Privacy policy.

Who we are

Virling (virling.com) is open-source revenue attribution software, run by Stacklance Infotech LLP ("we"), Surat, Gujarat, India. We are the operator and the data controller for the data this policy describes about our website, sign-ins and accounts, and pre-orders. For visitor data that the script collects on a customer's site, the site owner is the controller and we process it on their behalf. You can reach us at hello@virling.com. Security problems go to security@virling.com.

This policy covers this website and the docs, the hosted Virling app at beta.virling.com (a beta open to everyone, with sign-in by email) with its API and MCP server, and the data that sites using the Virling script send to it.

If you self-host Virling, none of your data comes to us. A self-hosted server makes no connection to us: no telemetry, no update check and no license check. Visitor events, payments and accounts stay in the data folder on your server, and you decide what to keep. This policy does not cover your install.

The short version

• The script stores no IP address and no full user agent.
• It sets one first-party cookie, virling_vid, with a random ID. Cookieless mode sets none.
• Payment keys are read-only wherever the provider allows it, and are stored encrypted.
• The MCP server is read-only.
• AI answers send only a buyer question to an AI provider, never visitor or customer data.
• We do not sell personal data.

Visitors of a site that uses Virling

A site owner adds the Virling script to their pages. When you visit that site, the script sends events to the Virling server the owner chose. For a hosted site, that server is ours. The site owner decides why the data is collected, and on the hosted app we handle it on their behalf.

What the script reads in your browser:

• The page address and the referrer address
• A visitor ID from the virling_vid cookie, or none in cookieless mode
• Your screen width, used to tell phone, tablet and desktop apart
• Your browser language and time zone
• Whether the page was loaded fresh, reloaded or reached with Back
• Whether the browser says it is automated
• Goals the site owner sends on purpose, and the address of outbound links you click
• A ping every 30 seconds while the tab is visible, and a note when you leave, for the live view

It does not read what you type, form fields or page content. Its source is public: assets/v.src.js.

What the server stores for each event: the time, the page path without its query string, the referrer host, UTM tags from the address, the traffic channel, country, device type, browser name, operating system, language, the site host, your visitor ID and a session ID. For a goal, the goal name. For an outbound click, the destination host and path without its query string. Region and city are stored too when the network in front of the server provides them, as Cloudflare can. Pings are used for the live view and are not stored.

IP address and user agent. Your IP address reaches the server with every request. It is used in memory to rate limit requests and, in cookieless mode, to build the visitor ID. It is not stored. The user agent is reduced to a browser name, an operating system and a device type, and the full string is not stored. Country, region and city come from the network that handled your request, which works them out from your IP address.

Bots. Events from user agents that look automated (empty, or containing words such as bot, crawler, headless or curl) are dropped. Events from browsers that report automation, or report no screen or no languages, are kept in a separate table, are not counted as visitors and are not shown in reports. Known referrer spam domains are dropped. AI crawlers that run the script are counted as crawler hits, with the page and crawler name, never as visitors.

The cookie. virling_vid holds a random ID that is not derived from you. It lasts one year, is first-party, uses path / and SameSite=Lax, and is marked Secure on https. It is set on the site's main domain, so its subdomains share one ID. The site's own code can read it on purpose, so the owner can pass it into checkout and link a payment to a visit. The script also adds the ID to Stripe, Polar and Dodo Payments payment links on the page.

Cookieless mode. A site owner can turn it on. The script then sets and reads no cookie, and the server builds an ID from a hash of the site, your IP address and your user agent with a random salt. The salt is kept only in memory, changes every day at midnight UTC and on a restart, and the old one is never stored. The same hash is used for any event that arrives without a valid visitor ID.

Global Privacy Control. If the site owner adds data-respect-gpc to the script tag, the script sends nothing when your browser has Global Privacy Control on. virling.com does this. The script does not read the older Do Not Track setting.

Names and animal faces. The dashboard shows visitors as generated names with an animal face, such as Amber Fox, so lists never show a real name or email. The name comes from the order in which a visitor was first seen and is not based on anything about you.

This website

virling.com and docs.virling.com use the Virling script to count visits, with the same data and cookie described above, and with Global Privacy Control respected. Pages are served through Cloudflare, which handles your IP address to deliver them and may log requests under its own policy. The beta sign-up is the sign-in form of the hosted app, described below.

Earlier waitlist. The site no longer has a waitlist form. People who joined it earlier have a record with their email, the plan they chose, the page they came from, the visitor ID that links it to their visit, and the time. If they also answered the optional second step, it holds their site address and three multiple-choice answers: payment provider, revenue range and who the analytics is for. We use it to email people about the beta. The confirmation email was sent from hello@virling.com through Resend and has a leave link that deletes the record.

Founding pre-orders. Checkout runs on Dodo Payments, which collects your payment details and handles the payment. We never see your card number. We send Dodo your email if you gave it, your visitor ID and the page you ordered from. We receive your email and name, the payment ID, the amount and your visitor ID, and keep them to hold your founding spot and to send you a welcome email through Resend. Refunds and cancellation are covered on the refund and cancellation page.

Payment data from your provider

To join payments to visits, an account owner connects a payment provider. Virling then reads from the provider once a minute, and imports the last 90 days on the first sync.

• Stripe: a restricted key that can read charges, Checkout Sessions, customers, events, invoices, subscriptions and payment intents. Secret keys (sk_) are refused.
• Dodo Payments: a key that only reads payments, refunds and subscriptions.
• Polar: an organization token with orders:read and refunds:read, plus subscriptions:read for retention.
• LemonSqueezy: its API keys cannot be made read-only and cover every store on the account. Virling reads orders and subscription invoices, and adds a webhook to each store so payments link to visits.

What is stored per payment: the provider's payment ID, time, amount and currency, the refunded amount, status, the provider's customer ID, whether it is a renewal, and the visitor ID if checkout carried one. For subscriptions: the subscription ID, status, end date, price and billing interval. Virling does not store customer names, customer emails or card details from your provider. Amounts are also converted to USD using European Central Bank exchange rates.

Keys are encrypted with AES-256-GCM before they are stored, are shown only by their last characters, and are never logged. Disconnect deletes the stored key and stops syncing. Payments already imported stay in your reports. To end Virling's access fully, also delete or roll the key at your provider.

Accounts and sign-in

An account is an email address. There are no passwords. To sign in, you enter your email and we send a link that works once and expires in 15 minutes. Links and sessions are stored as hashes. Signing in sets a virling_session cookie, which is HttpOnly and SameSite=Lax, lasts 30 days, and ends when you sign out. At most five links are sent per hour to one email address, and at most 20 per hour from one IP address. For each link we store a hash of the link, your email address, the time it was requested, when it expires, when it was used, and the IP address it was requested from, which is used to enforce those limits. These records are kept while the account exists and are deleted with the account on request.

Sign-in check. The sign-in form at beta.virling.com uses a Cloudflare Turnstile check. Your browser loads a script from challenges.cloudflare.com, the check shows something only when a challenge is needed, and Cloudflare sees your request and IP address when the check runs. (Self-hosted servers have the check off unless their owner turns it on.) We send Cloudflare the check result and your IP address to confirm it, and without a confirmed check no link is sent. Cloudflare handles that under its own policy.

Sign-in emails, invites and reports from the hosted app are sent through Resend over SMTP.

If you invite a team member, we store their email and send them an invite link that expires in 7 days. Weekly reports go to the recipients you list, by default your own email, and we store those addresses. An owner can also turn on a public, read-only report link for a site, and turn it off again.

AI answers

The AI answers feature asks a list of buyer questions to ChatGPT, Claude, Perplexity and Gemini with web search on, once a week and when the owner presses Run now. The questions are written from the site's homepage title, top landing pages and search keywords, and the owner can edit them.

What is sent to a provider is the question text. No visitor data, payment data, email or account detail is sent. The providers are OpenAI, Anthropic, Perplexity and Google. On the hosted app we use our own keys. We store each answer, cut to 4,000 characters, with whether it names your site and which of your pages it cites. A provider handles the question under its own terms.

Separately, the server counts visits by AI assistants that read a page to answer someone (ChatGPT-User, Claude-User, Perplexity-User) when the owner adds the server snippet. That records the page and the assistant's name only.

MCP server and OAuth access

The MCP server lets an AI assistant such as Claude or ChatGPT read your Virling reports. It is read-only and cannot change data. You connect an app by signing in to Virling and choosing Allow, or by using an API key you created. Only the account owner can connect an app.

• There is one scope, read. Access tokens last 1 hour. Refresh tokens last 30 days and rotate on every use.
• Tokens, codes and API keys are stored as hashes.
• We store the connected app's name and redirect addresses. Connected apps and API keys are listed in Account settings, where you can revoke them.
• Tokens work only on the MCP endpoint, not on the rest of the API.

What an assistant can read: the sites on your account and their reports: visitors, channels, pages, revenue and payments, retention, AI answers, and one visitor's timeline by visitor ID. This can include visitor IDs and provider customer IDs. Once an assistant has it, that assistant's company handles it under its own privacy policy, which we do not control. Connect an app only if you are comfortable with that.

Who else handles data

• Cloudflare: runs the marketing site virling.com and the pages that lead to sign-up (Workers, D1 database and KV storage) and its network, which sees request IP addresses in order to deliver pages. Its Turnstile check runs on the sign-in form as described above.
• Resend: sends the waitlist and founding-customer emails from virling.com, and the sign-in, invite and report emails of the hosted app. It receives the recipient's email and the message.
• Dodo Payments: handles billing and runs founding pre-order checkout.
• Your payment provider (Stripe, Dodo Payments, Polar or LemonSqueezy): we call its API with the key you gave us.
• OpenAI, Anthropic, Perplexity and Google: receive buyer questions for AI answers, as described above.
• Oracle Cloud Infrastructure: hosts the hosted app at beta.virling.com, including its databases, in the Mumbai, India region (ap-mumbai-1).

We do not run advertising or third-party analytics on our pages, and we do not sell personal data.

Where data is processed. Data of the hosted app is stored and processed in India, on Oracle Cloud Infrastructure in Mumbai, and by the providers above, which may process it in other countries. If you self-host, your data stays on your own server.

How long we keep data, and deleting it

Events and imported payments are kept until they are deleted. There is no automatic expiry and no retention setting yet. Sign-in links expire after 15 minutes and invites after 7 days, but their records are kept while the account exists.

You can do these yourself: disconnect a payment provider, remove an AI provider key, remove a team member or an invite, revoke an API key or a connected app, turn off a public report link, and remove an earlier waitlist record with the leave link in any email we sent you.

There is no button yet to delete a site, an account or one visitor's events. Email hello@virling.com and we will delete a site, a visitor, an account, a founding pre-order record or an earlier waitlist record within 30 days. For an account, write from the address on the account. For a visitor, tell us the site and, if you can, the visitor ID. You can also ask us what we hold about you. To remove the cookie, clear it in your browser.

Cookies

• virling_vid: the visitor ID described above. One year. Not set in cookieless mode, or when Global Privacy Control is on and the site respects it.
• virling_session: keeps you signed in to the hosted app. 30 days. Set only when you sign in.

Dodo Payments may set its own cookies on its checkout page. We set no advertising cookies.

Children

Virling is a tool for site owners and is not directed at children. We do not knowingly collect data from anyone under 16 for our own purposes. If you think a child has signed in, email us.

Changes

When this policy changes, we change the date at the top of this page. The history is public in the GitHub repository.

Contact

Questions, requests or complaints: hello@virling.com. Stacklance Infotech LLP, Surat, Gujarat, India, operator of Virling. The rules for using the service are in the terms of service.