How Virra Handles Your Data

1. Who This Policy Covers

This policy applies to:

• Visitors to virra.com and its subdomains, including the Artist Pages we host for artists and the dashboards we provide to clients.
• Artists, managers, and labels who contact us, use the chat assistant, submit a song, book a call, or buy a service.
• Fans and other people whose information we handle while running a page, form, or campaign for a client.
• Clients and their staff.

When we run a page, form, or campaign for a client, the client decides why that information is collected and how it is used, and we process it on the client's instructions under our agreement with them. The client's own privacy notice also applies, and we may pass a request about that information to the client. On our own pages, Virra makes those decisions, and this policy describes them.

2. Information We Collect

We collect information you provide, information generated when you use our sites, and information from providers that help us operate marketing and client services.

Information you provide

• Contact details, including name, email address, mobile number, and communication preferences.
• Artist, project, application, booking, campaign, and support information you submit, and the answers you give about your goals, budget, role, and release timing.
• Public artist profile information you ask us to retrieve from Spotify, such as artist name, profile URL, image, follower count, popularity, genres, and related metadata.
• Communications with Virra, including email, SMS, calls, forms, and support messages.
• Messages sent to Virra's AI assistant, its replies, safety flags, and any details you choose to provide in that conversation.

Payments

Stripe, our payment processor, handles card information. Virra receives payment status, customer identifiers, billing metadata, invoices, and transaction records. Our pages never see or store full card numbers.

Website and campaign data

We may collect IP address, browser and device information, approximate location, pages viewed, buttons clicked, form activity, referral source, timestamps, performance measurements, cookies, local storage, UTM parameters, advertising click identifiers, campaign IDs, and similar attribution data.

Pixels and audience measurement

Our pages use cookies, pixels, server-side events, analytics, advertising, and identity-resolution tools. These services may process browser identifiers, hashed contact information, IP address, user agent, page URL, event timestamps, and advertising identifiers to measure campaigns, improve relevance, prevent fraud, and support retargeting. Section 3 lists the ones that run on virra.com and where.

Audience and identity data in client work

When a client asks us to measure visitors to the client's own site or to build advertising audiences for the client's campaign, we may process profile and contact information from licensed, public, or client-provided databases, behavioral signals such as site visits and content engagement, and segmentation attributes used for targeting and reporting. The client is responsible for the notices and consent its own properties require, and our agreement with the client governs that work.

3. What Runs on virra.com Today

These are the technologies on virra.com today, where each one runs, and what each one does. virra.com shows no consent prompt, so this list is the disclosure. Section 6 explains your choices.

• Cloudflare hosts the site and runs on every page. Cloudflare Web Analytics counts page views and measures loading performance for us. It sets no cookies, stores nothing on your device, and cannot follow you to other websites. Cloudflare's bot-detection script also runs on every page and may set a security cookie that tells browsers apart from automated traffic. As our host, Cloudflare sees the IP address of every request, and our videos and images are served from our Cloudflare account.
• The chat assistant runs on the home page and the song submission page. When you type, your messages, the page address, and your browser's time zone go to our server. The assistant keeps a random session id and token in your browser's session storage, which your browser clears when the tab closes. Our server stores the transcript and a salted hash of your IP address, not the address itself. An AI provider classifies each message and, when needed, drafts an internal summary; Virra writes the reply script. A lead summary goes to our CRM and to our team's notification channel. Do not send secrets, payment-card details, or information you do not want processed in this way.
• The song submission form at virra.com/review/ sends your name, email, phone, artist and song links, your answers, and the consent you give to our server, together with the page you came from, campaign parameters in the link, and your browser's language, time zone, and user agent. Our server also records your IP address. We then create or update your record in our CRM and, if you book a call, the appointment.
• ActiveProspect TrustedForm runs on the song submission page and on the Fan Signal application page at virra.com/fans/. It loads with the page, before you type anything, and records how the page and its form are used, including mouse movement, typing in the form fields, and a snapshot of the page. When you submit, it issues a certificate of the consent language you saw and accepted. We keep the certificate reference with your submission as evidence of that consent. ActiveProspect's own privacy policy covers its handling of the recording.
• Virra's Meta pixel runs on the Fan Signal application page and its payment success page. It loads with the page and sets Meta's _fbp cookie, and when you arrive from a Meta ad our page stores the ad click id in a _fbc cookie for 90 days. It reports a page view and, after you submit the application, a lead event, a checkout-started event, and a purchase event. When you submit the application, the pixel sends your email address, phone number, and first name to Meta in hashed form, and our server sends the same events to Meta's Conversions API with your IP address, user agent, the hashed identifiers, and a random lead id, so that Meta can match and deduplicate them. We use this to measure our own advertising and to build advertising audiences on Meta. Meta's privacy policy governs what Meta does with it.
• A visitor-identification pixel runs on every page of virra.com, including this one, the home page, the song submission page, the Fan Signal pages, and the artist-manager playbook at virra.com/playbook/. It sends the page address, your browser and device details, and identifiers it keeps in your browser's local storage to a third-party data provider, which attempts to match the visit to a person-level record and returns marketing attributes to us. We use it to measure campaigns and to build advertising audiences.
• Fan Signal page measurement is our own script on the Fan Signal pages. It records how fast the page loaded, your device type, screen size, and connection type, the campaign parameters in the link, the site you arrived from, and which version of the page you saw, and sends them to our database with a random page-view id and a random lead id that it keeps in your browser's local storage. The lead id connects your application to your checkout and payment; the rest tells us whether the page is fast and which version works. The page also keeps your Spotify artist pick and the version you were shown in local storage so that a reload keeps your place.
• Playbook reading measurement is our own script on the artist-manager playbook. It measures how far down the page you scroll and how long you actively spend reading, together with the campaign parameters in the link you followed, the website you arrived from, your screen size, and your time zone, and it stores one identifier in your browser so that a repeat visit is not counted as a new reader. It goes to our own database and is not shared with the data provider above. If you opened the playbook from a text message we sent you, the link may carry your contact reference so that we know you read it, and we may report a thorough read back to Meta as a server-side event matched through your CRM record.
• Google Fonts supplies the typefaces on the Fan Signal application page, its demo page, and the playbook. Google's servers receive your IP address and browser details when those pages load. The home page, this page, and the song submission page serve their fonts from our own site.
• Stripe loads on the Fan Signal application page when you reach the payment step. Its script may set Stripe's fraud-prevention cookies, and your card details go to Stripe directly.
• Spotify is queried by our server when you paste an artist link or type an artist name, and we store the public profile information that comes back.
• Our CRM receives the contact details, answers, bookings, and page details described above and sends our emails, texts, and call reminders.

Campaigns we run for clients also use the advertising platforms' own pixels and server-side events inside accounts those clients control.

4. How We Use Information

• Operate pages, forms, applications, bookings, checkout, fan capture, and client services, and connect an application to its payment.
• Respond to inquiries and send requested email, SMS, operational, or marketing communications where permitted.
• Decide, from the answers you give about your project, listener count, and budget, whether to offer a strategy call.
• Measure page performance, campaign attribution, conversion events, and advertising effectiveness, and build advertising audiences.
• Personalize experiences, improve campaigns, test page variations, and create aggregate reporting.
• Prevent abuse, secure our systems, debug errors, enforce terms, and comply with law.
• Generate AI-assistant replies, route conversations, prepare internal lead summaries, and review aggregate conversation patterns under human controls.

5. How We Share Information

We share information as needed with hosting and database providers, AI-processing providers used to operate the chat assistant, payment processors, advertising and analytics platforms, audience-measurement and identity-resolution services, CRM and communication tools, booking systems, professional advisers, clients whose page you intentionally use, and legal authorities when required.

When a client asks, we deliver audiences, leads, or conversion events to the client's own advertising accounts, CRM, or marketing tools.

If Virra is involved in a merger, acquisition, financing, or sale of assets, information may be transferred to the successor, who will be bound by this policy until it is changed under section 12.

We do not sell personal information in exchange for money. Our use of the visitor-identification pixel across virra.com, and of the Meta pixel on the Fan Signal pages, may count as a sale, sharing, or targeted advertising under some state privacy laws. Section 6 explains how to opt out, and we honor that opt-out whether or not a particular law requires it.

6. Cookies and Your Choices

Cookies and browser storage on virra.com fall into three groups.

• Essential: Cloudflare's security cookie, the chat assistant's session token, and Stripe's checkout cookies. Pages need these to work and to reject forged or duplicate requests.
• Measurement: Cloudflare Web Analytics, which sets nothing, and our own page and reading measurements, which keep random identifiers in local storage.
• Advertising and identification: the visitor-identification pixel's local-storage identifiers on every page, and the Meta pixel's cookies on the Fan Signal pages.

virra.com shows no consent prompt and does not respond to Do Not Track or Global Privacy Control browser signals.

On supported Artist Pages, United States visitors can use the persistent Do not sell or share my personal information control to opt out. Where prior consent is required, including outside the United States or when location is unknown, nonessential tools remain off unless the visitor allows them.

On Artist Pages, we honor supported Global Privacy Control signals. Artist Page visitors can reopen privacy choices and request deletion of the current Virra session's activity. This cannot recall information already delivered to another provider or remove anonymous aggregate statistics.

To opt out of advertising and identification on virra.com, email hello@virra.com with the subject "Privacy Request" and say that you want to opt out. We will ask the data provider to suppress your record, remove you from the advertising audiences we build, and stop using your record for advertising, no later than 15 business days after your request. You can also block third-party cookies and clear local storage in your browser, and manage how Meta uses data it receives from businesses in your Meta ad settings.

7. Email, SMS, and Calls

If you submit contact information, Virra and the identified artist or client may use it for the purpose described beside the form. Email recipients can use available unsubscribe links. For recurring automated promotional texts, we request express consent; consent is not a condition of purchase, message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help.

8. Your Rights

Depending on where you live, you may request access to, correction of, deletion of, or a portable copy of your personal information, ask us to restrict or object to certain processing, withdraw consent you gave earlier, and opt out of sale, sharing, targeted advertising, or profiling. Email hello@virra.com with the subject "Privacy Request". We may need to verify your identity, or the authority of an agent acting for you, before we act.

We answer within 45 days. If a request is complex we may take up to 45 more days and will tell you why. If we decline all or part of a request, we will tell you why, and you can appeal by replying to our answer. We will decide the appeal within 45 days and, if you still disagree, tell you how to contact your state's attorney general. We will not deny you services, charge a different price, or provide a different level of service because you exercised a privacy right.

9. Legal Bases, Retention, and Security

Where required, Virra relies on consent, contract performance, legitimate interests, legal obligations, and protection of rights and security.

We keep information for as long as we need it for the purpose we collected it and then delete or anonymize it. In practice today: chat transcripts are kept in our database indefinitely, so that a conversation can be looked up later by the person who had it or by the team answering it; applications, bookings, and lead records are kept while we may still work together and afterwards for our billing, tax, and dispute records; page and reading measurements are kept as collected until we aggregate or delete them; TrustedForm certificates are kept by ActiveProspect under its retention terms; and AI providers may retain API inputs and outputs for a limited period under their service terms. We are putting fixed deletion periods in place and will publish them here when they are in force. A verified deletion request shortens all of these: ask through section 8 and we delete what we hold.

Every page is served over an encrypted connection, and our hosting and database providers encrypt stored data at rest. Staff reach only the systems they need, and our internal dashboards require a second sign-in factor. If a security breach affects your information, we will notify you and the authorities as the law requires. No online system can be guaranteed completely secure.

10. AI and Automated Steps

The chat assistant uses an AI provider to classify what you write and to draft internal summaries. Virra writes the reply script, and under the terms of the API we use, the provider does not train its models on these messages. The chat assistant and the song submission form decide, from your answers about your project, listener count, and budget, whether to offer you a strategy call. Those are the only automated decisions on our pages, they have no legal or similarly significant effect, and you can ask for a person at any time by emailing hello@virra.com.

11. Children, International Visitors, and Links

Virra's sites and services are not directed to people under 18, and we do not knowingly collect their personal information. If you believe we have, email us and we will delete it.

Information may be processed in the United States and other countries where our providers operate. Where a provider offers standard contractual clauses or an equivalent transfer mechanism, we rely on them.

Our pages link to other sites, such as Spotify and Meta. Their privacy policies, not this one, govern what they collect.

12. Changes and Contact

We may update this policy and will revise the effective and last-reviewed dates when we do. If a change is material, we will say so on this page. Earlier versions are available on request. For questions, requests, or opt-outs, contact hello@virra.com. Virra Marketing, Inc. is a Colorado corporation, Parker, Colorado 80138.