Skip to content

Verso is still being built. Please do not create an account or pay for anything yet. Things will change, break, or be deleted without notice, and anything you do here before launch is at your own risk.

VersoBack to home

Privacy Policy

Last updated: October 2026

Verso is an AI writing studio that drafts LinkedIn posts grounded in your own work. This policy explains what we collect, why, who we share it with, and how you stay in control. We have written it to be read, not to hide behind.

Who we are

Verso is operated by Wasim Asghar, a sole trader established in the United Kingdom, trading as “Verso”. Wasim Asghar is the data controller responsible for your personal data under the UK GDPR. You can contact us by post at Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom or by email at privacy@versovoice.com.

What we collect

  • Account data: your name, email and authentication credentials (passwords are hashed with scrypt; we never store them in plain text), plus optional Google or LinkedIn sign-in identifiers.
  • Content you create or upload: chat messages, generated posts, and the documents you add to your knowledge base.
  • Speech, if you use it: when you dictate or hold a live voice call, your microphone audio is processed to turn it into text. It is streamed to the speech providers named under “Who we share it with” below, and is never stored by Verso; what we keep is the resulting text, saved as ordinary content exactly as if you had typed it.
  • Derived data: a writing voice profile and durable memory (preferences, corrections, facts) distilled from your content to personalize generations. (“Voice profile” here means your writing style, not a recording of your speech.)
  • Usage and cost records: per-request token counts and cost, used for your dashboard and quotas.
  • Technical and security data: your IP address is recorded in a security audit log for specific actions: uploading, deleting or retrying a knowledge-base document (including one built from a guided interview, or one added from a link you paste), correcting when a knowledge-base document is from, connecting, disconnecting, syncing or rescoping a connector or overriding what it may sync, uploading a guardrails document, uploading your own picture, video or carousel file, building a carousel from your own photos, attaching your generated slides as a carousel document, a payment-webhook request that fails our signature check, and a request to the AI-tools connection that we turn away - either because the key was not valid or because too many requests arrived at once. Signing in itself is tracked in your session record instead, which is deleted along with your account rather than kept in this log. Audit log entries about a deleted account are de-identified rather than deleted (the link to you is removed, the entry itself stays), so we can still investigate abuse and defend the account afterwards if we ever need to. We rely on our legitimate interest in keeping the service secure for this.

How we use it

We use your data to operate the product: generating drafts in your voice, grounding them in your knowledge base, metering cost, and securing your account. We do not sell your data, and we do not use your content to train our own models.

Legal basis for processing

UK GDPR asks us to say which legal basis covers each use of your data. Delivering the product itself, generating drafts, storing your content, running your dashboard, rests on performance of our contract with you. Keeping the service secure, preventing abuse, and improving the product, including the security audit log above, rests on our legitimate interests, weighed against your right to privacy. Where we ask for it separately, for example the launch updates described below, we rely on your consent, which you can withdraw at any time without affecting the rest of your account.

Encryption

Your most sensitive fields, knowledge-base content, voice profile, learned memory and conversation summaries, are encrypted with AES-256-GCM on our server before they are written to the database, using a key that is not stored in that database. Transport is protected with TLS.

Who we share it with

We rely on a small set of sub-processors to deliver the service. They receive only what is needed to perform their function. See the full list on our sub-processors page. In short: your prompts and relevant context are sent to our AI provider to generate text; text is sent to an embeddings provider to make your knowledge base searchable; billing details are handled by our payments provider; and transactional email is sent through our email provider. If you dictate, your audio is streamed to Soniox, our real-time speech-to-text provider, so your words appear on screen as you speak. If you hold a voice call, the audio you speak, its transcript, and the reply spoken back to you are sent to our speech provider. If live dictation is unavailable, Verso falls back to your device’s own speech engine, so your browser vendor (Google in Chrome, Microsoft in Edge) also receives that audio directly from your device; on that fallback path only, the same short recorded segments are also sent to ElevenLabs for a more accurate pass over the rough, on-device transcript. If you generate a picture or a short video, what is sent to our media provider is the prompt you type for it and the shape and length you choose, plus the technical settings we send on every request. Nothing about you goes with it: not your knowledge base, not your drafts and not your account details. If you contact us, through the public contact form or the in-app feedback widget, your message is also shared with our AI provider so it can be sorted automatically before a person reads it.

On every plan, your finished posts are written by open-weight AI models reached through OpenRouter and run by DigitalOcean, DeepInfra or Novita; Pro and Team plans use a stronger model than Free and Starter. The same models handle the other writing tasks in the app (the questions asked before a draft, ideas, opening lines, grammar, your voice profile, memory, chat summaries, guardrail checks and sorting a message you send us) and write the replies spoken back to you in a voice call. Every request carries OpenRouter’s zero-data-retention setting. See the sub-processors page for what each of them does, where they run, and how long they keep your data (in short: none of them do).

Live web research is the one place your words reach a company that does keep them. When you switch it on for a draft, the request you typed is sent through OpenRouter to Exa, a search engine, so the model can write from current sources; Exa’s own privacy policy says query data is used to improve its products, including by training its models. Only that request is sent. Your knowledge base, your documents and your account details are not, and with live web research off nothing goes to Exa at all. The sources it returns are listed under your draft.

Your account and your content are stored in the United Kingdom: the database runs in London (Neon, AWS region eu-west-2), so the data you write to Verso is not held outside the UK. Neon itself is a United States company and can reach that data from there, and most of the other providers on our sub-processors list operate in the United States as well. Wherever personal data can be reached from outside the UK, whether because it is stored there or because the company holding it is there, the transfer is covered by the UK International Data Transfer Addendum (or the UK Extension to the EU Standard Contractual Clauses), the standard safeguard for sending personal data outside the UK, which each of those providers has agreed to. This does not cover your browser vendor: when dictation falls back to your device’s own speech engine and sends audio straight from your device to Google or Microsoft, as described above, that happens outside our control, under that vendor’s own privacy policy rather than ours.

Novita, named on the sub-processors page above, states in its own privacy policy that it transfers personal information to other countries, including the United States, and that this information is not used to train its models; its terms are governed by Delaware law. Every request that can reach Novita also carries OpenRouter’s zero-data-retention setting. The safeguard for that transfer runs through OpenRouter’s own terms (the UK International Data Transfer Addendum or the EU Standard Contractual Clauses), not a direct contract between Novita and Verso.

Retention and deletion

We keep your data for as long as your account is active. You can export your posts, documents and settings in full at any time from Account settings. Your uploaded files come in numbered parts within your plan's monthly allowance for opening files, and if you want all of them at once, email privacy@versovoice.com and we will send everything within a month. You can permanently delete your account from Account settings. Deleting your account erases your personal data and any workspace where you are the only member; cost-ledger rows kept for accounting are de-identified. Encrypted fields become unrecoverable once their rows are removed. A workspace owner or admin can also turn on "Forget my documents after 90 days" on the Knowledge page: each document in that workspace's knowledge base, with all its text, is then deleted within a day after the date shown next to it in Knowledge, which is 90 days after it was added, and anything already older is kept for 7 more days from when the setting is turned on. It is off unless someone turns it on, and it does not delete your posts, chats or memory.

Cookies and local storage

Verso sets only first-party cookies that are strictly necessary to run the service. There is no advertising cookie, no third-party tracker and nothing that follows you to other websites, which is why the notice you see on your first visit tells you what we do rather than asking you to opt in: under the Privacy and Electronic Communications Regulations, strictly necessary storage does not need your consent, but you are still entitled to be told about it. Here is everything we put on your device.

  • Sign-in cookies: set by our authentication library when you log in, so the site knows it is still you as you move between pages. They last up to 90 days and renew while you keep using Verso, so you are not asked to sign in every week. Deleting them signs you out. Without them you cannot use an account at all.
  • Sign-in help cookie: set for two minutes only after a failed sign-in, so that the page can tell you if the email address you tried signs in with Google, Microsoft or Apple instead of a password. It holds a signed code tied to that email address, nothing else, and is only ever sent back to one page of our site.
  • Connection cookies: set for a few minutes while you connect an outside account, and only if you start that yourself. They hold a one-time security code so we can tell that the account which comes back is the one you set out to connect, and nobody else's. They last ten minutes at most, and are deleted as soon as the connection finishes, whether it worked or not.
  • Preference storage: small values kept in your browser's local storage to remember choices you made yourself, such as light or dark theme, whether interface sounds are on, and which one-off notices you have dismissed. These never leave your browser and we never read them on our servers.
  • Audience measurement: we count page views through Vercel Web Analytics, which does not use cookies, does not store an identifier on your device and cannot follow you across other sites. It tells us how many people visited a page, not who they were.

You can clear or block all of this in your browser settings at any time. Blocking the sign-in cookies will stop you being able to log in; nothing else here is needed for the site to work.

Your rights

Depending on where you live (including under GDPR and CCPA), you have the right to access, export, correct and delete your personal data, and to object to certain processing. You can exercise access, export and deletion yourself from Account settings; for anything else, contact us at privacy@versovoice.com. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or through their helpline, though we would rather have the chance to put things right first.

Launch updates

The footer on our site lets you leave your email for occasional launch updates. We only use it for that, and only if you tick the box to opt in when you leave your address; visiting the site or reading a page never signs you up on its own. The legal basis is your consent, which you can withdraw at any time by emailing privacy@versovoice.com and asking to be removed.

LinkedIn

Connecting your LinkedIn account is optional. If you connect it, we store the access token LinkedIn issues (encrypted at rest) and use it for one purpose: publishing the posts you explicitly choose to publish, through LinkedIn's official API. Verso never posts without your action and does not scrape LinkedIn. You can disconnect your LinkedIn account at any time from Settings, and you are responsible for what you choose to post.

Browser extension (Save to Verso)

If you install the Save to Verso extension, it reads one web page only when you press its button. Pressing it sends that page's address, title and text, together with your connection key, to your Verso account. The extension does not run in the background, does not keep a list of the pages you visit and does not read any page you have not chosen to save.

The page text is stored in your knowledge base like any other document: encrypted before it is stored, and used only to help write your posts, for example to ground a draft in your own material and to learn how you write. You can delete it by removing the document, by pressing Disconnect and delete on the Integrations page, or by deleting your account. The connection key stays in your browser's extension storage on your own device.

The use of information received through the Save to Verso extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell it, we do not use it for advertising, we do not use it to judge creditworthiness or for lending, and nobody at Verso reads it except with your permission, to investigate abuse, or where the law requires.

Changes

If we make material changes to this policy we will update the date above and, where appropriate, notify you. Questions: privacy@versovoice.com.