Privacy Policy

Introduction

Vermoss (PTY) Ltd ("Vermoss", "we", "us") respects your privacy. This Privacy Policy explains how we collect, use, and protect personal information when you use our website, web dashboard, and mobile application.

This policy should be read together with our Terms of Service and Cookie Policy.

1. Who we are

• Responsible party: Vermoss (PTY) Ltd
• Contact: Use the contact form on this website.
• Jurisdiction: Republic of South Africa

2. Information we collect

• Account data: name, email address, password (hashed), organisation name.
• Billing data: business name, billing address, country, subscription plan and region.
• WhatsApp data: phone number identifiers, message content and metadata processed to provide inbox and automation features.
• Usage data: message counts, flow runs, feature usage, and security logs.
• Technical data: IP address, coarse country (for pricing), browser/device type, session identifiers.
• Support correspondence: emails and messages you send to us.

3. Why we process your information

• To provide and operate the Platform (contract).
• To bill subscriptions and prevent fraud (contract / legitimate interest).
• To enforce message limits, security, and acceptable use (legitimate interest).
• To improve the product and fix errors (legitimate interest).
• For marketing communications only where you have opted in (consent).

4. Processors & third parties

• Meta Platforms, Inc., WhatsApp Cloud API (messaging delivery).
• Hosting and infrastructure providers.
• Email delivery providers.
• Payment processor (for subscription billing).
• Analytics providers, only if you consent to analytics cookies.

5. International transfers

Your data may be processed in South Africa and other countries where our processors operate. Where required, we rely on appropriate safeguards such as standard contractual clauses.

6. Retention

We retain account and organisation data while your account is active and for a reasonable period thereafter to meet legal, tax, and dispute, resolution obligations.

Message content retention follows your organisation settings and applicable law. You may delete your account to request erasure subject to lawful exceptions.

7. Your rights

• Under POPIA and, where applicable, GDPR / UK GDPR: access, correction, deletion, restriction, objection, and data portability.
• Withdraw consent for optional cookies or marketing at any time.
• Lodge a complaint with the Information Regulator (South Africa) or your local supervisory authority.
• Use the contact form on this website to exercise your rights.

8. Children

The Platform is not directed at individuals under 18. We do not knowingly collect personal information from children.

9. Security

We implement reasonable technical and organisational measures to protect personal information. No method of transmission or storage is completely secure.

10. Changes

We may update this Privacy Policy. The "Last updated" date will change and material updates will be communicated where appropriate.

11. Contact

Privacy enquiries: use the contact form on this website.