Privacy Policy

1. Scope and who we are

Virtual Bridge Tech LLC (“Virtual Bridge,” “we,” “us,” or “our”) provides website analysis, digital marketing, search engine optimization (“SEO”), generative engine optimization (“GEO”), analytics, reporting, AI-assisted tools, automation, website development, and consulting services.

This Privacy Policy applies to information we process through our website, accounts, reports, tools, orders, and related services. It does not apply to third-party websites or services that have their own privacy practices.

2. Information we collect

Information you provide

We may collect your name, email address, company information, website URL, messages, service requests, order details, and other information you choose to provide through forms, accounts, proposals, or communications.

Order, consent, fulfillment, and refund information

When you place an order or request a cancellation or refund, we may collect and retain the selected service and order scope; applicable policy versions and snapshots; the date and time of acceptance; IP address and user agent; Stripe’s recorded terms-acceptance status; written cancellation or refund requests; supporting descriptions and communications; service-processing events; work performed; milestones and deliverables; third-party costs; and refund decisions and transaction records. We use these records to document your agreement, determine whether and when processing or work began, administer cancellations and refunds, deliver services, prevent fraud, and respond to payment disputes.

Google sign-in information

If you sign in with Google, we receive your Google account identifier, name, email address, email-verification status, and, if available, profile photo. We use this information to authenticate you and associate you with your Virtual Bridge account or order. The Google access token used to retrieve this profile is not retained by Virtual Bridge after sign-in is completed.

Website and analysis information

When you submit a website or digital property for analysis, we collect the submitted URL and may retrieve and process publicly accessible page content, technical metadata, links, and other information needed to produce the requested analysis.

Technical and usage information

Our servers necessarily receive ordinary request information such as your IP address, browser and device information, user agent, referring page, requested page, and timestamp. If you affirmatively accept optional analytics, we also collect pages or services viewed, destination links, interaction events, and a randomly generated first-party visitor identifier stored in your browser’s local storage. We do not create that identifier or send usage events to Google Analytics or our own event database before you accept optional analytics.

3. Google Analytics and Search Console data

If you connect a Google Analytics 4 property or Google Search Console property, you provide the applicable property identifier and grant our designated reporting account access through Google’s permission controls. Depending on the service, we may retrieve search queries, impressions, clicks, average position, landing-page performance, traffic and referral metrics, and related reporting data made available by Google.

We use Google reporting data only to provide or improve user-facing analytics, SEO, GEO, reporting, optimization, and consulting features that you request. We do not use Google user data for advertising, and we do not sell it.

You can revoke this access at any time by removing the designated reporting account from the applicable Google Analytics or Search Console property. You may also contact us to request deletion of reporting connections and stored reporting snapshots, subject to legal and recordkeeping requirements.

Virtual Bridge’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

4. How we use information

We use information to:

• provide website analyses, reports, services, and customer support;
• authenticate accounts and administer orders;
• document policy acceptance, service commencement, work performed, and delivery;
• evaluate and process cancellation, refund, fraud, and payment-dispute matters;
• generate SEO, GEO, analytics, and AI-assisted recommendations;
• communicate about requests, orders, service delivery, and account matters;
• operate, secure, troubleshoot, and improve our website and services;
• prevent fraud, misuse, and unauthorized access;
• maintain business and transaction records; and
• comply with law and enforce our agreements.

We may create aggregated or irreversibly de-identified information that cannot reasonably be linked to a person, customer, account, order, or specific property. We may retain and use that information to develop industry benchmarks, improve scoring and measurement methodologies, and understand service performance. Our long-term benchmark datasets do not include names, contact details, IP addresses, account or payment identifiers, stable customer or visitor identifiers, exact customer domains, Google property identifiers, raw Google reporting data, customer production data, or keys that would allow the records to be linked back to a customer. We do not attempt to re-identify de-identified information.

5. AI and service providers

We use third-party providers to support hosting, databases, authentication, analytics, communications, payment processing, professional services, and artificial intelligence. Depending on the service requested, publicly accessible website content, prompts, analysis inputs, or related outputs may be processed by Google Gemini.

We seek to limit the personal and confidential information sent to AI providers. Do not submit passwords, payment credentials, government identifiers, health information, trade secrets, or other highly sensitive or regulated information unless we expressly request it through an approved secure process.

We may disclose information to service providers and contractors only as reasonably necessary for them to perform services for us, to professional advisers, when required by law, to protect rights and safety, or in connection with a corporate transaction. We do not sell personal information for monetary consideration.

6. Payments and refunds

When you purchase a service, Stripe directly collects and processes your payment-card information through Stripe Checkout. Virtual Bridge does not receive or store your full card number or card security code.

Virtual Bridge receives and retains transaction information needed to administer the purchase and any refund, including the order amount, currency, payment and refund status, customer contact information, and identifiers associated with the Stripe Checkout Session, PaymentIntent, Invoice, charge, and refund. Approved refunds are normally returned through Stripe to the original payment method.

Stripe is an independent payment and data-processing provider and processes information under its own Privacy Policy. Stripe may independently determine how it processes certain information for security, fraud prevention, regulatory compliance, and operation of its payment services.

7. Cookies and similar technologies

Strictly necessary storage

We use strictly necessary cookies and similar storage for Google authentication, session security, sign-out, checkout completion, and remembering your privacy choice. These include a temporary OAuth state cookie, a signed session cookie that may remain active for up to seven days, temporary tab storage used to complete a Stripe return without exposing its Session ID to analytics, and the vb_analytics_consent preference. These functions operate whether you accept or reject optional analytics because they are needed to provide your requested service or remember your choice.

Optional analytics

Only after you select “Accept analytics,” we load Google Analytics and create a random vb_visitor_id in local storage for our first-party event measurement. Google Analytics may set cookies such as _ga and receive usage and device information to help us understand traffic and site performance. We configure it without Google Signals or advertising personalization. Google processes this information under its own Privacy Policy. Our first-party identifier helps us associate service views, analysis activity, and website performance; it is not created if you reject optional analytics.

You can accept, reject, or later change your choice using the “Privacy settings” button displayed on every page. Rejecting after previously accepting disables future optional analytics, removes the first-party visitor identifier, and attempts to remove Google Analytics cookies set for this site. You can also clear cookies and local storage in your browser. Withdrawing consent does not affect processing that occurred before withdrawal.

Our pages also load functional resources from providers such as Google Fonts and jsDelivr, which may receive ordinary connection information such as your IP address and user agent. We do not currently use third-party advertising cookies or cross-site behavioral advertising trackers.

Browser privacy signals

Some browsers offer a “Do Not Track” (“DNT”) setting. Because there is not a uniform industry standard for responding to DNT, our website does not currently change strictly necessary processing in response to that signal. We will honor legally required opt-out preference signals, such as Global Privacy Control, if we begin processing information in a way to which those signals apply.

8. Data retention

We apply standard retention periods based on the purpose and sensitivity of each record. A period begins at the event stated below. At the end of the period, we delete the record, irreversibly de-identify it, or move only the portion that remains necessary into a restricted legal archive.

Website, analytics, and report data

• Direct identifiers in ordinary request and access logs, including IP address, full user agent, and referrer: 30 days after collection.
• Consented first-party visitor events: 14 months after collection, with direct request identifiers removed after 30 days.
• Identifiable free SEO, GEO, workflow, and website-readiness analysis records: 12 months after the analysis is completed.
• GA4 and Search Console connection records used for a purchased report: 30 days after the report is completed.
• Raw GA4 and Search Console reporting snapshots: 90 days after the report is completed.
• Final SEO and GEO reports and customer-linked derived metrics: 24 months after delivery.
• Raw generative-AI benchmark answers, citations, and run results: 12 months after the run is completed. Customer-linked derived metrics are retained for no more than 24 months.

Professional-service and project data

• Source materials, research, and working drafts for SEO, GEO, and content services: 180 days after final delivery.
• Final SEO, GEO, and content deliverables: 24 months after final delivery.
• Temporary website-development test materials and backups: 90 days after acceptance or launch.
• Copies of customer production, ecommerce migration, automation, or custom-system data: 30 days after acceptance.
• Customer-specific source code, configuration, deployment, and handoff records: three years after the applicable support period ends.
• Consultation notes: 12 months after the meeting. A consultation recording, if made with consent, is retained for 90 days.

Accounts, communications, and compliance records

• Unverified account registration records: seven days after registration. Account email-verification links expire after 24 hours.
• Ordinary account profile information: while the account is active and for up to 24 months after the last account activity, unless it remains needed for an active service or is deleted earlier in response to a verified request.
• Inquiries that do not become customer engagements: 12 months after the last contact.
• Paid-customer support records: 24 months after the matter is closed, except for the minimum content moved to a restricted legal archive as transaction or contract evidence.
• Unconfirmed newsletter subscriptions: seven days after signup; confirmation links expire after 48 hours. Confirmed subscriptions are retained while active. After unsubscribe, related consent and delivery metadata is retained for 24 months and then reduced to the minimum suppression record needed to prevent further marketing.
• Privacy-rights request and response records: 24 months after the request is closed, restricted to compliance purposes.
• Stripe webhook event identifiers used for duplicate prevention: 90 days after processing.
• Temporary exports and in-progress generated files: seven days after generation.
• Encrypted rolling database backups: 35 days after creation. Data already deleted from active systems is not restored for ordinary use and expires when the backup is overwritten.

Transaction and legal records

Order, payment, invoice, refund, and accounting records are generally retained for seven years after the end of the relevant financial year. Contracts, policy-acceptance records, order-scope records, delivery evidence, and material dispute records are generally retained for seven years after the latest of service completion, final payment or refund, or final resolution of a dispute. These records are access-restricted and are not used for marketing or benchmarking.

De-identified benchmarks and legal holds

We may retain genuinely aggregated or irreversibly de-identified benchmark information without a fixed period because it can no longer reasonably identify or be linked to a person or customer. Encrypted, hashed, coded, or pseudonymous records remain subject to the periods above if we or another party can reasonably reconnect them to a person or customer.

We may pause deletion only for records relevant to a pending legal claim, subpoena, regulatory inquiry, refund or payment dispute, fraud investigation, tax audit, verified privacy request, or investigated security incident. A hold is limited to the relevant records. After the reason for the hold ends, we resume the original schedule and ordinarily complete the delayed deletion within 90 days unless a longer period is required by law.

9. Legal bases for processing

If data-protection law in the European Economic Area, United Kingdom, or a similar jurisdiction applies, we process personal information as needed to perform a contract or take requested pre-contract steps; for legitimate interests such as providing, securing, measuring, and improving our services; with consent where required; and to comply with legal obligations. You may contact us for more information about the legal basis applicable to a particular activity.

10. Your choices and privacy rights

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information, or to receive information about how it is used and disclosed. You may also object to or restrict certain processing, withdraw consent, request data portability, or appeal a decision where applicable.

To make a request, use our contact page or email us at virtualbridgetech@gmail.com. We may need to verify your identity and authority before completing a request. Some information may be retained where permitted or required for security, fraud prevention, contracts, transactions, or legal compliance. We will not discriminate against you for exercising an applicable privacy right.

If European or UK data-protection law applies, you may also lodge a complaint with the data-protection authority where you live or work. We encourage you to contact us first so we can try to address your concern.

We do not currently sell personal information or share it for cross-context behavioral advertising. You may nevertheless submit an applicable opt-out request through the channels described below.

11. Nevada privacy notice

This section supplements the rest of this Privacy Policy for Nevada consumers where Nevada Revised Statutes Chapter 603A applies. The categories of covered information we collect are described in Section 2 and may include names, physical or email addresses, telephone numbers, online identifiers, account and transaction information, submitted website information, and other information maintained in personally identifiable form. The categories of third parties with whom we may share covered information are described in Sections 3, 5, 6, 7, and 16 and include payment, Google product, analytics, hosting, communications, professional-service, security, and technology providers as necessary for the purposes described in this policy.

To review or request a change to covered information, or to submit a verified request directing us not to make a sale of covered information, email virtualbridgetech@gmail.com with the subject “Nevada Privacy Request” or use our contact page and include that phrase in your message. This email address and contact page are our designated request addresses. We may request information reasonably necessary to authenticate the request and verify your identity. We will respond to a verified request not to sell within 60 days after receipt, or within an additional 30 days if reasonably necessary and we notify you of the extension.

Virtual Bridge does not currently sell covered information as “sale” is defined by Nevada law. A verified direction not to sell will be honored for covered information we have collected or will collect about the requesting consumer if our practices change. If you accept optional analytics, Google Analytics may collect information about online activities over time and may process information across different websites or online services according to Google’s practices and your Google settings. We do not enable Google Signals or advertising personalization for our Google Analytics configuration. The effective date of this notice is the “Last updated” date shown above.

12. Account deletion requests

Signed-in customers may start an account deletion request from the Profile section of the account page. To protect the account, we require both an authenticated request and confirmation through a link that expires after 24 hours. A verified request is then reviewed and completed through our privacy-request workflow. If you cannot access your account, you may use our contact page or email virtualbridgetech@gmail.com.

When we complete an account deletion request, we remove login credentials, reporting connections and stored reporting snapshots, ordinary profile metadata, contact requests associated with the account, and account links to ordinary website analyses. We may retain restricted records associated with orders, payments, policy acceptance, fulfillment, cancellations, refunds, fraud prevention, tax, accounting, or disputes until the applicable period in Section 8 ends. Information that was irreversibly de-identified before the request cannot reasonably be located by or linked back to the requester and is not affected by an account deletion. The completion notice identifies the categories retained for restricted purposes.

13. Security and international processing

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No internet transmission, cloud service, AI system, or storage method can be guaranteed to be completely secure.

Virtual Bridge and its service providers may process information in the United States and other countries. Those locations may have data-protection laws that differ from the laws where you live. Where required, we use an appropriate legal mechanism for international transfers.

14. Children’s privacy

Our services are intended for businesses and adults and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can review and delete it as appropriate.

15. Newsletter communications

If you request our newsletter, we record the email address, subscription source and page, consent wording and version, consent time, confirmation time, IP address, user agent, and later unsubscribe status and time. The subscription remains inactive until you use the confirmation link sent to the submitted address. Marketing emails include Virtual Bridge Tech LLC’s postal address and a link and email-client control for unsubscribing from all marketing messages. We suppress an address immediately when a valid electronic unsubscribe request reaches our system. Transactional messages necessary to provide an account, order, security notice, or requested service may still be sent.

16. Third-party services and subprocessors

We use the following providers to operate our website and deliver requested services. The information processed by each provider depends on the features you use. A provider may act as our service provider or processor for some activities and as an independent controller for others under its own terms and applicable law.

• Amazon Web Services, Inc. and applicable AWS affiliates — Amazon Lightsail. AWS hosts our application servers and managed MySQL database and may process account, order, service, website-analysis, reporting, communication, IP-address, and technical-log information. Our current Lightsail application and database resources are hosted in the United States in the US East (N. Virginia) Region (us-east-1). AWS’s Privacy Notice and applicable data-processing terms govern its processing.
• Google LLC and applicable Google affiliates. We use Google authentication, Google Analytics, Google Search Console, Google Analytics reporting APIs, Google Fonts, and Google Gemini. Depending on the feature, Google may process account identifiers and profile information; optional website analytics and device information; connected Search Console and Analytics reporting data; font-resource request information; and website content, prompts, analysis inputs, and generated outputs submitted to Gemini. Google processes information in the United States and other locations under its applicable service terms and Privacy Policy.
• Stripe, Inc. and applicable Stripe affiliates. Stripe provides Checkout, payment, invoice, refund, fraud-prevention, and transaction services. Stripe directly processes payment credentials and may process customer contact, billing, device, transaction, and fraud-prevention information. Stripe’s Privacy Policy governs activities for which Stripe acts independently.
• Plus Five Five, Inc., doing business as Resend. Resend delivers account-verification, order-confirmation, privacy-request, transactional, and requested marketing emails and may process recipient names and email addresses, message contents, delivery events, IP addresses, and related technical information. Resend’s Privacy Policy and data-processing terms govern its processing.
• Volentio JSD Limited, trading as jsDelivr. jsDelivr delivers Bootstrap website files through its content-delivery network and may receive IP addresses, browser and device information, referring domain, requested resource URLs, timestamps, and diagnostic information. See the jsDelivr Privacy Policy.

MySQL is database software operated within our AWS environment and is not itself a separate recipient of personal information. Our website and reports may also link to third-party websites that you choose to visit. Those websites’ privacy and security practices are governed by their own policies.

17. Changes to this policy

We may update this Privacy Policy as our services or legal obligations change. We will post the revised policy and update the “Last updated” date above. If a change is material, we will provide a prominent notice on the website and, when the change materially affects an existing account or service relationship for which we have a current email address, we will also send notice to that address. The notice will describe when the updated policy takes effect.