Privacy Policy

1. Introduction

Welcome to Verza Technologies, Inc. ("Verza", "we", "us", or "our"). We are committed to protecting your privacy and ensuring you have a positive experience on our website and when using our services (the "Service").

This Privacy Policy explains how we collect, use, and safeguard your information, including data obtained through Gmail, connections to Claude, ChatGPT, Cursor, and Codex, third-party social media APIs, the optional Verza Optic Scout Chrome extension, and communication providers. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information, including:

• Email address
• First and last name
• Phone number
• Professional information (for example, brand name or agency details)
• Financial information for processing payments, handled by a secure third-party processor such as Stripe

2.2 Social Media Data (the "Verified Metrics")

To provide our verified marketplace features, you may choose to connect your social media accounts. When you do, we collect:

• YouTube. Channel statistics (subscriber count, view counts, video metadata) via YouTube API Services.
• Instagram and Facebook. Profile metrics (follower count, engagement rates, reach) via the Instagram Graph API.
• TikTok. Account performance data (followers, likes, video stats) via the TikTok for Business API.

2.3 Optic Scout Chrome Extension

Verza Optic Scout is an optional Chrome extension used with Verza Optic to help brands and agencies discover Instagram creators for campaigns. It is not a standalone scraper. It runs only as part of an Optic mission you start in the Verza Optic web app while signed in to your Verza account.

When data is collected

The extension collects data only when you start an Instagram discovery mission in Verza Optic while signed in to Verza and, typically, signed in to Instagram in the same Chrome browser session. It does not run in the background, and it does not collect data outside an active mission you initiated.

What we collect via the extension

• Public Instagram website content visible on creator profile pages in your signed-in browser session, including profile username, display name, bio text, follower and post counts as shown on the profile, public external or profile links, and the profile URL.
• Personally identifiable information that appears in that public content — for example, a name, email address, or phone number if a creator published it in their bio or linked profile.
• Verza session credentials used only to authenticate API calls to Verza (claim mission, submit leads, report progress). We do not collect or store Instagram passwords through the extension.

What we do not collect via the extension

• Instagram passwords
• Private direct messages
• Full browsing history
• Keystrokes, clicks, or scroll activity
• Health information or payment card data from your browser
• Website content outside Instagram and Verza Optic hosts during a mission

The extension does not post, comment, follow, or send direct messages on Instagram.

How we use extension data

Data collected through Optic Scout is used for a single purpose: to run your Optic mission — evaluate creator fit against your brief, save matching creators to your Optic vault, and support outreach drafts. We do not sell this data. We do not use it for creditworthiness or lending decisions. We do not use it for unrelated advertising.

Where data is stored and transmitted

Extension data is transmitted over HTTPS to Verza's backends (including Cloud Functions and Firestore associated with your Verza account or agency workspace). Locally, the extension may store temporary session flags — such as whether a mission is running and the associated job identifier — in chrome.storage.session. These flags are cleared when the mission ends or when the browser session ends.

Host access

The extension requests access only to Instagram (instagram.com), Verza Optic web app hosts (including app.tryverza.com and applicable staging environments), and Verza API hosts required to run Optic missions — not the open web.

Optic Scout does not access Instagram through the Instagram Graph API. It reads public profile pages in your signed-in Chrome browser session as described above. This is separate from the Instagram Graph API integrations described in Section 2.2 for verified creator metrics.

For how Optic vault leads are shared within your account and retained, see Sections 6, 7, and 10 below.

3. Social Media API Integrations

API disclosure and usage

Verza uses API services to provide real-time, verified performance metrics for creators.

• YouTube API Services. By connecting your YouTube account, you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. We use these services to display your channel's reach to brands.
• Revocation. You can revoke Verza's access to your data at any time via your Verza account settings or through your Google Security Settings.
• Instagram and TikTok APIs. We use these APIs similarly to verify audience size and engagement percentages. Access is governed by their respective developer terms.

4. Gmail

You can connect a Gmail account so Verza can help with the first email to a creator. Connecting Gmail is optional. The campaign still works if you do not connect it.

Intended purposes

When you connect Gmail, Verza uses that connection only to:

• Draft. Create a draft of the first outreach email in your Gmail account, so you can read it there and send it yourself.
• Send, after you approve. Send that email from your Gmail account after you approve the send.
• Record status. Record whether the email is still a draft or has been sent, so the campaign shows who has been contacted and who is still waiting.

What this connection is not for

• No advertising. We do not use Gmail data to advertise to you or to anyone else.
• No sale. We do not sell Gmail data.
• No unrelated mail. We do not read mail that is unrelated to an email Verza drafted or sent for your campaign.
• No model training. We do not use Gmail data to train a general-purpose model.

Verza's use of information received from Google APIs, including Gmail, adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google's own Privacy Policy also applies to your Google account.

You can disconnect Gmail in Verza, or revoke Verza's access from your Google Account permissions. After you disconnect, we stop creating drafts and sending mail from that account.

5. Claude, ChatGPT, Cursor, and Codex

You can connect Verza to Claude, ChatGPT, Cursor, or Codex. The connection is Verza's server at https://api.tryverza.com. You stay in the chat you already use. Verza does the work from there.

Intended purposes

The connection exists so you can, from that chat:

• Launch a creator campaign from a product URL.
• Find creators for that product.
• Draft or send the first email once you approve, or leave it in Gmail as a draft.
• Ask for the status of a campaign, or ask for ROAS.

What is exchanged

The chat sends Verza the request you make, such as a product URL and the instruction. Verza sends back the result, such as a campaign draft, creator matches, an email, a status, or a ROAS figure. That exchange also passes through the LLM product you connected. That provider processes the conversation under its own terms.

Connecting an LLM does not give that provider access to your Gmail mailbox. Gmail stays a separate connection, used only for the purposes in Section 4. If you approve a send, Verza uses Gmail. The LLM does not receive your mailbox.

We do not sell the contents of these requests or replies. You can disconnect by removing Verza from that chat product.

6. How We Use Your Data

Verza uses your data for the following purposes:

• Verification. To display "Verified Metrics" (reach, engagement, growth) on creator profiles for brands to see.
• Marketplace operations. To facilitate campaign postings, applications, and Campaign Vault-based payments.
• Creator discovery (Optic). To find and save public Instagram creator profiles to a brand's Optic vault when using Optic Scout, and to draft outreach for those creators.
• System notifications. To send time-sensitive alerts, campaign updates, and security notifications via SMS or voice calls using third-party providers (for example, Twilio).
• Communication. To send updates regarding your campaigns, payouts, or security alerts.
• Gmail. To draft the first creator email in your Gmail account, to send it after you approve, and to record whether it is still a draft. See Section 4.
• Chats you already use. To carry out a request you make from Claude, ChatGPT, Cursor, or Codex, and to return the result to that chat. See Section 5.
• Performance analysis. To calculate your Verza Score and provide insights into content performance.

7. Data Sharing and Disclosure

8. Cookies and Tracking

We use cookies to track activity and hold certain information to improve your experience.

• Session cookies. We use session cookies to operate our Service.
• Preference cookies. We use preference cookies to remember your preferences and settings.
• Security cookies. We use security cookies for security purposes.

9. Your Data Protection Rights (GDPR / CCPA)

Depending on your location, you have rights regarding your personal data. Verza aims to provide these rights to all users:

• Access, update, or delete your information.
• Rectification if your information is inaccurate.
• Object to our processing of your personal data.
• Restrict processing.
• Data portability.
• Withdraw consent.

10. Data Retention and Deletion

We retain your information only as long as necessary for the purposes set out in this policy. If you disconnect a social media account or phone number, we stop fetching new data and will delete previously stored metrics within 30 days, unless a campaign is active and requires that data for legal or financial record-keeping.

Optic vault leads (public creator profile information saved via Optic Scout) are retained with your customer account until you delete them, until your account is deleted, or until you request removal by contacting support@tryverza.com.

Gmail. The draft or sent message itself stays in your Gmail account, under Google's retention. Verza keeps the campaign record of that email — that it was drafted or sent, and which creator it belongs to — with your account until you delete the campaign or the account, or until you ask us to remove it.

LLM connections. The request you send from Claude, ChatGPT, Cursor, or Codex, and Verza's reply, are kept with the campaign they belong to, on the same schedule as the rest of that campaign. The LLM provider you connected keeps its own copy under that provider's terms.

To request full account deletion, contact us at support@tryverza.com.

11. Security

We implement industry-standard technical and organizational security measures, including AES-256 encryption for data at rest and TLS for data in transit. However, no system is 100% secure.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, write to support@tryverza.com or visit https://tryverza.com.