Who we are (data controller)
This Privacy Policy describes how VERSE collects, uses, and protects personal data when you use our websites at verse.ad and hub.verse.ad, our advertiser, agency, and venue products, and any pairing software that runs on screens connected to the VERSE network. The data controller for the personal data described here is VERSE Ltd, a company registered in England and Wales under company number [Co. No. pending], with its registered office in London, United Kingdom. Engineering and operations are co-located in Tunis, Tunisia, and personal data may be processed by our Tunisian operating entity under a written intra-group data processing agreement.
For all privacy questions, including requests to exercise your rights under UK GDPR, EU GDPR, or the Tunisian Loi organique n° 2004-63 du 27 juillet 2004 relative à la protection des données à caractère personnel, you can contact us at privacy@verse.ad. Where a Data Protection Officer has been appointed for a particular product or jurisdiction, you can reach the DPO at dpo@verse.ad. We aim to acknowledge every privacy request within five working days and to provide a substantive response within thirty days, extendable by up to two further months where the request is complex.
Throughout this policy, "we", "us", and "VERSE" refer to VERSE Ltd and its affiliated operating entities. "You" refers to any user of our products, including individual advertisers, agency staff, venue operators, and people who simply visit our marketing site. We use plain English wherever possible, where we use a defined term, we explain it the first time it appears.
Data we collect
We try to collect the minimum data needed to operate the platform and to keep advertisers, agencies, and venues accountable to one another. We do not buy personal data from third parties, we do not build advertising profiles of individual viewers, and we do not place trackers on third-party sites. The categories of data we collect are described below.
Account data
When you create an advertiser, agency, or venue account, we collect your name, work email address, work telephone number, the company you represent, your role, and the country in which you operate. For agencies, we additionally collect the name and basic contact information of each advertiser client you onboard as a sub-account, because that relationship affects how invoices and reports are generated. For venues, we collect the trading name of the venue, the postal address where the screen is installed, and the name of the person responsible for the screen on site.
Campaign and content data
Advertisers and agencies upload creative files (images, videos, copy), define targeting parameters (geography, venue category, time of day, dwell estimates), build playlists, and schedule flights. Venues upload menus, in-house promotions, and brand assets. We treat all of this as personal data when it identifies an individual, and as confidential business data in all other cases. We do not reuse your creative or your menu content for any purpose outside the campaign or playlist you configured.
Engagement data
When a creative plays on a screen, we record an impression, a structured event containing the creative ID, the screen ID, the timestamp, and a coarse audience estimate based on venue category and time of day. When a viewer scans a QR code, we record the scan, the destination URL, and any query parameters that the advertiser configured, but we do not associate scans with named individuals. We rely on aggregated venue-level metrics for dwell estimates, not on individual viewer detection.
What we do not collect. VERSE does not collect biometric data. We do not run facial recognition, gait recognition, or any other technique designed to identify individual viewers. We do not deploy cameras as part of our standard pairing kit. Where a venue chooses to install third-party audience-measurement hardware, that activity is governed by the venue's own privacy notice, not by VERSE.
Device data
For every screen paired to the network, we collect the paired device identifier, the IP address used to connect to our backend, the browser or runtime in use (for example Chrome on Tizen, webOS, or Android TV), the operating system version, the configured orientation, and the online or offline status of the device. Device data is used to deliver the right creative at the right time and to detect outages. We log a connection event when a screen comes online and a disconnection event when it drops, so that downtime can be excluded from impression billing.
Payment data
Payments to fund advertiser wallets and payouts to venues are handled by Stripe, our payment services provider. When you enter card details into our checkout, those details are sent directly to Stripe and are never stored on VERSE servers. We retain the payment reference, the amount, the currency, the date, and the last four digits of the card or the bank account name where applicable, so that we can reconcile invoices and respond to chargebacks. For payouts to venues, we collect bank account details and beneficiary identification documents to comply with anti-money-laundering and tax reporting obligations.
Cookies and analytics
On verse.ad and hub.verse.ad, we use a small number of strictly-necessary cookies to keep you signed in and to remember your language and currency preferences. On verse.ad we use Google Analytics, provided by Google, to understand which pages people visit and how the site performs. If your device is set to a time zone in Europe outside the UK, Google Analytics loads, and sets its cookies, only if you accept analytics cookies in our cookie banner. Elsewhere, including the UK, it runs from your first visit and our banner tells you so. Wherever you are, you can change your choice at any time via "Cookie settings" in the footer. We describe the cookies we set in the Cookies section below.
Why we collect it (lawful bases)
Under Article 6 of the UK GDPR and EU GDPR, every use of personal data must rest on a lawful basis. The Tunisian Loi organique n° 2004-63 imposes a comparable consent-and-purpose framework. The table below sets out, for each category of data, the purposes for which we use it and the lawful basis on which we rely.
| Data category | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Account data | Create and operate your VERSE account, authenticate you, communicate about service changes | Performance of a contract (Art. 6(1)(b)) |
| Campaign and content data | Run, schedule, and report on campaigns and playlists you have configured | Performance of a contract (Art. 6(1)(b)) |
| Engagement data | Bill impressions, attribute conversions, improve forecasting | Legitimate interest in operating the network and being accurate to advertisers (Art. 6(1)(f)) |
| Device data | Deliver content to the right screen, detect outages, exclude downtime from billing | Performance of a contract (Art. 6(1)(b)) and legitimate interest in service reliability (Art. 6(1)(f)) |
| Payment data | Process payments, reconcile invoices, prevent fraud, respond to chargebacks | Performance of a contract (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c)) |
| Marketing communications | Send product updates and newsletters to people who opted in | Consent (Art. 6(1)(a)) |
| Tax and audit records | File VAT returns, respond to tax authorities, retain audit trails | Compliance with legal obligations (Art. 6(1)(c)) |
| Cookies and analytics | Keep you signed in, measure site usage | Strictly necessary; for Google Analytics, consent (Art. 6(1)(a)) in Europe outside the UK, and legitimate interests (Art. 6(1)(f)) with an opt-out elsewhere |
Where we rely on legitimate interest, we have carried out a balancing test and concluded that our interest does not override your fundamental rights and freedoms, taking into account the limited scope of the data, the absence of profiling, and your ability to object at any time. You can ask us for a copy of the relevant balancing test by writing to privacy@verse.ad.
Where we rely on consent, for example, for marketing emails, that consent is opt-in, granular, and revocable at any time without affecting the lawfulness of processing carried out before withdrawal.
How long we keep it
We retain personal data only for as long as we need it to deliver the service, to meet legal and tax obligations, or to defend legal claims. Specific retention periods are set out in the table below; where multiple periods could apply, the longer one prevails.
| Data category | Retention period |
|---|---|
| Account data | For the lifetime of the account, plus 6 months after closure |
| Campaign and content data | 7 years from the end of the campaign (UK + Tunisian tax and audit retention) |
| Engagement data (per-impression) | 24 months at row level, then aggregated and anonymised |
| Paired-screen device data | For the duration of the pairing, plus 30 days after unpair |
| Payment receipts and invoices | 7 years (HMRC and Tunisian tax retention) |
| Support and email correspondence | 3 years from the date of last contact |
| Marketing consents and unsubscribes | Indefinitely while we operate, to honour your preference |
| Cookies | Session-only or up to 12 months for stored preferences; Google Analytics cookies up to 13 months (see Cookies below) |
At the end of a retention period, data is either deleted or irreversibly anonymised so that it can no longer be linked back to you. Anonymised aggregate metrics, for example, how many impressions ran in a given venue category last quarter, may be retained indefinitely to support network-level reporting and forecasting.
Where we host data
VERSE's primary application infrastructure runs in AWS region eu-west-2 (London, United Kingdom). Encrypted database snapshots are replicated to AWS region eu-west-3 (Paris, France) for disaster recovery. Static assets and signed media URLs are served via Cloudflare's global edge network, with EU and UK points of presence preferred.
Operational data relating to screens paired in Tunisia, for example, device telemetry, local creative caches, and venue-level reporting, may be processed on Tunisian-hosted infrastructure to reduce latency and to comply with Tunisian regulatory expectations regarding data sovereignty. Where this is the case, the same security controls apply, and access is restricted to authorised VERSE engineers under written confidentiality and data-protection commitments.
We do not host production data outside the UK, the EEA, or Tunisia. If we ever need to expand our hosting footprint to another jurisdiction, we will update this policy and notify affected users at least 30 days in advance.
International transfers
Some of our sub-processors are headquartered in the United States or operate global infrastructure. Where a transfer of personal data leaves the United Kingdom or the European Economic Area, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses approved by the European Commission, depending on which set of laws applies to the transfer in question. We supplement these contractual safeguards with technical measures including encryption in transit, encryption at rest, and pseudonymisation of identifiers where practicable.
For transfers between the United Kingdom and Tunisia, we rely on the United Kingdom's adequacy regulations as they apply to the relevant Tunisian recipient, where available, and otherwise on the UK International Data Transfer Agreement. The European Commission has not, as at the effective date of this policy, issued a general adequacy decision for Tunisia under Article 45 of EU GDPR; transfers from EU controllers into Tunisia therefore rely on Standard Contractual Clauses and on additional technical and organisational measures, including end-to-end encryption of payloads and role-based access controls scoped to the minimum number of engineers required to operate the service.
You can request a copy of the contractual safeguards we use for any specific transfer by writing to privacy@verse.ad. We may redact commercially sensitive terms before sending them to you.
Your rights
Under UK GDPR and EU GDPR you have the following rights, which you can exercise by writing to privacy@verse.ad. We will not charge a fee unless your request is manifestly unfounded or excessive, in which case we will tell you and give you the option to refine your request.
- Access, ask for a copy of the personal data we hold about you, together with information on how we use it.
- Rectification, ask us to correct personal data that is inaccurate or incomplete.
- Erasure, ask us to delete personal data where we no longer need it, where you have withdrawn consent, or where you object and there is no overriding legitimate ground.
- Restriction, ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
- Portability, ask for the personal data you provided to us in a structured, commonly used, machine-readable format, and have us send it directly to another controller where technically feasible.
- Objection, object at any time to processing based on legitimate interest, including profiling. We will stop processing unless we can show compelling legitimate grounds that override your interests.
- Withdraw consent, where we rely on your consent, withdraw it at any time without affecting the lawfulness of processing already carried out.
- Complain, lodge a complaint with the supervisory authority in your country of residence, place of work, or the place where the alleged infringement occurred.
Tunisian users. If you are a resident of Tunisia or a Tunisian national, you have equivalent rights under the Loi organique n° 2004-63, including the right to access, rectify, and object to the processing of your personal data, and the right to lodge a complaint with the Instance Nationale de Protection des Données Personnelles (INPDP). The INPDP can be contacted via its public address in Tunis. We will respond to Tunisian rights requests on the same terms as UK and EU requests, in French, Arabic, or English at your preference.
We may need to verify your identity before responding, particularly for access and erasure requests, to make sure we do not disclose your data to someone else. Where your account is managed by an agency or a venue group, we may also coordinate with that organisation to ensure that fulfilling your request does not disrupt a service you depend on.
Children
VERSE is a business-to-business platform. The advertiser, agency, and venue products are not directed at children, and we do not knowingly collect personal data from anyone under the age of 18. The marketing site at verse.ad is open to anyone, but it is also not directed at children and does not deploy advertising or profiling tools that target minors.
If you believe we have inadvertently collected personal data from a person under 18, please contact privacy@verse.ad and we will delete the data promptly. Where a venue runs creative on a screen in a location frequented by minors, the venue and the advertiser are responsible for ensuring that the creative complies with applicable advertising-to-children rules; VERSE does not target ads to minors as a category.
Security
We protect your personal data using a layered set of technical and organisational measures. All traffic between your browser, our APIs, and our screen runtime is encrypted using TLS 1.3. Passwords are hashed using bcrypt with a per-user salt; we never store passwords in cleartext. Multi-factor authentication is available for every account and is required for accounts with billing or payout permissions.
Application access is governed by role-based access controls, with explicit checks at every endpoint to prevent insecure direct object reference (IDOR) attacks. Internally, engineers access production systems through audited bastion hosts, with privileged actions logged centrally and retained for at least 12 months. We align our application security programme with the OWASP Application Security Verification Standard (ASVS) v5, level 1, and we run automated and manual security testing on a regular cadence.
In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office and, where applicable, the relevant EU lead supervisory authority and the Tunisian INPDP, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in clear and plain language.
Changes to this policy
We update this policy from time to time, for example when we add a new sub-processor, launch a new product, or respond to a change in law. The "Effective" date at the top of this page tells you when the current version came into force. We keep an internal record of every previous version and can send you a copy on request.
For material changes, particularly any change that reduces the protections afforded to you, that expands the categories of personal data we collect, or that introduces a new sub-processor in a third country, we will give you at least 30 days' advance notice by email and by a banner on hub.verse.ad. Continued use of the service after the effective date constitutes acceptance of the updated policy. If you disagree, you can close your account before the effective date and we will follow the deletion timelines described in the Retention section.
Contact and complaints
For any privacy question, including a request to exercise your rights, write to privacy@verse.ad. Where a Data Protection Officer is in place for your product or jurisdiction, you can also write to dpo@verse.ad. Postal correspondence can be sent to VERSE Ltd, registered office in London, United Kingdom; the full postal address is available on request and on our public companies-house filing once registration is finalised.
If you are not satisfied with our response, you have the right to complain to a supervisory authority. The relevant authorities are:
- United Kingdom, Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; ico.org.uk.
- France, Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, 75007 Paris; cnil.fr.
- Tunisia, Instance Nationale de Protection des Données Personnelles (INPDP), Tunis; inpdp.nat.tn.
- Other EEA jurisdictions, your local supervisory authority, listed on the European Data Protection Board website.
We always prefer to resolve complaints directly. If you contact us first, we will treat your concern as a priority and will keep you updated until it is resolved.