are called inside an organization | Consent — both are optional and can be cleared |
| A second email address, if you add one | To get you back into your account if you lose access to the first, and to check it is you | Consent — optional, and removable at any time |
| Your time zone, if you set one | To show dates and times as they happened where you are | Consent — optional |
| Whether you want product announcements | To know whether to email you about new features | Consent — off unless you turn it on |
| Google or Apple account identifier, if you sign in that way | To recognise you on return without a password | Performance of a contract |
| Organizations you belong to, your balances, and your transaction history | This is the service — a simulated account has to be recorded | Performance of a contract |
| Sign-in tokens and device labels | To keep you signed in and let you sign out a lost device | Legitimate interest in keeping accounts secure |
| Server logs, including IP address | To keep the service running and investigate abuse | Legitimate interest in security and reliability |
We do not collect anything we do not need. There is no advertising identifier, no third-party analytics that follows you elsewhere, and no profiling. We do not ask for a phone number, a date of birth, or a postal address, because nothing here needs one.
If you report a problem
The app has a "Report a problem" button. If you use it, the report you choose to send includes the app version, your device model and operating system version, your language and time zone, the screen you were on, and the last few errors the server sent back. It never includes balances, names, or anything you typed into another field. The screen shows you exactly what will be sent before you send it. Reports are emailed to our support address and kept until the problem is handled.
Email we send you
Emails you cannot turn off. Sign-in codes, invitations, and anything about an organization you belong to. These are how the service works — an account you cannot sign in to is not a service, and switching them off is not something we can offer.
Product announcements, which you can. Occasional news about new features. Off unless you turn it on: the box is not ticked for you when you sign up, and turning it off in Your account takes one tap. We record when you last changed the setting, so we can show what you chose and when.
We do not sell your address, and we do not send you anything on somebody else's behalf.
Your second email address
If you add one, we email a code to it and it counts for nothing until you enter that code back. Until then it is stored but unproved, and we will not use it to let anybody into your account. Changing the address starts that over, because a new address has not been proved just because the old one was.
Removing it deletes it. It is used for recovering your account and confirming it is you, and for nothing else — in particular it is not added to any mailing list.
Donations
VirtuBank is free and takes no payments. If you choose to donate, you do it on PayPal, and PayPal handles your payment details under its own privacy policy — they never reach VirtuBank. PayPal tells us what it tells anyone who receives money: the name and email address on the PayPal account, the amount, and any note you add. We use that only to keep a record of donations and to thank you, and it is not connected to your VirtuBank account.
Who else sees your information
People in your organizations. Staff of an organization you join can see your name, your balances there, and your transaction history there. Other members can see your name so they can send you things. Nobody in one organization can see your activity in another.
Service providers. We use Amazon Web Services to run and store the service (in Canada), and Amazon SES to send email. They act on our instructions. Donations go through PayPal, which acts under its own terms rather than ours.
Nobody else. We do not sell personal information, and we do not share it for advertising. We will disclose information if the law requires it, and will tell you unless we are forbidden from doing so.
Children
VirtuBank is built partly for families and classrooms, so children may use it — but always inside an organization an adult set up and controls. We do not knowingly let a child create their own account without an adult, and we ask for nothing about a child beyond a name and an email address to invite them.
If you believe a child's information is here without an adult's involvement, write to us and we will remove it.
How long we keep it
- Your account: until you delete it, plus up to 30 days while backups age out.
- Transaction records inside an organization: as long as the organization exists. These are shared records — deleting your account removes your personal details from them, but the fact a transaction happened stays, because it is part of somebody else's history too.
- Server logs: 90 days.
Your rights
You can ask us to:
- show you what we hold about you, in a portable form;
- correct anything wrong;
- delete your account and personal details — which you can also do yourself, in the app; see Delete your account;
- stop processing while a complaint is looked into;
- explain a decision, though we make no automated ones about you.
Write to privacy@virtubank.ca and we will answer within 30 days. If you are not satisfied you can complain to the Office of the Privacy Commissioner of Canada, or to your local supervisory authority if you are in the UK or the EU.
Where your information lives
Data is stored in Canada. Email delivery may involve providers outside Canada; where that happens we rely on their standard contractual protections.
Cookies
The web app stores a sign-in token in your browser so you stay signed in. That is the only thing it keeps, and it is not used to track you. There are no advertising or analytics cookies, which is why there is no cookie banner.
Changes
If we change this notice materially we will tell you. The version and date at the top say which notice applies.