Privacy Policy

1. Introduction

Welcome to Viato (“we,” “us,” or “our”). We are committed to protecting your privacy and the confidentiality of your data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

Viato is a customer relationship management (CRM) platform purpose-built for mortgage professionals. We provide loan officers and mortgage teams with tools for contact management, pipeline tracking, task management, email and phone communications, calendar scheduling, marketing campaigns, automation workflows, and more.

2. Your Data Belongs to You

We want to be absolutely clear: Your data is your property. We do not, and will never:

• Sell your data to third parties
• Share your data with other users without your explicit permission
• Use your data for purposes outside the core functionality of our platform
• Mine your data for marketing purposes
• Transfer your data to competitors or other businesses
• Use your client information for our own business purposes

Your data is used solely to provide you with the services and features you've subscribed to, and nothing more. You maintain full ownership and control over all information you upload to our platform.

3. Information We Collect

We collect various types of information to provide and improve our services:

3.1 Account Information

• Name and email address
• Professional credentials (NMLS number, license information)
• Company name and contact information
• Professional headshot and logo
• Role designation (loan officer, admin, team member)

3.2 Client and Business Data (Feature-Specific)

Depending on which features you use, you may upload or generate:

3.3 Usage and Analytics Data

• Feature usage patterns and engagement
• Email opens and clicks (for marketing emails you send)
• Report and export activity
• Team collaboration and activity tracking

3.4 Technical Data

• IP address and browser type
• Device information and operating system
• Log data and error reports
• Cookies and similar tracking technologies

4. How We Use Your Information

We use the information we collect exclusively to provide and improve our services:

• To provide you access to our tools and features
• To process and store your data securely
• To enable collaboration with your team members
• To generate reports, exports, and other outputs you request
• To facilitate integrations with third-party services you choose to connect
• To provide customer support and respond to your inquiries
• To send you service-related notifications and updates
• To improve our platform and develop new features
• To ensure platform security and prevent fraud
• To comply with legal obligations

We do NOT use your data for advertising, marketing to others, or any purpose unrelated to providing you with our services.

5. Data Storage and Security

We take the security of your data seriously and implement industry-standard measures to protect it:

• Data is stored in Supabase (PostgreSQL database) with encryption at rest
• All data transmission is encrypted using SSL/TLS protocols
• Authentication is handled by Clerk with support for multi-factor authentication
• Role-based access controls ensure users can only access their own data
• Regular security audits and monitoring
• Secure file storage with signed URLs
• API endpoints are protected with authentication middleware
• Sensitive credentials (e.g., phone system keys) are encrypted before storage

While we implement robust security measures, no system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

6. Third-Party Services and Integrations

Our platform integrates with various third-party services to provide functionality. These services may receive limited data necessary for their operation:

When you use features that rely on these services, only the minimum necessary data is shared to enable the functionality. We carefully vet all third-party services for security and privacy compliance. Each service has its own privacy policy governing how they handle data.

We never share your client data with third parties for their own marketing or business purposes.

7. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We only share your data in the following limited circumstances:

7.1 With Your Team Members

If you use our team collaboration features, data may be shared with team members within your organization. This sharing is managed by your organization's admin and is entirely under your control.

7.2 Service Providers

We share limited data with service providers who help us operate our platform (as listed in Section 6). These providers are bound by confidentiality agreements and are prohibited from using your data for any purpose other than providing services to us.

7.3 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such change and ensure the new entity honors this Privacy Policy.

8. Your Rights and Choices

You have full control over your data and the following rights:

• Access: You can access and download your data at any time through our platform
• Correction: You can update or correct your information directly in your account settings
• Deletion: You can delete your data or close your account at any time
• Export: You can export your data in standard formats (CSV, JSON, etc.)
• Opt-Out: You can opt out of non-essential communications and analytics tracking
• Portability: You can request a copy of your data in a machine-readable format

To exercise any of these rights, contact us at support@viato.app. We will respond to your request within 30 days.

9. Data Retention

We retain your data for as long as your account is active or as needed to provide you services. Specific retention policies:

• Account data: Retained while your account is active
• Client and contact data: Retained until you delete it or close your account
• Files and attachments: Retained until you delete them
• Analytics data: Aggregated and anonymized after 2 years
• Billing records: Retained for 7 years for tax and accounting purposes
• Support communications: Retained for 3 years

Upon account closure, your data is deleted within 30 days, except where we are required to retain it for legal or regulatory purposes.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for authentication and core functionality
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Help us understand how you use the platform

You can control cookie settings through your browser, but disabling cookies may limit functionality.

11. Children's Privacy

Our platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

12. International Data Transfers

Your data is stored in secure data centers located in the United States. If you access our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located. By using our services, you consent to this transfer.

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information (we don't sell your data)
• Right to request deletion of personal information
• Right to non-discrimination for exercising your rights

To exercise these rights, contact us at support@viato.app with “CCPA Request” in the subject line.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new policy on this page and updating the “Last Updated” date. Continued use of our services after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: support@viato.app