Privacy Policy

1. Who we are

VRSO is operated by ArQ Criterion Limited, a company registered in New Zealand ("VRSO", "we", "us"). Our address is L3, Copson Building, 95 Hurstmere Road, Takapuna, Auckland 0622, New Zealand. For any privacy question or request, contact support@vrso.io.

This policy covers the vrso.io website, the VRSO application, and the VRSO chat widget embedded on our customers' websites.

2. Two roles: our customers and their visitors

VRSO is used in two ways, and our responsibilities differ between them.

When you create a VRSO account, visit vrso.io, or contact us, we decide how and why your information is processed — we act as the "controller" of that data.

When you chat with a VRSO-powered widget on another business's website, that business is our customer and controls the data you share in the conversation. We process it on their behalf and on their instructions — we act as their "processor" (or "agency" under the New Zealand Privacy Act 2020). If you want your conversation or contact details accessed, corrected, or deleted, the fastest route is to contact the business whose website you used. We will support them in fulfilling your request, and you can also reach us at support@vrso.io.

3. Information we collect

Account information: name, email address, and password credentials (managed by our authentication provider; we never store plain-text passwords), plus business details you provide during setup such as business name, website, location, and service descriptions.

Billing information: payments are handled by Stripe. We store your subscription status, plan, and billing currency. Full card numbers never touch our servers.

Business content: when you connect your website, we crawl and store its public content to build your agent's knowledge base, along with any documents you upload and any services or insights generated from that content.

Widget conversations: messages exchanged with the widget, lead details a visitor chooses to share (such as name, email, and phone number), the page the conversation started on, and a session identifier stored in the visitor's browser so the conversation can continue across pages.

Contact form submissions: name, email, company, and message.

Technical information: IP address (used momentarily to estimate country for currency display and for security), browser and device information, and approximate region. We do not run third-party advertising trackers on vrso.io.

4. How we use information

To provide and operate the service: generating AI chat replies from the customer's knowledge base, capturing and scoring leads, sending lead notifications and customer follow-up emails, and showing analytics to the account holder. To run our own business: processing subscriptions, providing support, responding to contact messages, sending transactional emails (account confirmations, password resets, billing notices), improving the product, and preventing abuse. We do not sell personal information, and we do not use widget conversation content for advertising.

5. AI processing

VRSO uses third-party AI providers to operate: OpenAI (generating chat replies and analysis) and Voyage AI (converting text into search embeddings). Relevant content — visitor messages, knowledge-base excerpts, and business details — is sent to these providers to produce each reply. We use their business APIs, which contractually do not use submitted content to train their models. AI-generated responses are produced automatically and may occasionally be inaccurate; the business deploying the widget remains responsible for the information it provides to its visitors.

6. Service providers

We use a small set of providers to run VRSO: Supabase (application hosting, database, authentication), OpenAI (AI responses), Voyage AI (embeddings), Stripe (payments), Resend (email delivery), Firecrawl (website crawling), and Google Fonts (font delivery on vrso.io). These providers process data only as needed to provide their service to us. Some are located in the United States; where data is transferred internationally we rely on our providers' compliance frameworks and contractual safeguards, and under the NZ Privacy Act we take reasonable steps to ensure comparable protection.

7. Cookies and local storage

vrso.io stores your currency preference and session information in your browser. The widget stores a session identifier in the visitor's browser so conversations persist across pages. We do not use advertising cookies.

8. Retention

Account and business data are kept while your account is active and deleted within 30 days of account closure, except records we must keep for tax, billing, or legal purposes. Widget conversations and captured leads are retained while the relevant customer's account is active, or until the customer deletes them. Contact form submissions are kept for up to 24 months. Backups expire on a rolling schedule after deletion.

9. Your rights

If you are in New Zealand, the Privacy Act 2020 gives you the right to access and correct your personal information. If you are in the EEA or UK, the GDPR / UK GDPR gives you rights of access, correction, deletion, restriction, portability, and objection. To exercise any right, email support@vrso.io — we respond within the timeframes required by the applicable law. If you are unhappy with our response, you may complain to the Office of the New Zealand Privacy Commissioner (privacy.org.nz) or your local supervisory authority.

10. Security

Data is encrypted in transit, access to production systems is restricted and authenticated, and payment credentials are handled entirely by Stripe. No internet service can guarantee absolute security, but we take the protection of your information seriously and review our safeguards as the product evolves.

11. Children

VRSO is a business tool and is not directed at children under 16. We do not knowingly collect personal information from children.

12. Changes

We will update this policy as the product evolves and change the effective date above. Material changes will be notified to account holders by email or in-app notice.

13. Contact

support@vrso.io · ArQ Criterion Limited, L3, Copson Building, 95 Hurstmere Road, Takapuna, Auckland 0622, New Zealand.