Privacy Policy

Introduction

Vermoss (PTY) Ltd ("Vermoss", "we", "us") respects your privacy. This Privacy Policy explains how we collect, use, and protect personal information when you use our website, web dashboard, and mobile application.

This policy should be read together with our Terms of Service and Cookie Policy.

1. Who we are

• Responsible party: Vermoss (PTY) Ltd
• Contact: Use the contact form on this website.
• Jurisdiction: Republic of South Africa

2. Information we collect

• Account data: name, email address, password (hashed), organisation name.
• Billing data: business name, billing address, country, subscription plan and region.
• WhatsApp data: phone number identifiers, message content and metadata processed to provide inbox and automation features.
• Google Calendar data (when you connect Calendar): calendar events, busy times, and related calendar metadata needed to offer booking slots and create or update booking events. We also receive your Google account email and basic profile identifiers from the sign-in scopes used for that connection.
• Usage data: message counts, flow runs, feature usage, and security logs.
• Technical data: IP address, coarse country (for pricing), browser/device type, session identifiers.
• Support correspondence: emails and messages you send to us.

3. Why we process your information

• To provide and operate the Platform (contract).
• To bill subscriptions and prevent fraud (contract / legitimate interest).
• To enforce message limits, security, and acceptable use (legitimate interest).
• To improve the product and fix errors (legitimate interest).
• For marketing communications only where you have opted in (consent).
• When you connect Google Calendar: to check busy times, offer open booking slots in WhatsApp flows, and create or sync booking events on your calendar. We use this data only to provide that feature for your signed-in business. We do not sell Google user data.

4. Processors & third parties

• Meta Platforms, Inc., WhatsApp Cloud API (messaging delivery).
• Google LLC (Google Calendar API), when you connect Calendar for booking availability and event sync.
• Hosting and infrastructure providers.
• Email delivery providers.
• Payment processor (for subscription billing).
• Analytics providers, only if you consent to analytics cookies.

5. Google Calendar

Vermoss is a WhatsApp business inbox and scheduling product. If you connect Google Calendar, Vermoss requests access so we can read busy times and calendar events, and create or update events when customers book through your flows.

The Google scopes we request are calendar.events and calendar.readonly (read and write calendar events and busy times for booking), plus openid and email (basic Google account identity so we can link the connection to your signed-in business user).

Google Calendar data is used only to provide booking availability and calendar sync for your organisation. We do not sell it, and we do not use it for advertising. You can disconnect Calendar in product settings; after disconnect we stop new access and retain only what we still need for your account, legal obligations, or dispute resolution.

6. International transfers

Your data may be processed in South Africa and other countries where our processors operate. Where required, we rely on appropriate safeguards such as standard contractual clauses.

7. Retention

We retain account and organisation data while your account is active and for a reasonable period thereafter to meet legal, tax, and dispute resolution obligations.

Message content retention follows your organisation settings and applicable law. You may delete your account to request erasure subject to lawful exceptions.

8. Your rights

• Under POPIA and, where applicable, GDPR / UK GDPR: access, correction, deletion, restriction, objection, and data portability.
• Withdraw consent for optional cookies or marketing at any time.
• Lodge a complaint with the Information Regulator (South Africa) or your local supervisory authority.
• Use the contact form on this website to exercise your rights.

9. Children

The Platform is not directed at individuals under 18. We do not knowingly collect personal information from children.

10. Security

We implement reasonable technical and organisational measures to protect personal information. No method of transmission or storage is completely secure.

11. Changes

We may update this Privacy Policy. The "Last updated" date will change and material updates will be communicated where appropriate.

12. Contact

Privacy enquiries: use the contact form on this website.