Privacy Policy
This policy describes what VERSO IQ actually does today: what it collects, why, where it is kept, who else processes it, and how to remove it. Where the product has a limit, this page says so.
- Who we are
- How VERSO IQ runs today
- What we collect
- Connected accounts
- AI processing
- Third-party services
- Storage and security
- Retention and deletion
- Cookies and tracking
- Sharing and sale
- Changes
- Contact
1. Who we are
VERSO IQ is a business-audit product made by VERSO (versolab.ai). "We" means VERSO. For any privacy question or deletion request, write to contact@versolab.ai.
2. How VERSO IQ runs today
VERSO IQ is in private preview. It is not open for public sign-up. The application and its database run on a computer operated by VERSO, not on a public cloud service. It is used by VERSO and by businesses VERSO invites. There is no password sign-in yet. Each browser that opens VERSO IQ gets its own workspace, identified by a random cookie (see section 9), and every audit and connection belongs to that workspace.
3. What we collect
Information you give us
- Workspace details. An optional name and email address you enter in Settings. VERSO IQ does not send email to that address.
- Audit inputs. The business name, your goals, your answers to audit questions, and the evidence you add:
- web addresses (VERSO IQ fetches those public pages and stores their text);
- uploaded files (PDF, image, text, CSV, and JSON; up to 10 MB each);
- pasted text.
- Browser companion captures, if you use the optional Chrome companion. You choose which pages it captures. For each page it records:
- the title, description, headings, visible text, links, and image counts;
- text hidden in the page code, labeled as hidden.
- Your actions and notes on the action items a report suggests.
Information we create
- Audit reports and the processing log for each audit run. The log lists the sources processed, such as web addresses and account usernames.
- Usage records for each analysis: the AI model used, token counts, and the provider's request identifier.
4. Connected accounts
Connections are optional. You sign in on the platform's own page and approve access there. VERSO IQ never sees or stores your password. It receives an access token, which it stores encrypted (section 7). It then makes a real read to confirm the account before showing the connection as connected.
| Platform | Permissions requested | What VERSO IQ reads, and what it keeps |
|---|---|---|
| TikTok | user.info.basic, user.info.profile, user.info.stats, video.list | Your TikTok account's basic profile (ID, display name, avatar), username and verified status, totals (followers, following, likes, videos), and public video list (each video's title, date, duration, link, and view, like, comment, and share counts). Kept: the account ID, display name, granted permissions, and the result of the verification read. The video list is fetched when you ask for it and shown to you; it is not saved. |
| Instagram (professional accounts) | instagram_business_basic, instagram_business_manage_insights | Profile, media (including captions and links), and insights for the connected account. Kept with the audit it was collected for. |
| QuickBooks Online | com.intuit.quickbooks.accounting. Intuit has no read-only option, but VERSO IQ only ever reads. | The company name, plus profit-and-loss and balance-sheet reports you request. Kept: the company name and identifier. Reports are fetched on request and shown to you; they are not saved. |
| Gmail | gmail.metadata, openid, email | Message metadata only: sender, recipients, subject, dates, and labels, limited to labels you choose, at most 90 days and 500 messages. Never message bodies or attachments. Kept: your email address and the folder and date limits you set. Metadata is read on request and not saved. |
| Outlook / Microsoft 365 | Mail.ReadBasic, User.Read, openid, email, profile, offline_access | The same metadata limits as Gmail. Mail.ReadBasic excludes message bodies and attachments. |
VERSO IQ uses connected-account data only to show it to you and to produce your audits. It never posts, publishes, comments, follows, or sends messages, and it never changes data on any connected platform.
5. AI processing
VERSO IQ uses Anthropic's Claude models to analyze evidence and write audit reports. When you run an audit, VERSO IQ sends the following to Anthropic's API:
- the business name, your goals and answers;
- the text of your sources, including fetched pages, companion captures, and pasted text;
- uploaded PDFs and images;
- any Instagram data collected for that audit;
- for a follow-up audit, the previous findings.
Data from TikTok, QuickBooks, Gmail, and Outlook connections is not sent to the AI. Today it is only displayed to you. If that changes, this policy will be updated first.
Anthropic processes this data under its Commercial Terms of Service. VERSO IQ treats every source as evidence to review, never as instructions.
6. Third-party services
- Anthropic: AI analysis, as described above.
- TikTok, Meta (Instagram), Intuit (QuickBooks), Google, and Microsoft: only when you connect an account. Each receives the sign-in and the read requests needed for that connection.
- Public websites you name: VERSO IQ fetches those pages directly. It refuses private and local network addresses.
- Fly.io hosts this website and VERSO IQ's sign-in callback address (connect.versolab.ai). The callback only forwards your browser back to VERSO IQ; it records only the address path and response status, never sign-in codes.
7. Storage and security
- Access and refresh tokens, and the one-time values used during sign-in, are encrypted with AES-256-GCM before they are stored. One-time sign-in state values are stored only as hashes.
- All other workspace data (audit inputs, reports, uploaded files, and connected-account details) is stored unencrypted in a database and file folder on the VERSO-operated computer. Uploaded files are readable only by the account that runs VERSO IQ.
- Connections are tied to the workspace that created them. One workspace cannot read another workspace's audits, connections, or tokens.
No system is perfectly secure. If we learn of a breach that affects your data, we will tell you.
8. Retention and deletion
- Audits are kept until you delete them. Deleting an audit removes its report, sources, uploaded files, actions, processing log, and the Instagram data collected for it.
- Disconnecting TikTok, QuickBooks, or Gmail asks the platform to revoke VERSO IQ's access and deletes the stored tokens. A record of the disconnected account (its ID and name) remains until you choose Forget, which deletes it.
- Outlook / Microsoft 365 has no per-app revoke. Disconnecting deletes the stored tokens; to remove the permission itself, remove VERSO IQ at myapps.microsoft.com (work or school) or account.live.com (personal).
- Instagram: disconnecting deletes the stored token in VERSO IQ but does not revoke it at Meta. To revoke it, remove VERSO IQ in Instagram under Settings → Apps and websites.
- You can also revoke access at any time from each platform's own settings. TikTok, for example, lists connected apps under Settings and privacy → Security → Manage app permissions.
- Temporary sign-in data expires after 10 minutes. Instagram's pending sign-in grants expire after 24 hours.
- Your whole workspace. The product doesn't have a self-service workspace deletion yet. Email contact@versolab.ai and we will delete the workspace and everything in it, and confirm when it is done.
9. Cookies and tracking
VERSO IQ sets one cookie, viq_uid, a random workspace identifier that lasts one year. It is required for the product to work. VERSO IQ uses no advertising, analytics, or third-party tracking scripts. This public website sets no cookies at all.
10. Sharing and sale
We do not sell personal information or connected-account data. We do not use it for advertising, and we do not share it except with the services in section 6, as described, or where the law requires it.
11. Changes
We will update this page before VERSO IQ starts collecting anything new or using data in a new way, and change the effective date above.