Privacy policy

Last updated October 23, 2026

HECANO LLC ("we") runs Virtucano at https://virtucano.com. This policy explains what we collect when you use Virtucano, why, who else handles it, and the choices you have. Most of what Virtucano works with is information businesses publish about themselves, but using it means sharing some personal information too, such as your email address.

What we collect

Free reports. The business name, city, state, category and website you enter, and the report Virtucano builds from them: what AI assistants and search engines said, and what Virtucano found on the website. Each report lives at its own hard-to-guess link, which works for anyone you share it with. We ask search engines not to index reports.
Report emails. If you ask for a report by email, your email address, and whether you asked for and confirmed monthly re-checks.
Your account. Your email address, which is how you sign in, and the browser description your browser sends, kept with each signed-in session.
Businesses you manage. What you add about a business: its facts in the Truth Ledger (such as hours, services, locations and prices), your settings, the changes Virtucano proposes, and your approvals.
Connected services. Data from Google, Bing Webmaster Tools and WordPress, if you connect them. See Connected services.
Weekly briefings. If you turn them on, your mobile number or email address, the briefings we send and your replies.
Your plan and payments. Your plan, when your trial started and ends, and, if you subscribe, the customer and subscription IDs Stripe gives us, the subscription's status and dates, and whether a payment failed. You enter your card and billing details on Stripe's pages, not ours: we never see or store your card number.
Server logs you upload. Virtucano counts the visits from AI assistants' agents in them and keeps only daily counts per page and per assistant. It doesn't keep the file, or your site visitors' IP addresses.
Technical data. To limit abuse, we store a hash of your IP address with each free report and report email, not the address itself. Our request logs record the page, the result and how long it took, but not your IP address. Our hosting provider may keep its own standard logs.

Cookies. Virtucano sets one cookie, to keep you signed in. Its pages load no advertising or analytics trackers. When the bot check is on, Cloudflare Turnstile runs on the free report and email forms, and when street maps are on, map images load from Mapbox (see below). Checkout and the billing portal are Stripe's own pages, where Stripe's privacy policy and cookies apply.

How we use it

To build free reports, and send the emails and monthly re-checks you ask for.
To run Virtucano for the businesses you manage: ask AI assistants and search engines about them, check the answers against your facts, propose changes, ship the ones you approve or your autonomy settings allow, and measure what they did.
To send sign-in links, weekly briefings and replies to your texts.
To run your trial and your plan: emailing you before your trial ends and when it does, and billing you through Stripe if you subscribe.
To keep Virtucano secure and working: preventing abuse, fixing problems, and understanding in aggregate how it's used, such as how many free reports lead to a connected business.
To answer you when you write to us.

We don't sell personal information, share it for targeted advertising, or use it to train AI models.

We share information only with services that help run Virtucano, and only what they need:

AI assistants and search providers: OpenAI, Anthropic, Google (Gemini), Perplexity and DataForSEO. They get the questions Virtucano asks about a business and the Google searches it tracks, which name the business, its city, category and website, or its spot on the map, and they may visit the website to answer. To draft changes and read answers, Virtucano also sends a business's facts and pages to one of these AI providers, and, with Google connected, some Google data (see Connected services). These requests are about the business: they don't include your email address or the mobile number you give for briefings.
Cloudflare, when the bot check is on. Turnstile receives your IP address and information about your browser to tell people from bots, under Cloudflare's privacy policy.
Mapbox, when street maps are on. Your browser loads the map behind map rankings from Mapbox, which receives your IP address and information about your browser, under Mapbox's privacy policy.
Google PageSpeed Insights, when the speed check is on. It receives the address of a business's home page, to measure how fast it loads on a phone.
Our email provider, which receives your email address and the emails we send you.
Twilio, which receives your mobile number, the texts we send you and your replies.
Stripe, our payment processor, if you subscribe to a paid plan. We send it your email address and which account is subscribing; on its own pages it collects your card and billing details, and charges your card. It tells us back whether payments went through. Stripe also uses payment information for its own purposes, such as preventing fraud, under Stripe's privacy policy.
Our hosting and database providers, which store the information above.
Services you connect (Google, Microsoft Bing and your WordPress site), which receive the changes you approve.

We may also disclose information when the law requires it, to protect someone's safety or our rights, or as part of a merger or sale of our business, in which case this policy keeps applying to it.

Connected services

Google. If you connect Google, Virtucano asks for read-only access to Search Console and Google Analytics, and for access to manage your Business Profile:

From Search Console, it reads daily clicks and impressions for your site and its pages, and each week the searches your site showed up for, with their clicks, impressions and average position.
From Analytics, it reads daily sessions and key events by traffic source, to count visits from AI assistants.
From Business Profile, it reads your locations (including their categories and services), their daily performance (impressions, calls, website clicks and direction requests) and their reviews. It updates a listing, or posts a reply to a review, only when you approve it, or after you've chosen in your autonomy settings to let it do that without asking.

Search Console, Analytics and performance numbers are totals: Virtucano doesn't receive information about individual visitors. Reviews are what your customers post publicly on Google: their words, star rating and name as Google shows it. We use Google data only to show you how your business is doing, measure the changes Virtucano makes, keep your listing in sync with your Truth Ledger, and draft replies and page changes for you. We don't sell it, use it for advertising, or transfer it to others except as this policy describes, and people read it only to help you, to investigate abuse, or to meet a legal obligation.

To draft something for you to approve, Virtucano sends some Google data to the AI provider it uses (Anthropic, OpenAI or Google; see Who else handles it): a review's words and star rating, the reviewer's first name and your earlier replies, to draft a reply; and the searches a page showed up for, with their positions, to draft its title or search description. The provider uses it only to answer that request, under terms that don't let it train its models on what we send. Virtucano doesn't use Google data to train or improve AI models either.

Virtucano's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting Google in Virtucano deletes its access tokens. You can also remove Virtucano's access in your Google Account. What's already synced, such as totals and reviews, stays with the business until it's deleted.

Bing Webmaster Tools. The API key you give us, stored encrypted, which Virtucano uses to read daily clicks and impressions for your site.

WordPress. The Virtucano plugin sends your site's page list (titles, descriptions, text and internal links) and applies the changes you approve. Disconnecting in Virtucano, or removing the plugin, stops this.

Text messages

If you turn on the weekly text, we send about one briefing a week, plus replies to your texts. Message and data rates may apply. Reply STOP to stop, or HELP for help.

We share mobile numbers only with Twilio, which delivers the texts. We don't share mobile information with third parties or affiliates for marketing or promotional purposes, and text messaging opt-in data and consent aren't shared with any third parties.

Review requests

When a business asks one of its customers for a Google review, it gives Virtucano the customer's name and, to have it emailed, their email address. Virtucano uses them only to send that request and one reminder on the business's behalf, through our email provider, and deletes them 90 days later. If the customer stops the business's requests, we keep a one-way hash of their address so we can honor that, and nothing else. Customers can stop requests from the link in any request email.

How long we keep it

Account and business data, while the account is open.
Free reports and the answers behind them, so their links keep working and re-checks have something to compare against.
The hash of your IP address with each free report and report email, for about a day. It's only needed for an hour, to limit abuse.
Sign-in links work once and expire after 15 minutes; signed-in sessions expire after 30 days.
Records of what we charged and when, as long as tax and accounting law requires, even after the account is closed. Stripe keeps its own records of payments.
If you unsubscribe, we keep your address marked as unsubscribed, so we don't email it again.
The audit log records who approved, shipped or undid each change: by account, or by phone number for text replies. It's append-only, because it's how you and we prove what changed, so its entries stay when the rest is deleted.

Owners and admins can remove a business from its settings in Virtucano, which deletes it and what we hold for it right away, apart from its audit log entries. Ask us to delete your account, a business or a report and we'll do it within 30 days, except what we must keep by law or to prevent abuse.

Your choices and rights

Unsubscribe from report emails with the link in each one.
Reply STOP to any text.
Disconnect services, change your autonomy settings, or undo changes, in Virtucano.
Download everything Virtucano holds about a business, as JSON, from its settings.
Remove a business, and what Virtucano holds for it, from its settings, as its owner or an admin.
Write to us to see, correct or delete your personal information, or to object to how we use it. We'll answer within 30 days.

Depending on where you live, for example in the EU, the UK or California, you may have further rights, including to complain to a data protection authority. We won't treat you differently for using them.

Where the GDPR applies, we rely on our contract with you for your account, the services you connect, your trial and your subscription; on our legal obligations for keeping billing records; on your consent for monthly re-checks and text messages, which you can withdraw at any time; and on our legitimate interests for free reports about businesses, keeping Virtucano secure, and understanding how it's used. Virtucano and the services above may process information in the United States and other countries.

Security

Connection tokens and keys are encrypted at rest. Sign-in links, sessions and API keys are stored only as hashes. Every change Virtucano makes is recorded in a tamper-evident audit log. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.

Children

Virtucano is for businesses and isn't directed at children under 16. We don't knowingly collect their information.

Changes to this policy

We'll post changes here and update the date at the top. For significant changes, we'll email account holders before they take effect.

Contact

HECANO LLC, [email protected]