Privacy Policy

California Notice at Collection and State Privacy Rights. See the State privacy rights notice section below for important information about your rights under applicable state privacy laws.

Virtus Professional Services LLC (“Virtus,” “we,” “us,” or “our”) provides a research library and workspace for United States federal tax primary sources. This Privacy Policy describes how we process personal information that we collect through our website, the Virtus research workspace, and the other online properties and activities that link to this Privacy Policy (together, the “Service”), including our communications with you and our marketing of the Service to professionals and firms.

For the content of a firm’s workspace, we act on behalf of that firm as its service provider, and the firm’s own policies and its agreement with us also apply. For account, billing, and website information, we decide how information is used as described here. This Privacy Policy is part of our Terms of Use. See also our Cookie Notice and, for customers, our Data Processing Addendum.

Information you provide to us

Personal information you may provide to us through the Service or otherwise includes:

• Contact data, such as your first and last name, work email address, professional title, and firm name.
• Profile data, such as your organization membership, role, license, authentication records, sign-in preferences, and active sign-in sessions. If a sign-in option such as Google, Microsoft, or company sign-in is enabled and you choose it, the sign-in flow supplies the identifiers needed to sign you in.
• Communications data based on our exchanges with you, including the contents of emails and support requests, and what you enter on the Book a demo page, which is emailed to our team so we can reply and is not stored in the product.
• Transactional data, such as seats, plan, order, invoice, tax, contract, and deletion-receipt information when those records apply to your organization.
• Payment data needed to complete transactions. Card details are collected and stored by our payment processor, not by us; we receive limited details such as the card brand and last four digits.
• User-generated content and input data, such as the research questions you ask, research folders you create, documents you save, and notes you add to your workspace, as well as associated metadata such as when an item was created. Raw research query text is not retained by default. If a workspace expressly approves and consents to retention, the maximum period is 30 days.
• Marketing data, such as your preferences for receiving our communications and details about your engagement with them.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

The Service is built for professional research and does not need your Social Security number, other government-issued identification numbers, tax return information, health information, or payment card numbers. Please do not enter them in questions, notes, or messages to us.

Highlights, notes, and downloads. Highlights and notes you add to a document are kept in your browser on that device. Annotated copies you download are created in your browser and are not sent to us.

Data about others. Workspace administrators add colleagues by email address. Please do not give us someone’s contact details unless you have the authority to do so.

Third-party sources

We may combine personal information we receive from you with personal information we obtain from other sources, such as:

• Your organization, when an administrator adds you to a workspace or provisions your account through company sign-in or directory sync.
• Sign-in providers, such as Google, Microsoft, or your company’s identity provider, which supply your name, email address, and sign-in identifiers when you choose that option.
• Service providers that help us operate the Service, such as our payment processor and email delivery provider.
• Public sources. The research library contains public documents published by government agencies, described in the next section.
• Business transaction partners. We may receive personal information in connection with an actual or prospective business transaction, such as from an entity we acquire or are acquired by.

Automatic data collection

We and our service providers may automatically log information about you, your device, and your interaction with the Service over time, such as:

• Device data, such as your browser type, device type (phone, tablet, or computer), language settings, your country as determined from your connection, and your IP address, which is processed to deliver the Service and to protect it, for example through rate limits, and is not stored in our site visit records.
• Online activity data, such as the page address of each page you view without any search terms or other query text, the domain of the website that referred you, and the times of your visits.
• Service records: operational, security, application, administrator, and audit events needed to run and protect the Service.
• Workspace usage for administrators: daily counts of searches, documents opened, and seats in use for a workspace. Those counts do not include the words you searched or any document text.

We do not collect precise geolocation data. For more information about automatic collection, see the next section.

The research library currently contains public IRS rulings. Virtus may add materials from other approved United States government sources in the future. Public source documents are separate from your account, workspace, and research activity. A question you ask or a research folder you create does not become part of a public source document. Government documents can contain names or other details that the publishing agency chose to release; we display them as published.

Cookies and other technologies. Some of our automatic data collection is facilitated by cookies and browser storage. Virtus uses a necessary sign-in cookie. It expires after 30 minutes and never lasts more than 12 hours; signing out ends it sooner. Short-lived cookies also protect a sign-in with Google, Microsoft, or company sign-in and a two-step verification check while it is in progress. Browser local storage remembers the theme, navigation rail, and document-view preferences. Some features also keep device-local research folders, update state, and document highlights there. Clearing site data in your browser resets those preferences and removes any data stored only on that device. Our Cookie Notice lists each cookie and storage item and how to control them.

Site visit counts. Site visits are counted without cookies or any identifier stored in your browser. To count unique visitors, we combine your IP address and browser details with a random value that changes every day and is then deleted, and keep only the resulting one-way code, so it cannot be used to identify you or to link your visits across days. Browsers that send Global Privacy Control are not counted. Your research query text is never included. Virtus counts site visits to understand how the site is used and improve its reliability. It does not use advertising or targeting cookies, sell your personal information, or track you across other websites. We do not use session-replay tools.

AI-assisted research features. If an AI-assisted or transcription feature is enabled, it may process the current request and retrieved public source evidence to produce a research aid. If another company helps deliver that feature, it processes the information for us under agreements that do not allow it to use your requests to train its AI. Processing of public source documents alone, which contain no information about you, may be kept by those companies for quality review. Generated answers, summaries, and transcribed text are not official source text and may contain errors.

For your choices about these technologies, see the Your choices section of this Privacy Policy and our Cookie Notice.

We may use your personal information for the following purposes or as otherwise described at the time of collection:

Service delivery and operations

• provide the Service, including search, document, folder, citation, and research-assistance features;
• authenticate users, enforce workspace roles and access, and enable security features of the Service;
• establish and maintain your user profile and workspace membership;
• communicate with you about the Service, including service announcements, updates, security alerts, billing messages, and support and administrative messages;
• manage applicable subscriptions, entitlements, and contracts; and
• provide support for the Service and respond to your requests, questions, and feedback.

Service improvement and analytics

We use information about how the Service is used, such as the visit counts and workspace usage counts described above, to understand which pages and features are used, keep the Service reliable, improve the Service, and develop new features. We do not use your workspace content, questions, or annotations to train AI.

Marketing

We may send you direct marketing communications about Virtus if you are a professional who has asked us for information or has requested a demo. You may opt out as described in the Your choices section. We do not use personal information for interest-based advertising and we do not allow advertising networks on our site.

Compliance and protection

• comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, investigations, or requests from government authorities;
• protect our, your, or others’ rights, privacy, safety, or property, including by making and defending legal claims;
• audit our internal processes for compliance with legal and contractual requirements or our internal policies;
• enforce the terms and conditions that govern the Service; and
• prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and identity theft.

Corporate events and aggregated data

We may share personal information in the context of actual or prospective corporate events, as described in How we share your personal information below. We may create aggregated, de-identified, or anonymized data, such as total counts of searches, by removing information that makes data identifiable to you. We will not attempt to re-identify that data. We do not build aggregated data from your workspace content, questions, or annotations.

Further uses. In some cases we may use your personal information for further uses, in which case we will ask for your consent if the new use is not compatible with the purpose for which the information was collected.

We generally retain personal information to fulfill the purposes for which we collected it, including to satisfy legal, accounting, or reporting requirements, to establish or defend legal claims, and to prevent fraud. To decide how long to keep it, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve them by other means, and applicable legal requirements. When we no longer need personal information, we may delete it, anonymize it, or isolate it from further processing. Our current standard periods, where a record type applies, are:

• Active and archived account and workspace data: for the account or contract life.
• Scheduled deletion: a 30-day soft-deletion period followed by a 7-day final hold before deletion from active systems.
• Account export artifacts: 7 days.
• Raw research query text: disabled by default; if expressly approved and consented to, no more than 30 days.
• Operational logs: 30 days.
• Site visit records, which contain no IP address: about 13 months.
• Application, security, and administrator audit records: 24 months.
• Transactional email outbox records: 30 days.
• Email delivery metadata: 90 days.
• Billing, tax, contract, and deletion receipts: 7 years.
• Rolling encrypted backups: 35 days.

We may keep information longer when the law requires it, to resolve disputes, or under a legal hold. Deletion is not instantaneous. Encrypted backup copies expire through the rolling backup cycle. If an external integration is enabled, its retention and deletion rules also apply; a deletion request does not promise immediate removal from every supporting company’s records.

We may share your personal information with the following parties, or as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection.

• Your organization. Authorized workspace administrators and members can access workspace information according to their assigned roles. Virtus does not make one customer’s research available to another customer.
• Service providers. Companies that help us provide hosting and security, sign-in, email delivery, customer support, and assisted research process information on our behalf, limited to what their task needs. A current list is available on request.
• Payment processors. Payment card information you use to make a purchase is collected and processed directly by our payment processor, which may use it under its own privacy policy.
• Third parties designated by you. Third parties where you have instructed us or provided your consent to do so.
• Linked third-party services. If you sign in with Google, Microsoft, or your company’s sign-in, we exchange the identifiers needed to sign you in with that provider, and its use of information is governed by its own privacy policy.
• Professional advisors. Lawyers, auditors, bankers, and insurers, in the course of the professional services they render to us.
• Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
• Business transferees. In connection with an actual or prospective financing, merger, acquisition, sale of assets or shares, or an insolvency or similar proceeding, we may disclose personal information to counterparties and their advisers, and transfer it to a successor, which will be bound by this Privacy Policy for that information.

We do not sell personal information for money or other valuable consideration, and we do not share it with third parties for cross-context behavioral or targeted advertising.

In this section we describe the rights and choices available to all users. Users who are located in certain U.S. states can find additional information about their rights in the State privacy rights notice below.

• Access or update your information. You can review and update certain account information by signing in to your account, and you can sign out to end the current session. Ask your workspace administrator to correct membership details or manage your workspace access.
• Opt out of communications. You may opt out of marketing emails by following the unsubscribe instructions in the email or by writing to hello@virtusprofessionalservices.com. If you opt out, you may still receive service-related messages, such as security alerts and billing notices.
• Cookies and other technologies. For information about the cookies and browser storage the Service uses and how to control them, see our Cookie Notice. You can clear browser site data to remove device-local preferences and records.
• Global Privacy Control and Do Not Track. If your browser sends Global Privacy Control, we honor it: your visits are not counted, and it is treated as a request to opt out of any sale or sharing of personal information. We do not respond to the older “Do Not Track” signal as such, because we do not track you across other websites in any case.
• Blocking images and clear GIFs. Most browsers and devices allow you to prevent images from loading. Follow the instructions in your browser or device settings.
• Requests about your information. To request access, correction, export, or deletion, contact your workspace administrator, or write to admin@virtusprofessionalservices.com. Requests are evaluated under applicable law, workspace authority, and contractual requirements.
• Declining to provide information. We need to collect certain personal information to provide the Service. If you do not provide the information we identify as required, we may not be able to provide it.
• Linked third-party platforms. If you sign in through a third-party provider, you may be able to use your settings with that provider to limit the information we receive. Revoking our access does not apply to information we have already received.

The Service links to official government websites and may contain links to other websites and online services operated by third parties. These links are not an endorsement of, or a representation that we are affiliated with, any third party. We do not control those sites or services and are not responsible for their actions. We encourage you to read the privacy policies of the other websites and services you use.

We employ technical, organizational, and physical safeguards designed to protect the personal information we collect, including authenticated sessions, role-based access, and encryption of information in transit. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information. Tell your workspace administrator, or write to admin@virtusprofessionalservices.com, if you suspect unauthorized access or find a security issue.

We are headquartered in the United States and the Service is operated from the United States for United States federal tax research. Information is processed in the United States and may be processed in other countries where the companies that help us operate do business, with safeguards required by applicable law. Your personal information may be transferred to or stored in locations where privacy laws are not as protective as those where you live.

Virtus is a service for professionals and businesses. The Service is not intended for use by anyone under 18 years of age, and it is not directed to children or to individuals acting in a personal capacity. If you are a parent or guardian and believe we have collected personal information from a child in a manner prohibited by law, please contact us. If we learn that we have collected personal information through the Service from a child without the consent required by law, we will comply with applicable legal requirements to delete it.

We may modify this Privacy Policy at any time. If we make material changes, we will notify you by updating the effective date shown above and posting the modified version on the Service, and we will notify workspace administrators of material changes. Changes are effective when posted unless we indicate otherwise at the time of posting. Your use of the Service after the effective date of a modified Privacy Policy indicates that you acknowledge it applies to your interactions with the Service and our business.

Except as otherwise provided, this section applies to residents of U.S. states to the extent they have privacy laws applicable to us that grant their residents the rights described below (the “State Privacy Laws”). Not all rights listed below are afforded to all users, and if you are not a resident of a state with an applicable law, you may not be able to exercise these rights. We may not be able to process your request if you do not provide enough detail to let us confirm your identity or understand and respond to it. We confirm identity by matching your request to the email address on your account, by asking you to confirm the request from your signed-in account or by a reply to that address, and, where workspace content is involved, by involving your workspace administrator.

In this section, “Personal Information” has the meaning given to “personal data,” “personal information,” or similar terms in the State Privacy Laws, and “Sensitive Personal Information” has the meaning given to “sensitive personal information,” “sensitive data,” or similar terms, except that neither includes information exempted from the State Privacy Laws. In some cases we may provide a different privacy notice to certain categories of residents, in which case that notice applies instead of this section.

Your privacy rights

The State Privacy Laws may provide residents with some or all of the rights below. These rights are not absolute, and we may decline a request in certain cases as permitted by law.

• Information. You can request the categories of Personal Information we have collected, the categories of sources, the business or commercial purpose for collecting it, the categories of third parties with which we share it, and the categories of Personal Information we disclosed for a business purpose and to whom.
• Access. You can request a copy of the Personal Information we have collected about you.
• Correction. You can ask us to correct inaccurate Personal Information we have collected about you.
• Deletion. You can ask us to delete the Personal Information we have collected from you.
• Appeal. You can appeal our denial of any request validly submitted by replying to our decision or writing to admin@virtusprofessionalservices.com.
• Opt-out. We do not process Personal Information for targeted advertising, we do not sell Personal Information within the meaning of the State Privacy Laws, and we do not use it for profiling or automated decision-making that results in legal or similarly significant effects. There is therefore nothing to opt out of, although you may ask us to confirm that.
• Consumers under 16. The Service is for professionals and is not directed to anyone under 18. We do not have actual knowledge that we collect, sell, or share the Personal Information of consumers under 16.
• Sensitive Personal Information. We do not intentionally collect or process Sensitive Personal Information, and we do not use it to infer characteristics about you.
• Nondiscrimination. You are entitled to exercise these rights free from discrimination as prohibited by the State Privacy Laws.

How to exercise your rights

You can submit requests by writing to admin@virtusprofessionalservices.com or through your workspace administrator. We respond within the time that applicable law requires, which is generally 45 days, and we may extend that period once where the law allows. We honor the Global Privacy Control signal as a valid request to opt out of the sale or sharing of Personal Information, as described in the Your choices section.

Verification of identity; authorized agents. We may need to verify your identity to process your request and reserve the right to confirm your state of residence. Under some State Privacy Laws you may enable an authorized agent to make a request on your behalf. We may need to verify the agent’s identity and authority, and may require a copy of a valid power of attorney or your signed written permission and your confirmation that you gave the agent permission to submit the request.

Our information practices

The following describes our practices currently and during the past 12 months.

• Sources and purposes. We collect the categories of Personal Information below from the sources and for the business purposes described above in this Privacy Policy.
• Retention. The criteria for deciding how long to keep Personal Information are described in the Retention section above.
• Deidentification. We do not attempt to re-identify deidentified information derived from Personal Information, except to test whether our deidentification processes comply with applicable law.

The table below summarizes the Personal Information we collect, the purposes for which we collect it, and the third parties to whom we may disclose it, by reference to both the categories described in the Personal information we collect section above and the categories of Personal Information specified in the California Consumer Privacy Act (Cal. Civ. Code § 1798.140). It describes our practices currently and during the 12 months before the effective date. Information you provide in free-form fields may contain other categories of Personal Information not described here.

Additional information for California residents

Shine the Light law. Under California Civil Code Section 1798.83, California residents who have formed a business relationship with a company primarily for personal, family, or household purposes may ask for the names of third parties to which it has disclosed certain personal information for their own direct marketing purposes during the preceding calendar year, and the categories disclosed. Virtus is offered to professionals for business use and we do not disclose personal information to third parties for their direct marketing. To make a request anyway, email admin@virtusprofessionalservices.com with the statement “Shine the Light Request,” your name and mailing address, and your certification that you are a California resident. We do not accept these requests by telephone or fax.

Additional information for Nevada residents

Nevada residents have the right to opt out of the sale of certain personal information for monetary consideration. We do not engage in such sales. If you are a Nevada resident and want to make a request about any future sales, email admin@virtusprofessionalservices.com.

Additional information for Michigan residents

• Privacy rights. We handle the Personal Information of Michigan residents under this Privacy Policy and the Michigan laws that apply to us. If a Michigan statute grants you privacy rights against us, we will honor them in the way this section describes for State Privacy Laws.
• Security breach notice. If we learn of a security breach that affects your Personal Information and that requires notice under the Michigan Identity Theft Protection Act (MCL 445.72), we will notify you in the way and within the time the law requires.
• Social Security numbers. The Service does not ask for Social Security numbers. If you send us one anyway, we will protect it as the Michigan Social Security Number Privacy Act (MCL 445.81 et seq.) requires and may ask you to remove it.

Direct privacy questions or requests through your workspace administrator.

If you have questions about our practices or want to exercise a privacy right that may be available to you, you can also write to Virtus Professional Services LLC. Send privacy and data requests to admin@virtusprofessionalservices.com. For everything else, use the address that matches your request:

General questions

hello@virtusprofessionalservices.com

Product help and account access

support@virtusprofessionalservices.com

Legal notices, arbitration notices, privacy and data requests, and security reports

admin@virtusprofessionalservices.com

Invoices, payments, billing disputes, and seat changes

billing@virtusprofessionalservices.com

Accounts receivable and remittance

ar@virtusprofessionalservices.com

This Privacy Policy is part of our Terms of Use. See also the Cookie Notice.

Adapted from the General Legal open-source legal templates (CC0 1.0).