Virtuo Turing

GDPR overview

Implementation is concrete rather than declarative. A dated privacy policy, version 10-12-2025, names the controller in full — Virtuo Turing – Artificial Intelligence, Lda, Rua José Sarmento 27, Braga, corporate tax ID 518902013 — and cites its legal bases by article: Art. 6(1)(b), 6(1)(c) and 6(1)(f) GDPR for the payment and invoicing flow. Access, rectification, erasure, restriction, portability and objection are listed, and the Portuguese supervisory authority, the CNPD, is named. A zero-cookies policy means no consent banner exists, because no consent-requiring cookie is set. Transfers outside the EEA are acknowledged on Stripe's side under EU Standard Contractual Clauses. Gaps remain: no data protection officer is designated, no DPA is published, and no general subprocessor register exists beyond the two named payment providers. No Article 27 representative is named, and an EU-established company needs none.

Who owns the data?

Ownership stays with the customer, and the publisher's own footprint is deliberately small. Browsing the site collects nothing: no analytics, no profiling, no visitor database. The only trace is the host's minimal connection log, which Virtuo Turing states it never downloads, copies or turns into a local database. Inside the desktop products the position holds by construction — Maestro keeps its SQLite database, logs, screenshots and generated files on the customer's own machine, and its licence hands retention, deletion, backup, incident response and data-subject requests back to the user. PEN Translator adds that translated content is neither stored nor monetised.

Reuse rights

Customers may use the proprietary parts of each product for internal, personal, professional or business purposes under a limited, non-exclusive, non-transferable and revocable licence. Without written permission they may not resell, rent, sublicense, host as a service or redistribute the software as a competing standalone product, reverse engineer it, or strip its proprietary notices. Outputs are treated differently: JUSTINA returns a fully editable DOCX and states that the lawyer keeps full control of the text, and every system is presented as an auxiliary tool that complements qualified human review rather than replacing it. Third-party components keep their own licences, which prevail in any conflict, and nothing in the terms narrows a right granted by an open-source licence. Building malware, credential theft tools, unauthorised surveillance or scraping systems, spam systems or access-control circumvention is prohibited outright.

Data retention & training

Hosting summary

No hosting country or region is named anywhere on the site. The privacy policy refers only to the hosting provider's servers, without identifying the provider or its location, so nothing can be reported as a vendor commitment on that point. What the site does describe is a model that largely sidesteps the question: most modules run locally on the customer's own machine. Maestro keeps its SQLite database, configuration, logs, screenshots and generated documents on the workstation. Vox Late states that audio stays on the machine by design, with no account and no built-in telemetry. Ariadne uses a files folder beside its executable as the intake point and exposes its input, output, storage and database paths. The only documented remote processing sits outside the products themselves: OpenAI for the assisted modes, under the customer's own API key, and the licensing flow handled by Stripe Payments Europe in Dublin and InvoiceXpress in Lisbon. InvoiceXpress stores billing data under Portuguese and EU law, while Stripe may transfer outside the EEA under EU Standard Contractual Clauses. The publisher states it keeps no local personal-data store in that flow.