1. Scope and our role
This Privacy Policy describes how Versarial AI LLC ("Versarial," "we," "us") handles personal information in connection with its website and assessment services.
For our own business communications and administration, we determine the purposes and means of processing. For personal data in a customer-authorized assessment, the customer generally determines the purposes and instructions, and we act as its service provider or processor under a written data processing agreement ("DPA"). The actual roles depend on the engagement and applicable law.
This notice does not replace a customer’s privacy notice, lawful authorization, or DPA. If your information is processed in an assessment for one of our customers, that organization’s notice and instructions also apply.
2. What the website does today
The current inquiry form asks for a name, work email, company, assessment focus, plan interest, and description of a flow. Submitting the form sends those fields to Versarial by email through Web3Forms. The website does not store inquiries in a Versarial database.
Report downloads and animated results are marketing demonstrations, not records of tests performed on your systems. This website has no payment checkout or assessment account backend.
The site does not use advertising pixels, cookies, or browser storage for tracking. Page views are measured with Vercel Web Analytics. Hosting and infrastructure providers may process network information to deliver and secure the site.
3. Information an assessment may require
When an assessment is agreed, the scope and DPA must identify the data involved. Depending on the engagement, it may include:
- Business contact details, agreement records, and billing information.
- Target configuration, approved credentials, access permissions, and test-account information.
- Synthetic identity fixtures, device or network contexts, and permitted test communications.
- Requests, responses, application state, screenshots, logs, agent conversations, findings, and reproduction evidence.
- Run metadata, such as the tested build, time, scenario, outcome, and reviewer decisions.
Test evidence can incidentally include real personal data. Calling a profile synthetic does not make every identifier, phone number, IP address, or captured response non-personal. We should use sandbox fixtures and minimize or redact real data wherever feasible.
Live identity documents, payment-card details, highly sensitive data, and real user communications are outside the default scope. They require a specific need, lawful authorization, and agreed safeguards. Do not include them or API secrets in the website inquiry.
4. Purposes and legal grounds
We use information provided for an engagement to scope and deliver authorized assessments, produce evidence, verify fixes, manage agreed scheduled checks, support customers, administer contracts and payments, secure the service, and comply with applicable legal obligations.
Where data-protection law requires a legal basis for our own processing, the basis depends on the activity and circumstances. It may be contractual necessity, a legal obligation, a legitimate interest balanced against individuals’ rights, or consent where required. Sensitive data requires any additional conditions and safeguards applicable to that information.
For data processed on a customer’s behalf, we follow its documented instructions and the DPA. The customer must establish its own lawful basis and required notices or permissions.
5. AI and model training
AI-assisted tools may be used to generate scenarios or analyze permitted evidence when included in the agreed delivery model. Use of customer information with external model providers is subject to the applicable engagement and data-processing terms.
We do not use Customer Data, confidential assessment traces, or customer-specific findings to train or fine-tune models without a separate affirmative written agreement. Providers processing that information for us must follow the same restriction. Any optional permission must identify the data, purpose, protections, and applicable withdrawal arrangements.
Independently researched scenarios and expert knowledge are separate from confidential customer evidence. A scenario library does not authorize reuse of a customer’s confidential information.
7. Retention, return, and deletion
Inquiry messages sent from this website are delivered by email through Web3Forms. They are not stored in a Versarial inquiry database. We keep the email to respond and to manage any resulting engagement.
We retain service information for the period needed to deliver the agreed service, fulfill contractual obligations, resolve disputes, and comply with applicable law. The retention of credentials, raw traces, screenshots, reports, scenario history, and backups is governed by the applicable Order and DPA.
After an engagement ends, data return, deletion, credential revocation, and backup handling follow the agreed procedures and any applicable legal retention requirements. Retention may differ by data category and purpose.
8. Security and international processing
We use safeguards appropriate to the information and engagement, including agreed access restrictions, credential handling, evidence minimization, and incident-response procedures. No system or method of transmission can guarantee absolute security. Specific security commitments and customer notification obligations are set out in the applicable agreement and DPA.
Information may be processed in locations used by the providers supporting the website or agreed service. Assessment processing locations and any customer requirements are addressed in the engagement’s data-processing arrangements. Where required by applicable law, cross-border transfers are subject to appropriate safeguards.
9. Privacy requests and choices
Depending on applicable law and your circumstances, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to processing; withdraw consent; and complain to the relevant supervisory authority. Some rights have exceptions and may require proportionate identity verification.
For information processed in an assessment for one of our customers, contact that organization first. We assist it under the DPA and applicable law rather than independently changing its records or processing instructions.
For information you have provided directly to Versarial, contact your Versarial representative through the contact channel in your agreement or existing correspondence. Do not include sensitive identity documents in an initial request. You can also send a privacy request through the website inquiry form.
10. Children and external sites
Versarial is intended for business users, not children. The service is not intended to collect personal information from children. Assessments should not include real children’s data; any exception requires separate legal and scope review.
External sites and services have their own privacy practices. Following a link may involve processing governed by that site’s notice.
11. Changes to this policy
We may update this policy to reflect changes in our services, data handling, or legal requirements. The last-updated date identifies the current version. We provide additional notice or obtain consent when required by applicable law before a material change in how personal information is used.
See our Terms of Service for assessment authorization and service conditions.