Version 2026-10-28. What we collect, why, who helps us, where it goes, and your rights in the UK, US, Canada, Australia and New Zealand.
Virgo Command / Clove9 is based in the United Kingdom. We decide how and why your personal information is used, so in UK law we are the controller.
Contact: privacy@virgocommand.com. Address: Office 128, 18 Young Street, Unit LGE, Edinburgh EH2 4JB, United Kingdom. ICO registration: ZC260560. Our privacy officer can be reached at the same email address.
We do not sell your information, share it for advertising, or build advertising profiles. We do not use it to make decisions about you that have legal or similarly significant effects; your chief of staff prepares suggestions and you decide.
When you talk to your chief of staff, or it prepares a brief or a draft, the relevant part of your message and records is sent to an AI model provider to produce the reply. The providers process it on our instructions only, do not use it to train their models, and keep it only briefly, where needed to detect abuse. AI can make mistakes; please check anything important (see section 5 of our Terms).
If you connect Google, we ask Google only for:
We never write to your Google account: we do not create, change or delete events, contacts or files.
How it is used. Google data is used only to give you the features above, in your own account. It is processed by AI models only to answer you or to prepare something you asked for, such as your brief. The AI providers that may receive it are listed below. None of them may use it to train or improve their models, and we never use it to train any model ourselves.
Who receives it. Only the processors in section 5 that are needed to give you the feature: Amazon Web Services (storage in London, and Claude AI models through Amazon Bedrock), Anthropic (Claude AI models), Google (Gemini AI models) and OpenAI (which turns what you tell your chief of staff into search codes, so it can find the right memory later). We do not sell Google data, use it for advertising, or give it to data brokers, and we do not use it to decide credit or lending. People at Virgo Command do not read it unless you ask us to (for example in a support request), it is needed for security, or the law requires it.
How long we keep it. Calendar events and contacts we copy into your account stay until you delete them or delete your account. Disconnecting Google stops new copies; what was already copied stays until you delete it. We do not store copies of your Drive files. What your chief of staff says about a file stays in your conversation history like any other message, and anything you ask to save becomes a note or memory you can delete.
Stopping it. Disconnect Google on the Connections page at any time. We then ask Google to revoke our access and delete the stored sign-in tokens. You can also remove access at myaccount.google.com/permissions.
Google's rules. Virgo Command's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
| Provider | What they do | Where |
|---|---|---|
| Amazon Web Services | Hosting, storage and backups; the Claude AI models through Amazon Bedrock; the Polly voice | Storage and voice in London, UK. Bedrock AI processing in the European Union |
| Anthropic | Claude AI models | United States |
| Gemini AI models (a back-up model for your chief of staff and some background tasks such as remembering what you tell it); Google sign-in; Google Calendar, Contacts and the Drive files you pick, if you connect them | United States and other countries where Google operates | |
| OpenAI | Turns what you tell your chief of staff into search codes so the right memory can be found later. OpenAI does not use this to train its models | United States |
| Apple | Sign in with Apple, if you use it | United States |
| Stripe | Payments | United States, European Union and UK |
| Resend | Sending account emails | United States |
| Plausible | Counting website visits, with no cookies and no personal information | European Union |
Each works under a written agreement that limits what they may do with your information. If we add or change a provider that handles your information, we will update this list.
Your account and everything in it are stored in London, United Kingdom, wherever you live. Some processing happens elsewhere, as the table above shows: AI processing in the European Union and the United States, and email and payment processing in the United States.
When information leaves the UK we protect it as UK law requires: to the European Union under the UK's adequacy regulations, and to the United States under the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU US Data Privacy Framework where the provider is certified. If you live outside the UK, your information is sent to the UK and to the countries listed above; the country sections below explain what that means where you live.
We plan to offer storage in your own country as we grow. We will tell you before your information is moved, and this page will say so plainly.
If you connect your calendar or contacts, or record details about family and friends, we receive information about people who do not use Virgo Command. We use it only to provide the service to you: we do not contact them, profile them, or use it for our own purposes. If someone asks us what we hold about them, we will help.
Information travels encrypted (TLS) and is stored on encrypted disks. Your Security Vault and the keys for services you connect are additionally encrypted field by field. We hold the keys, because we must be able to run the service for you, so we could technically access stored information; we do so only where necessary to run, support or protect the service, or where the law requires. Access is limited to the people who need it.
Wherever you live, you can ask us to: give you a copy of your information; correct it; delete it; export it (you can also do this yourself in Settings); stop or restrict some uses; and withdraw any consent. You can object to uses based on legitimate interests. Email privacy@virgocommand.com. We may need to confirm it is you. We will not charge you or treat you differently for using your rights. We reply within the time your law allows, and usually much sooner.
We use one cookie, which keeps you signed in. We count website visits with Plausible, which uses no cookies and collects no personal information. We use no advertising cookies, tracking pixels or social media trackers. See our Cookie Policy.
Virgo Command is only for adults aged 18 and over, and we ask for your date of birth to check. If we learn that someone under 18 has an account, we close it and delete their information.
If a breach of security puts your information at risk, we will tell the regulators and you as quickly as the law in your country requires.
Your rights come from the UK GDPR and the Data Protection Act 2018. We reply to requests within one month. If you are unhappy, tell us first if you can; we acknowledge complaints within 30 days and usually within 5 working days. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
We give every US user the rights in section 10, whether or not your state's privacy law applies to a business our size. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive information to infer characteristics about you. Health information is collected only with your consent and shared only with the providers in section 5 to deliver the service; Washington and Nevada residents can ask us to confirm, access or delete it, and we reply within 45 days. If we refuse a request you can appeal by replying to our answer, and if you are still unhappy you can contact your state attorney general.
We handle your information under the Personal Information Protection and Electronic Documents Act. Your information is stored in the United Kingdom and processed in the countries in section 5, where the law may allow authorities there to access it. We reply to access requests within 30 days. You can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Virgo Command is not yet offered in Quebec.
We handle your information in line with the Australian Privacy Principles. Your information is disclosed overseas, to the United Kingdom where it is stored and to the European Union and the United States where our providers process it. We remain responsible for how they handle it. We do not use automated decisions that significantly affect you. You can ask to access or correct your information, and we reply within 30 days. You can complain to us and, if unresolved, to the Office of the Australian Information Commissioner at oaic.gov.au.
We handle your information under the Privacy Act 2020. Our providers act only on our behalf. When you add information about other people, we hold it only to provide the service to you. We reply to access and correction requests within 20 working days. You can complain to the Office of the Privacy Commissioner at privacy.org.nz.
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect, and ask you to accept it where the law requires. Earlier versions are available on request.