Overview
Verso ("we," "us," "our") operates the Verso platform (withverso.io), which provides demand intelligence for the travel and hospitality industry. We operate branded discovery experiences on behalf of destination organizations, hospitality brands, and travel professionals (together, "Partners"), and we process the resulting session and communication data into structured intelligence for those Partners. Some Partner experiences cover related consumer verticals such as beauty and real estate. The people who interact with these experiences are "Consumers."
Partners use Verso in two ways. Individual professionals, such as travel advisors, operate their own discovery pages and can connect their own communication channels; they receive intelligence about their own clients only. Destination and enterprise Partners, such as tourism boards, business improvement districts, and hotel groups, receive aggregate intelligence only.
This Privacy Policy explains what data we collect, how we process and store it, how long we retain it, and what rights you have. It applies to all users of the Verso platform, including Consumers who interact with discovery experiences, Partners who operate them or connect their accounts, and enterprise recipients of aggregate intelligence reports.
Data We Collect
Discovery Session Data
When a Consumer interacts with a discovery experience that Verso operates for a Partner (a destination microsite, concierge surface, or discovery page), we collect session data including: responses to discovery questions (travel preferences, budget ranges, timing, style preferences), properties or products viewed, booking clicks and inquiry actions, session duration and completion status, and referring source (e.g., Instagram post, direct link).
Session data is collected directly through the Consumer's interaction with the platform. No account creation is required to complete a discovery session.
Messaging Data (Partner-Connected Channels)
When a Partner connects their Instagram, WhatsApp, or email account to Verso, we process messages from those channels to extract structured intelligence. We collect: message content from connected channels, contact information (names, email addresses, phone numbers, social handles), conversation metadata (timestamps, thread grouping, message direction), and extracted intelligence (intent signals, preferences, commitments, deadlines).
We only process conversations that the Partner has access to through their own accounts. For Instagram and WhatsApp, we only process conversations initiated by the other party. We never access or process unsolicited outbound messages.
Partner Account Data
When a Partner creates a Verso account, we collect: name, email address, business information, connected platform credentials (OAuth tokens), notification preferences, and page configuration data.
Technical Data
We automatically collect: device type and browser information, IP address (used for geolocation at the city/DMA level, then discarded), page load and interaction timestamps, and referral URLs. We measure page traffic with Vercel Analytics, which is cookieless and aggregate. We do not use third-party tracking cookies. We do not serve advertising.
Text Messaging (SMS) Data
If a Consumer chooses to receive their saved route by text message, we collect the mobile number they enter, a timestamped record of their consent (a keyed hash of the number and the wording version they agreed to), the message we sent and its delivery status, and any replies such as STOP or HELP. The number is stored encrypted with the delivery record. See "Text Messaging (SMS)" below for how this data is used and shared.
How We Use Your Data
For Partners
We process Partner data to: power the AI discovery experience on their pages, extract structured intelligence from connected communication channels (intent signals, client preferences, action items, deadlines), generate dashboard analytics (session counts, conversion metrics, audience insights), deliver semantic notifications when new sessions match their stated preferences, and build client profiles and relationship timelines from communication history.
For Consumers
We process Consumer session data to: deliver personalized discovery results (property matches, product recommendations, neighborhood matches), attribute session activity to the referring Partner, page, or campaign, and generate aggregate demand intelligence (never individual profiles) for tourism boards, hotel groups, and other enterprise Partners.
For Destination and Enterprise Partners
We generate aggregate intelligence reports for destination and enterprise Partners such as tourism boards, business improvement districts, and hotel groups. These reports contain only aggregate and segment-level data with a minimum group size of 50. Individual consumer profiles are never shared with these Partners. Reports include: demand trends by origin market, travel vibe and budget distributions, property-level demand attribution, campaign and channel performance metrics, and seasonal timing patterns.
AI and Automated Processing
Verso uses AI models (Claude by Anthropic and other providers) to process data in the following ways:
Discovery sessions: AI interprets Consumer responses to match preferences with properties, products, or neighborhoods. The AI generates personalized recommendations based on the Partner's configured offerings.
Communication intelligence: When a Partner connects their messaging channels, AI extracts structured data from conversation threads, identifying entities (people, companies), episodes (commitments, requests, decisions, deadlines), and intent signals (travel interest, budget indicators, timing preferences). The AI does not generate or send messages on behalf of the Partner.
Notification matching: AI semantically compares new session signals against Partner-defined notification preferences to determine relevance.
All AI processing is performed on Verso's infrastructure. We do not share raw conversation content with enterprise clients or any third party other than our AI processing providers, who are bound by data processing agreements.
Data Security
We implement the following security measures:
Encryption: All OAuth tokens and sensitive credentials are encrypted at rest using AES-256-GCM with per-record initialization vectors. Data is encrypted in transit via TLS 1.2+.
PII Redaction: Before storing processed intelligence, our redaction system strips personally identifiable information including email addresses, phone numbers, social security numbers, and payment card numbers from stored text. Intelligence insights are preserved; raw PII is not retained in processed outputs.
PII Hashing: When we need to reference a contact for deduplication or attribution without storing the raw identifier, we derive a keyed HMAC-SHA-256 of the normalized identifier. The key is held in application configuration and is never stored alongside the hash, so the hashes cannot be reversed by dictionary attack without it.
Access Controls: Partner data is scoped by account at the database query level. One Partner cannot access another Partner's data, connected accounts, or client intelligence. Enterprise API access is restricted to aggregate queries with minimum group sizes.
Audit Logging: All data access, consent changes, processing events, and administrative actions are logged to an immutable audit trail with timestamps, actor identification, and action details.
Infrastructure: Data is stored in Supabase (PostgreSQL) with row-level security policies. The application is hosted on Vercel. Both providers maintain SOC 2 compliance.
Data Retention
We retain data according to the following schedule:
Discovery session data: Raw session data is retained for 18 months. After 18 months, individual session records are removed; only aggregate intelligence is preserved.
Communication thread data: Raw message bodies are purged after 90 days. Extracted intelligence (entities, episodes, signals) is retained for 12 months. After 12 months, only aggregate client profiles are preserved.
Processed intelligence: Intelligence observations and signal classifications are retained for 6 months, then archived.
OAuth tokens: Encrypted tokens are retained for the duration of the active connection. Tokens are deleted immediately when a Partner disconnects a channel.
Audit logs: Retained for 24 months for compliance purposes.
Partners can request immediate deletion of their data and all associated client intelligence at any time (see Your Rights below).
Consent and Legal Basis
Partner Consent
Partners explicitly consent to data processing when they: create a Verso account (account data processing), connect a messaging channel via OAuth (communication intelligence processing), and configure notification preferences (semantic matching on their data). Partners can withdraw consent at any time by disconnecting channels or deleting their account. Withdrawal of consent triggers deletion of associated processed data according to our retention schedule, with immediate deletion of OAuth tokens.
Consumer Consent
Consumer discovery session data is processed under the Partner's legitimate interest in understanding its audience and improving its service. Consumers are informed at the start of each discovery session that their responses will be used to generate recommendations and may be included in aggregate analytics. Consumers can opt out of aggregate intelligence reporting. Opt-out is tracked via a hashed identifier; we do not need to store any PII to honor an opt-out request.
Enterprise Data
Enterprise intelligence reports contain only aggregate data that cannot be used to identify individual consumers. No individual consent is required for aggregate statistical analysis with minimum group sizes enforced at the query layer.
Text Messaging (SMS)
On some Partner concierge pages, you can choose to receive your saved route by text message. If you enter your mobile number and submit the form, With Verso, Inc. sends one text containing a link to your route. It is a single message, not a subscription, and we do not send recurring or marketing texts.
Your mobile number is used only to deliver that message. We keep an encrypted copy of the number with the delivery record and a keyed hash with a timestamp as the record of your consent, so that we can honor a STOP request and evidence that you asked for the message. It is not added to any list or used again.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except the SMS provider that delivers the message. Reply STOP to opt out or HELP for help. Message and data rates may apply. Questions: anand@withverso.io.
Your Rights
Regardless of your location, you have the following rights:
Access: You can request a copy of all data we hold about you. Partners can view their data through the dashboard. Consumers can request their data by contacting us.
Rectification: You can request correction of inaccurate data.
Deletion: You can request deletion of your data. For Partners, this includes all connected channel data, extracted intelligence, client profiles, and account information. For Consumers, this includes session data and any aggregate contributions (removed via hash-based exclusion).
Portability: Partners can request an export of their data in a structured, machine-readable format.
Opt-Out of Intelligence Processing: Consumers can opt out of inclusion in aggregate intelligence reports. Partners can disconnect any channel to stop processing of that channel's data.
Opt-Out of Text Messages: Reply STOP to any text message from us, or contact us, and we will stop messaging that number immediately.
To exercise any of these rights, visit withverso.io/data-deletion or contact us at anand@withverso.io. We will respond within 30 days.
Third-Party Services
We use the following third-party services to operate the platform:
Anthropic (Claude AI): Processes session and communication data for intelligence extraction. Bound by data processing agreement. Does not retain input data after processing.
Supabase: Database hosting (PostgreSQL). SOC 2 compliant. Data stored in US regions.
Vercel: Application hosting and cookieless, aggregate page analytics (Vercel Analytics). SOC 2 compliant. Analytics data contains no advertising identifiers and no cross-site tracking.
Apify: When a Partner connects or imports a public Instagram profile during onboarding, we retrieve that profile's public posts and profile information through Apify's scraping infrastructure. Only the Partner's own public content is retrieved, and only at the Partner's request.
Resend: Delivers transactional email on our behalf, such as lead notifications, itineraries, and inquiry confirmations. Recipient addresses and message content are processed solely for delivery.
Telnyx: Delivers text messages you request, such as a link to your saved route. It receives the destination mobile number and message content solely to deliver that message.
Upstash: Operates the managed queue behind our durable background processing, such as ingesting messages from connected channels. Workflow payloads transit Upstash infrastructure encrypted via TLS.
Tango Card and Tremendous: When a gift card is purchased through the product, we place the order with one of these issuers so they can deliver it. They receive the recipient's email address and the card amount. No name is sent — the recipient is identified to them as "Verso Guest". Which of the two is used depends on the venue.
Google Fonts: Our pages load typefaces from Google's font CDN. This means a visitor's browser connects to Google and, as with any web request, Google receives that visitor's IP address and user-agent. No account data, session content, or preferences are sent. We are evaluating self-hosting these fonts to remove this connection.
Firecrawl: When a Partner asks us to import content from their own website during onboarding, Firecrawl retrieves and structures the public pages of that site. It receives the site address only, and no consumer data.
Pexels and Unsplash: Supply stock imagery displayed in the product. They receive image requests only, and no consumer data.
Viator: Supplies bookable activity listings shown in travel itineraries. It receives search parameters such as destination and date, and no consumer identifiers.
Meta Platforms (Instagram, WhatsApp): When Partners connect their Instagram or WhatsApp accounts, we access their messaging data through Meta's official APIs under the permissions they grant during OAuth. We comply with Meta's Platform Terms and Developer Policies. We do not sell or share messaging data with any party other than providing intelligence back to the Partner who owns the account.
We do not sell personal data to any third party. We do not share individual-level data with enterprise clients. We do not use personal data for advertising.
International Data Transfers
Verso is based in the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.
For users in the European Economic Area (EEA) and United Kingdom: our legal basis for processing is legitimate interest (aggregate analytics) and consent (Partner channel connections). You have additional rights under GDPR including the right to lodge a complaint with your local supervisory authority.
For users in California: you have additional rights under the CCPA including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information.
Children's Privacy
Verso is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete that data immediately. If you believe a child under 16 has provided us with personal information, please contact us at anand@withverso.io.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify Partners of material changes via email and by posting the updated policy on this page with a revised "Last Updated" date. Continued use of the platform after changes constitutes acceptance of the updated policy.