Your voice. Your stories. Your legacy. These are some of the most intimate things you'll ever share with any platform. Here's exactly how we protect them.
Your voice recordings, video messages, and legacy content are encrypted at rest (AES-256) and in transit (TLS 1.3). Nobody — not even VertualMe staff — can access your raw content without your keys.
Full stop. Your profile, voice model, relationships, and stories are yours. We will never sell, share, or trade your personal data to third parties for advertising or commercial purposes.
Every piece of content you create has its own access control. You decide — per person — who can receive messages, access the AI Presence, or view your life story.
You can delete your account and all associated data at any time. We process deletion requests within 30 days. Legacy vaults require executor co-confirmation for deletion.
We only collect data that is necessary to operate the platform. We explain exactly why each category exists:
| Data type | Why we collect it | Retention |
|---|---|---|
| Account information name, email, password hash |
Authentication and communications | Until account deletion |
| Profile data personality, values, tone preferences |
Power AI message generation | Until deletion |
| Relationship map contact names, birthdays, relationship type |
Drive automated care actions | Until deletion |
| Voice recordings training samples, Best of Me audio |
Build your voice model; deliver voice stories | Until deletion (or lifetime for Legacy) |
| Video messages Best of Me recordings |
Store and deliver video stories | Until deletion (or lifetime for Legacy) |
| Written stories Best of Me content, milestone messages |
Store and deliver your written legacy | Until deletion (or lifetime for Legacy) |
| Payment information card details, billing address |
Process subscription and gift payments | Governed by payment provider's policy |
| Usage analytics pages visited, features used |
Improve the product | 24 months, then purged |
Voice data is the most sensitive information on our platform. We treat it accordingly.
When you upload voice training samples, we send them to ElevenLabs via their API to create a cloned voice model. This model is:
Your profile data, tone preferences, and message history are sent to Anthropic's Claude API to generate messages in your voice. We use the API in a way that:
All Legacy plan content is stored in encrypted cloud infrastructure hosted in Australia, with:
We hold a separate escrow fund to cover legacy vault storage costs for a minimum of 25 years from the date of any company closure. In this event:
We use trusted third parties to deliver our service. Here is what each one receives and why:
| Service | Purpose | Data shared | Your control |
|---|---|---|---|
| Anthropic Claude | Generate personalised messages in your voice | Profile data, tone preferences, message context | Opt out in settings (reverts to template messages) |
| ElevenLabs | Create your voice clone | Voice training samples | Delete voice model any time |
| Stripe | Payment processing | Payment card details (tokenised) | Governed by Stripe; delete card any time |
| Twilio | SMS delivery of messages | Recipient phone number, message text | Disable SMS in delivery settings |
| SendGrid | Email delivery of messages | Recipient email, message text | Disable email in delivery settings |
| Bloomex / Interflora | Flower & gift ordering | Recipient name, delivery address | Disable in flower & gift settings |
Your Trusted Executor is the person you designate to activate your legacy after you pass. This is a significant responsibility and we take the security of this access seriously.
Your executor can activate legacy delivery and confirm your wishes have been carried out — they cannot read your private messages, modify your content, or access financial accounts.
Executor activation requires verified identity (government ID), a death certificate, and a 14-day waiting period before any irreversible actions are taken.
You can update your Trusted Executor at any time. We recommend reviewing this every few years as life circumstances change.
VertualMe facilitates charitable giving but does not hold charitable funds itself. All charitable payments are processed through Stripe and sent directly to registered charity accounts.
Under the Australian Privacy Act 1988 (including the Australian Privacy Principles) and where applicable, the EU General Data Protection Regulation (GDPR), you have the following rights:
Request a full copy of all data we hold about you
Ask us to fix any inaccurate personal information
Delete your account and all associated data
Export all your content as a ZIP archive any time
Opt out of any non-essential data processing
Limit how we process your data while a complaint is resolved
To exercise any of these rights, email vertualme.com@gmail.com. We respond to all requests within 30 days.
We implement security appropriate for the sensitivity of the data we hold:
AES-256 at rest. TLS 1.3 in transit. All content encryption keys are unique per user and stored separately from content.
VertualMe staff cannot read your voice recordings, stories, or legacy messages. Content access requires your decryption key.
2FA is available for all accounts and mandatory for accounts with executor privileges.
We conduct annual penetration tests by an independent third party and publish a summary of findings on this page.
In the event of a data breach affecting you, we will notify you within 72 hours as required by the Notifiable Data Breaches scheme.
All personal data is stored in Australia. We do not transfer personal data outside Australia except as required to deliver AI services (Claude, ElevenLabs) under strict data processing agreements.
VertualMe complies with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). We are registered with the Office of the Australian Information Commissioner (OAIC).
For users in the European Economic Area or the United Kingdom, we comply with the GDPR. Our lawful basis for processing your data is:
VertualMe is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us at vertualme.com@gmail.com.
For privacy enquiries, data subject requests, or to report a security concern, contact our Privacy Officer directly:
We respond to all privacy enquiries within 5 business days and data subject requests within 30 days. For urgent security concerns, email the subject line: SECURITY REPORT.
vertualme.com@gmail.comYour legacy deserves a platform that takes privacy as seriously as you take the relationships you're protecting.