VERSAI · OPEN SAFE BETA
Privacy policy
Updated 2 November 2026
Unconfirmed publisher and hosting details and some operational policies still require completion. Free access does not establish legal approval or permission for real sales.
Controller and contact
The publisher identified in the legal notice is responsible for the use of personal data by VersAI. Privacy contact: contact@vers-ai.com
Data used by the beta
The following table identifies the data used for the requested functions. The purpose-specific legal bases are set out below.
| Data | Purpose | Basis |
|---|---|---|
| Sign-in identity, private account email, public username, display name, optional profile photo, profile text and optional creator presentation and platform links | Provide and manage the account | Performance of the account service |
| Saved favourites and followed creators | Maintain your personal lists and creator follows | Performance of the account service |
| Reviews and comments | Publish and manage your contributions | Performance of the community service |
| Creator legal name, contact email, country, portfolio, introduction, AI tools and rights declarations | Review creators and permissions | Manage the creator application and legitimate interests in rights protection |
| Uploaded files, submission metadata and review decisions | Review, host and publish approved creations | Performance of the creator service; legitimate interests in safe operation |
| Moderation history and security information | Protect accounts, investigate abuse and manage disputes | Legitimate interests in security and rights protection; legal duties where applicable |
Required fields are indicated in forms. If you do not provide them, the corresponding account, creator review or publication function may be unavailable. Avoid including sensitive personal data in public contributions.
Visibility and providers
Profile names, profile photos, public profile text, approved creations, reviews and comments can be visible to visitors without an account. Creator legal and contact details and unpublished files are restricted to the creator and authorised administrators. Published files become accessible through the catalogue. Your list of followed creators is private to your account; aggregate follower counts appear on creator profiles. Optional creator platform links are public and open external websites when selected.
The site uses ChatGPT Sites with Cloudflare D1/R2 for application records and files, Supabase Auth for sign-in, Resend for account confirmation, recovery, purchase confirmation with PDF, billing updates and delivery tracking, and Google Workspace for professional correspondence. Visitors can browse within the beta without an account. Only verified email accounts use a credit wallet to unlock credit-based creations. Visitors can open free creations without receiving discovery credits. Older visitor-wallet records follow the retention policy. Older allowance records follow the retention policy. Stripe checkout is being prepared separately from public sales. Advertising and optional audience measurement require their own configuration and applicable consent.
Optional Google sign-in
If you choose Google sign-in, Google provides Supabase with your identity, email and basic profile information, which may include your name and profile photo. VersAI verifies the provider account ID and email to open your account. You choose your VersAI avatar in your profile.
Providers and international processing
Authorised VersAI personnel use these providers for the functions listed. A project or sending region does not guarantee that all data and access stay within the European Union.
| Provider | Purpose | Location and transfers | Safeguards | Retention |
|---|---|---|---|---|
| Supabase Pte. Ltd | Sign-in identities, confirmation, sessions and MFA. | Project in Ireland (eu-west-1); other processing and access follow the agreement. | DPA and Standard Contractual Clauses | Account for its lifetime; request deletion through Contact. Free provides access to one day of logs, without proving complete erasure within 24 hours. Accessible logs |
| Resend · Plus Five Five, Inc. | Account confirmation, recovery, purchase confirmations with PDF, billing updates, withdrawal acknowledgements and email delivery tracking. | Sending from Ireland; content and logs stored in the United States. | DPA and Standard Contractual Clauses | Published Free retention: 30 days for email/log data; backups: 7 days; remaining data deleted within 90 days after termination. GDPR information |
| Google Workspace | Contact mailbox and operator correspondence. | Business Starter has no EU Data Regions policy. Processing may occur in countries with Google/subprocessor facilities. | CDPA and transfer safeguards · Editions and regions | During handling, then minimal evidence for 180 days after closure outside a dispute, with manual review and erasure. The CDPA has a separate technical deadline after a deletion instruction. |
| OpenAI Ireland Ltd · ChatGPT Sites | Hosting, application data and files; Cloudflare D1/R2. | No exclusive EU residency established; provider access and transfers follow their arrangements. | Sites DPA: Standard Contractual Clauses or adequacy · Subprocessors | Account and publication needs described here; return/deletion on instruction when the agreement ends. The 30-day local backup programme is separate. |
The Workspace contracting table identifies Google Cloud France for French billing addresses, unless a specific agreement defines a different entity. Google contracting entity.
A log-access window does not prove actual erasure. Use Contact for access, erasure and information about safeguards. Legal requirements and documented exceptions for an actual dispute may require separate retention.
Retention and erasure
Data needed for an account and its functions is kept for the life of the account. Saved entries and follows are removed when you delete them. Preferences are replaced or removed when you change them or request erasure.
An application and pending files are kept during review and, if you wish to continue it, during the exchanges needed to correct it. Approved creations and their information are kept while their publication is requested and authorised. You can request withdrawal or erasure through Contact. Data no longer needed must then be erased, subject to separately justified retention for an applicable legal duty or an actual dispute.
Hiding or unpublishing content removes its visibility; it does not by itself erase files, the dossier or every decision record. An account deletion request withdraws visible content and disables access, followed by administrator action for the Supabase identity and the file deletion queue.
Account-restriction decisions are kept while the measure applies. Minimal useful evidence is reviewed 180 days after the measure is closed, then erased manually when no longer necessary, subject to an actual appeal, dispute or justified preservation duty. Suspension does not erase an account; you can request access or erasure through Contact even when sign-in is blocked.
Private copies registered in the local backup programme have a 30-day retention period from creation. A daily check deletes expired copies when the PC and Codex can run it; if they are off, cleanup happens on a later check. This rule concerns independent copies managed on the operator’s PC and does not guarantee erasure of providers’ copies.
Deletions and access revocations made after a backup must be reapplied before a restored service reopens. Recovery copies remain restricted to that purpose.
Rejected creator dossiers, rejected genre requests and closed reports are reviewed 180 days after their last change. Hidden reviews and comments are reviewed 90 days after their last change or latest moderation decision. A notice actually sent to the person and another 30 full days are required before erasure. Linked files or creations, related reports, appeals or a justified preservation obligation block erasure.
Pending applications and pending, rejected or withdrawn creations are reviewed after 180 days without a change. The administrator contacts the author and reviews useful files individually. This review does not automatically erase accounts, creations or files. A profile modification date is not evidence of account inactivity.
Expired sign-in sessions and flows, expired security counters and completed upload metadata may be cleaned after their effective expiry. Cleanup summaries containing only counts are kept for 180 days. Previously consumed invitation keys remain unusable; erasure must never enable their reuse.
Application cleanup is manual, after a simulation, a recent sign-in and an authenticator check. Bounded batches recheck current state, dependencies and preservation exceptions. An exception for an actual dispute, appeal, rights request or legal duty identifies the necessary records and has a review date within 180 days; it never releases automatically. The operator sends notices manually; this tool does not send them.
Correspondence is kept while a request is handled; minimal evidence of the response is reviewed 180 days after closure. Verification documents that are no longer needed are erased after verification. Correspondence review and erasure are manual in the mailbox, subject to the same justified exceptions. Provider-specific periods and limits are described separately below.
Recovery copies on the operator’s PC
The operator currently creates recovery copies manually and stores independent copies on their PC. They include application records and uploaded files, plus a separate private snapshot of sign-in accounts and identities, which may contain email addresses, technical IDs, metadata and password hashes. A new encrypted Auth archive includes verified TOTP authenticator secrets for account recovery. Earlier account CSV/JSON snapshots exclude authenticator secrets and remain separately stored without archive encryption. Active sessions, temporary sign-in codes and unverified factors are excluded. This targeted copy is not a complete backup of provider settings.
Weekly renewal is assisted: the operator must download the export and enter secrets locally. New pairs are encrypted and verified before registration in the 30-day retention programme. Deletion checks are scheduled daily and depend on the PC and Codex being available. The registered earlier copies also have a 30-day deletion check. A local test validated recovery of the tested account using its password and authenticator; other accounts, Google sign-in and recovery of all project settings require separate verification.
Account deletion
My account > My data offers a permanent deletion request. A recent sign-in and confirmation are required. The request disables access and withdraws your public content. Support removes the Supabase sign-in identity, then files and application records are erased through a resumable queue. Your Google account is unaffected. The owner account requires an ownership transfer before deletion. A minimal deletion reference is retained to prevent accidental restoration; backups must respect subsequent deletions.
Your rights and our responses
You may request access, correction, erasure, restriction or, when the conditions apply, portability of your data. You may also object to processing based on legitimate interests. A minor whose data remains in an earlier dossier can contact us to exercise their rights; a legal guardian’s assistance can help but is not a universal prerequisite.
Use the Contact channel shown on the site. We respond without undue delay and normally within one month of receipt. If a lawful extension is needed because of the complexity or number of requests, we will explain the reasons during that first month.
We check only what is necessary to respond for the correct account. Evidence of identity may be requested where reasonable doubt exists, with an explanation; do not send an identity document unsolicited.
The My data download contains a limited copy of application data. It does not replace a complete response including information held separately by providers where needed. You may complain to the CNIL.
Private report alerts
When management alerts are enabled, a new report automatically queues a minimal email to the operator at contact@vers-ai.com. It contains the report reference, date and a protected administration link, without the reported text or file or the reporter’s identity. Resend sends the email and receives these technical references. The full case remains in private administration.
VersAI keeps the sending queue, identifiers, dates and states needed for retry, and minimal signature-verified delivery events. Acceptance by Resend does not prove delivery; delivery proves neither reading nor case review. After failure, retry depends on management activity or a manual action; no permanent autonomous monitoring or retry is claimed.
Alerts with no pending retry become eligible for bounded cleanup after 90 days without activity, once the case is also closed and has no recent activity. Open, recent or justifiably preserved cases are kept; related events are deleted with the alert. This period covers VersAI’s technical follow-up, separately from the moderation case, Resend’s retention and copies in the operator’s mailbox.
Provider agreements
For hosting this site from France, the ChatGPT Sites terms and their data processing addendum cover data collected after publication; OpenAI Ireland Ltd acts as processor. Data sent in conversations to create the site follows a separate framework. Standard Supabase and Cloudflare Self-Serve agreements incorporate their processing addenda; Resend states that its DPA is executed at sign-up. Applicable versions, any account-specific terms and each provider’s own processing must remain documented.
ChatGPT Sites DPA · Supabase Terms · Resend GDPR · Cloudflare Self-Serve
Account bot protection
Cloudflare Turnstile protects sign-in, sign-up, recovery forms and, where offered, the start of Google sign-in. This security check may process the IP address, browser and connection signals including User-Agent and TLS fingerprint, the public widget key and origin. VersAI uses it for its legitimate interest in preventing abuse (Article 6(1)(f)), separately from advertising.
Cloudflare processes signals for VersAI to protect these forms; its notice also describes processing controlled by Cloudflare to improve bot detection. Temporary tokens are transmitted for validation, not archived by VersAI. This integration does not enable cf_clearance pre-clearance and is neither advertising consent nor age verification. Cloudflare’s notice describes its processing and safeguards. Its standard Self-Serve agreement incorporates its data processing addendum for its processor role; account settings, transfers and service retention must be documented separately.
Private contribution identification archive
A separate private archive records operations on profiles, applications, files, creations, albums, reviews, comments and category requests: the internal author reference, item reference, operation and UTC date. It keeps identity data actually collected, including known emails and declared legal names, plus relevant pseudonyms and account references. It requests neither birth dates nor identity documents and keeps neither passwords nor MFA secrets.
Identity, account data and technical context are encrypted. An available connection source may be an IP address supplied by hosting or a session digest that is not a reusable sign-in token; it does not prove civil identity. Operations are kept for one year from their date; after account closure, actually collected civil data has a five-year expiry and account information a one-year expiry. The available connection source and protocol have a one-year expiry per operation under the technical duty in Article 5 of Decree 2021-1362, independently of the annual Article 6 injunction for publication metadata. Decree 2026-920 renews that injunction from 21 October 2026. The service requires review before new publication at the configured boundary; this internal safeguard does not mean the law automatically requires closure. Necessary removal and erasure remain possible. Expiry does not itself erase records: private cleanup is manual, bounded and checks actual preservation exceptions.
This retention concerns applicable contribution-identification duties (Article 6(1)(c)), separately from wallets, adult declarations and security. It permits neither general tracking of all visits nor unlimited retention. Relevant records remain available to the authorised operator and legally entitled authorities; request your own records and explanations through Contact. The archive does not reconstruct missing past facts, and data held by providers may require a separate response.
Transactional emails and delivery tracking
Resend receives the recipient address, subject, message content and, for payment documents, their PDF copy. Confirmations and updates contain the references, offer, amounts, dates and states relevant to your order or subscription; a withdrawal acknowledgement contains the declared information needed for your request. These messages provide the requested service and, where required by law, confirm the contract or receipt of the declaration. They do not subscribe you to a newsletter.
VersAI keeps technical sending references and preparation, acceptance, delivery, delay or failure states to track delivery and retry without duplicates. Provider acceptance does not prove delivery. Tracking notifications do not contain a complete card number. Resend publishes 30-day email and log retention for Free, Pro and Scale plans, 7-day backups, and deletion of remaining data within 90 days after its account is terminated. Its standard DPA is incorporated at sign-up. These periods are separate from VersAI’s retained evidence and copies in your mailbox; justification for keeping financial and delivery evidence must be confirmed before real sales.
Earlier adult declaration and acceptance records
Earlier records keep the version, language, acceptance date, access expiry and exact copy of the declaration and terms shown at that time. Current browsing and free creations require no new adult declaration. The record is linked to a technical visitor identifier or, after sign-in, to the account. It documents the rules actually accepted at that time and supports rights requests or an actual dispute. This mechanism requests neither a birth date nor an identity document; the declaration does not independently prove your age.
Earlier visitor access records become eligible for cleanup 30 days after their access expiry; erasure takes place in bounded cleanup batches. For an account, cleanup during a confirmation removes bounded batches of intermediate records expired for at least 30 days, keeping the first and last for each version, language and exact rules copy. Still-valid and recently expired records and accounts or creator dossiers protected by an actual preservation exception are kept. Remaining records follow the useful life of the account and are erased during its cleanup, unless separately retained in a proportionate, justified way for a rights request, dispute or actual obligation. Such exceptions must be reviewed and do not permit unlimited retention. Necessary financial evidence has separate handling. Cookie expiry does not itself guarantee erasure of the server record.
Accepting the terms does not waive the rights below. Earlier minor declarations and any authorisations are historical data; they permit no new upload or publication.
Accepted rules
Terms of use and contribution rules · Access cookie and other cookies
Wallet data
The server keeps the balance, monthly period, grants and debits, and unlocked creations with their expiry. These private records provide the requested access and prevent duplicate debits. They are not public and are included in account exports. Account deletion removes its application wallet; necessary financial evidence is handled separately.
Stripe and payment evidence
Card details are entered on Stripe’s secure page. VersAI does not receive or store a complete card number or its security code. Stripe receives the information needed for payment, including a technical account reference, the offer, amount and currency, and directly processes billing details entered on its page.
VersAI keeps Stripe references for the customer, order, payment, invoice and subscription, relevant amounts, states and dates, terms acceptance and credit adjustments. These tables contain neither complete Stripe notification payloads nor card data. Records stay private and account-related items appear in its bounded application export.
Account deletion does not automatically erase payment, refund or dispute evidence that remains necessary. The retention period and justification must be confirmed before real sales; access is restricted and records must be reviewed and erased when retention is no longer justified. Copies held by Stripe are also governed by its obligations and privacy information.
Legal bases for processing
| Requested or necessary processing | Basis |
|---|---|
| Account, sign-in, chosen profile, saved lists, creator follows and settings saved at your request | Performance of the requested service (GDPR Article 6(1)(b)), only for data objectively necessary for these functions. Profile options remain optional. |
| Historical evidence of accepted rules, earlier declarations and authorisations, defence of an actual dispute | Legitimate interests in documenting the rules actually accepted and protecting rights (Article 6(1)(f)), with private, limited and reviewed retention. A specific legal duty may separately require certain records (Article 6(1)(c)). |
| Creator application, requested review of files and availability of approved creations | Pre-contractual steps at your request and performance of the publication service (Article 6(1)(b)). The necessary publication rights and authorisations must be established. |
| Reviews and comments you choose to publish and manage | Performance of the requested contribution service (Article 6(1)(b)). |
| Access restrictions, abuse prevention, account security, backup and recovery | Legitimate interests in protecting the service, accounts and data (Article 6(1)(f)), with limited access and retention necessary for that purpose. |
| Reports, moderation and protection of people and third-party rights | Legitimate interests in maintaining a safe catalogue and respecting people’s rights (Article 6(1)(f)); a legal obligation for actions expressly required by applicable law or a valid order (Article 6(1)(c)). |
| Third-party information supplied in a contribution, report or rights request | Limited review to protect people and rights (Article 6(1)(f)), or a specific applicable legal obligation (Article 6(1)(c)). The contributor’s contract does not by itself provide a contractual basis for another person’s data. |
| Responses to personal-data rights requests | Compliance with GDPR obligations concerning these rights (Article 6(1)(c)). |
Security, abuse prevention and moderation are not used for behavioural advertising. You can object to processing based on legitimate interests by explaining your situation. We will assess the request and explain our response.
The legitimate-interest assessment must consider people’s rights, including where an earlier dossier concerns a minor. Any feature relying on consent will require a separate, appropriate choice; accepting the terms of use does not consent to every use of data.
Your profile and privacy
A profile photo and profile text are optional. You can keep a pseudonym and an avatar without using a personal photo. Your display name, chosen photo and visible contributions can be seen by people who can access the site.
You can prefer a pseudonym and an avatar. Avoid publishing an address, telephone number, birth date or location. Do not post another person’s photo or personal information without the necessary authorisations.
You can edit your profile, replace or remove your photo and request deletion of data. If content makes you uncomfortable or reveals your personal information, use Contact or the report button; an identity document is not needed simply to contact us.
Application export
My data downloads a bounded JSON export: each collection shows its total, limit and any truncation. File metadata is included, but file bytes and provider records are excluded. You can remove your own reviews and comments in your account.
Internal audience statistics
VersAI counts successful public page loads on the server and estimates visitor numbers to understand use of its own site, based on its legitimate interest (GDPR Article 6(1)(f)). This measurement sets no cookies, reads or creates no local storage and loads no measurement script in your browser. Recognised bots, preloads, technical files and API requests are excluded; the operator’s visits to public pages may be counted.
To reduce duplicates, the server calculates a site-specific HMAC digest from the connection address supplied by hosting and limited browser categories (family and major version, operating system and device category). Statistics tables keep neither raw IP addresses nor raw User-Agent strings, visited page paths, link parameters or referrers. The digest is pseudonymous data, not proof of identity: people using a similar network and browser can be grouped together, and one person can be counted more than once when changing device or connection. Without a usable technical source, only a page load may be counted and the visitor estimate is marked incomplete or unavailable.
Statistics and daily digests are used only for aggregate reports restricted to administration; they are not linked to account identifiers or payments and are not used for advertising or tracking across sites. Data older than thirteen calendar months is excluded from reports. It is deleted in batches on subsequent eligible visits or dashboard reads; expired data may therefore remain until those operations without being used in reports. Commercial evidence follows its separate retention rules.
The server respects the browser signals Do Not Track (DNT: 1) and Global Privacy Control (Sec-GPC: 1) by excluding the visit from this internal measurement. You may also request review of an objection or further information through Contact. These signals and internal measurement remain separate from advertising choices and Google’s consent message.
Google advertising and your data
Advertisements remain disabled on VersAI Safe. The Google consent message may load in the catalogue, subject to the rights applicable to your visit, even before the site receives advertising approval. Showing this message enables no advertisements and does not mean you have consented.
Loading the message involves connections to Google, which may receive technical data needed to provide it, including an IP address and browser information. The message presents the available choices and relevant partners.
Advertisements may be offered during beta after Google approves the site, a certified CMP is published, and the configuration and membership rights are verified. All these conditions must be met before activation.
Possible data and purposes
When an advertisement loads, Google and the relevant partners may receive an IP address, cookie identifiers, browser information, visited pages and advertising interactions. Purposes may include ad selection and personalisation, measurement and fraud prevention. The consent message explains purposes, applicable legal bases and choices for each partner. Cookies and personalisation require your consent where required.
If advertising is enabled and your choices allow it, third-party providers, including Google, may use cookies to serve advertisements based on previous visits to VersAI or other websites. Google and its partners may personalise advertisements subject to your settings and eligibility.
Google and other partners
The prepared settings use Google’s list of commonly used advertising partners, including Google Advertising Products. The selection may change; the public reference list does not mean that all listed partners currently receive your data.
Open “Ad partners” in the consent message to see the actual partner selection, purposes and each partner’s privacy links.
Google partner reference list and privacy policies · How Google uses data on partner sites
Refuse, change or withdraw consent
Refusing the requested advertising permissions prevents advertisements from loading in this version of VersAI. When the server confirms your entitlement to an ad-free membership, no advertising script or advertising CMP loads. If those rights cannot be verified, advertising stays blocked.
To change or withdraw consent, return to the Catalogue and use “Privacy choices” in the footer before opening sign-in or your account. No account is needed to make this choice when it is offered for your visit. Refusing advertising permissions does not block catalogue browsing, free creations or account registration. Withdrawal blocks advertising; if advertisements have already loaded, VersAI reloads the page to stop them running.
You can also manage personalisation in Google My Ad Center and, where offered, partners’ settings linked from their privacy policies. These settings complement your choices on VersAI; they do not replace the consent requested by its CMP.
This privacy page and the cookies page load neither advertisements nor an advertising CMP message. The Catalogue link lets you reach the available choices without embedding those tools on these pages.