Privacy Policy

Last updated: 7 March 2026

NB Performance Pty Ltd ABN 25 675 763 050, trading as VerusLink, ("we", "us", "our") operates the VerusLink platform, including the website at veruslink.au, the Vero AI assistant, and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose and protect personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information We Collect

We collect the following categories of personal information when you sign up for or use our Service:

Account information: your full name, email address, business name, phone number, and industry or profession.
Authentication credentials: hashed passwords for CRM login. We do not store plaintext passwords.
Gmail OAuth tokens: if you choose to connect your Gmail account, we store OAuth 2.0 access and refresh tokens issued by Google. These tokens allow the Service to read your inbox and create email drafts on your behalf. We access only the Gmail API scopes you authorise (gmail.readonly and gmail.compose).
Contact and CRM data: names, email addresses, phone numbers, business details, notes, and deal information for contacts you add to your CRM workspaces.
Payment information: billing details are collected and processed directly by Stripe. We do not store credit card numbers or full payment details on our servers.
Usage data: service interaction logs, feature usage, and error reports used to maintain and improve the Service.

2. How We Use Your Information

We use your personal information solely for the purpose of delivering, maintaining and improving the Service:

To create and manage your account and tenant workspace.
To provide AI-assisted email drafting, contact management, and workflow automation features.
To send transactional emails such as welcome messages, account notifications and service updates.
To process payments and manage your subscription.
To respond to support requests and communicate with you about the Service.
To monitor and improve the reliability, performance and security of the Service.

We do not use your personal information for advertising, profiling, or any purpose unrelated to delivering the Service.

3. Third-Party Service Providers

We share personal information with the following third-party providers, solely to the extent necessary to operate the Service:

Supabase (PostgreSQL hosting) — stores account data, CRM contacts, workspace configuration and OAuth tokens. Data is hosted in Supabase's cloud infrastructure. supabase.com/privacy

Stripe — processes subscription payments and coupon codes. Stripe receives your name, email and payment details. stripe.com/au/privacy

Resend — sends transactional emails from vero@veruslink.au. Resend receives recipient email addresses and message content. resend.com/legal/privacy-policy

Google (Gmail API) — when you connect your Gmail account, Google's OAuth system issues tokens that we store. We access your Gmail data only through the authorised API scopes. policies.google.com/privacy

Vercel — hosts our website and serverless API functions. Vercel may process request metadata (IP addresses, user agents). vercel.com/legal/privacy-policy

OpenAI — powers AI features within the Vero assistant. Prompts may include business context you provide but never raw email content or OAuth tokens. openai.com/privacy

We do not sell, rent or trade your personal information to any third party.

4. Gmail Data Usage

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only request the minimum scopes necessary to provide email-related features (gmail.readonly and gmail.compose).
We do not use Gmail data for advertising, market research, or any purpose other than providing and improving the Service features you have authorised.
We do not allow humans to read your email content unless you explicitly request support, you provide affirmative consent, or it is necessary for security purposes such as investigating abuse.
We do not transfer Gmail data to third parties except as necessary to provide the Service, as required by law, or with your explicit consent.

5. Data Storage and Security

Your data is stored in cloud infrastructure provided by Supabase and Vercel. We implement reasonable technical and organisational measures to protect your personal information, including:

Encryption of data in transit (TLS/HTTPS).
Row-level security policies on database tables to isolate tenant data.
Environment variable encryption for API keys and secrets.
Password hashing (SHA-256) for CRM authentication credentials.
Service-role key access controls for administrative operations.

No method of electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

Account and CRM data: retained while your account is active. Upon cancellation, your data is retained for up to 90 days before deletion to allow for account reactivation.
Gmail OAuth tokens: retained while your Gmail integration is active. Tokens are deleted when you disconnect your Gmail account or close your VerusLink account.
Payment records: retained by Stripe in accordance with their data retention policies and applicable tax and accounting obligations.
Usage logs: retained for up to 12 months for service monitoring and troubleshooting.

You may request earlier deletion of your data at any time by contacting us.

7. Your Rights Under the Australian Privacy Act

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

Access: request a copy of the personal information we hold about you.
Correction: request correction of any inaccurate, incomplete, out-of-date or misleading personal information.
Deletion: request deletion of your personal information, subject to any legal obligations requiring us to retain it.
Withdraw consent: revoke your Gmail OAuth connection at any time through your Google Account security settings at myaccount.google.com/permissions, or by contacting us.
Complain: lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have breached the Australian Privacy Principles.

To exercise any of these rights, please contact us using the details below. We will respond to your request within 30 days.

8. Cookies and Tracking

Our website uses localStorage in your browser to maintain your login session and CRM preferences. We do not use third-party tracking cookies, analytics platforms, or advertising pixels.

9. Cross-Border Data Disclosure

Some of our third-party service providers (Supabase, Stripe, Vercel, OpenAI, Resend) may store or process data outside of Australia, including in the United States. Where this occurs, we take reasonable steps to ensure that overseas recipients handle your personal information in accordance with the Australian Privacy Principles.

10. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on our website. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or want to make a complaint, please contact us:

NB Performance Pty Ltd, trading as VerusLink
ABN 25 675 763 050
Email: james@veruslink.au