Privacy Policy

1. Scope and roles

This policy applies to the Viresto website, application, and services. Aqua Tech acts as controller for account, communications, security, and billing data. For client, case, and document data entered by a law office, the office determines the processing purposes and Aqua Tech generally acts as its processor to provide the service.

Each office is responsible for having an appropriate legal basis to add client and case-party data and for providing any notices required by law.

2. Data we process

• Account and office data, including names, office name, email, phone number, role, and permissions.
• Operational content entered by users, including clients, cases, appointments, tasks, documents, invoices, payments, and notes.
• Security and technical data, including IP address, browser and device details, sessions, sign-in records, activity logs, and access attempts.
• Subscription, billing, and payment-request data. Viresto does not store complete payment-card details.
• Content sent to an AI provider only when the office has enabled consent and requests a feature that uses it.

3. Purposes and legal bases

Depending on the context, processing relies on performance of a contract, prior consent, a legal obligation, or legitimate interests that do not override data-subject rights, as permitted by applicable law.

• Creating accounts, performing the service agreement, and operating Viresto features.
• Protecting accounts, preventing misuse, auditing activity, and responding to incidents.
• Managing subscriptions, support, operational communications, verification, and recovery emails.
• Complying with legal obligations and binding lawful requests.
• Improving reliability and performance using limited operational data and data-minimisation practices.

4. Service providers and transfers

We use technical providers for hosting, databases, file storage, email delivery, and rate limiting. These may include Vercel, Neon, Cloudinary, Resend, Upstash, and an AI provider when the feature is enabled.

We do not sell personal data. We disclose it only as needed to provide the service, with suitable consent, or to comply with a binding legal request. Processing or hosting may occur outside Jordan under appropriate contractual and technical safeguards and applicable legal requirements.

5. Retention and deletion

Account data and office content are retained while the account is active and as needed to provide the service and meet legal obligations. Operational activity logs are normally retained for 30 days and security logs for up to 365 days unless an incident or legal duty requires longer retention.

When an account is closed, data is deleted, concealed, or returned according to its nature, third-party rights, backup cycles, and mandatory retention requirements. Restricted backups may remain for a limited period before rotation.

6. Data-subject rights

Requests may be sent to the address below. We may request appropriate information to verify identity and authority, particularly where the request concerns data controlled by a law office inside its account.

• To know whether data is held, access it, and obtain a copy.
• To request correction, updating, or restriction of processing.
• To request erasure or concealment where the law permits.
• To withdraw consent and object to unnecessary processing or profiling.
• To submit a complaint to the competent personal-data authority.

7. Security

We use technical and organisational controls including encrypted transport, encryption for selected sensitive fields, tenant isolation, role-based permissions, two-factor authentication, session protection, audit logs, file-type validation, and restricted access to private documents. No system can guarantee absolute security, so controls are reviewed and updated regularly.

8. Changes and contact

We may update this policy when the service or legal requirements change. The effective date appears above, and material changes will receive appropriate notice. Privacy questions and rights requests can be sent to the official contact address below.