Privacy.

0x01 // scopeWho We Are

Verseta Labs ("Verseta", "we", "us") builds self-learning inference: a model endpoint your apps call in place of their usual model provider. Verseta watches that traffic, finds the jobs your agents repeat, trains a small specialist model for each one, and routes a matching call to its specialist once it has proven as good as your original model. Everything else goes to your original model.

This policy covers verseta.ai and the Verseta service: the model endpoints, the customer portal, and the specialists we train. Verseta is in early access with a small number of design partners. If your organization has a signed agreement with us, that agreement controls where it differs from this page.

For the traffic you send through Verseta, your organization decides what goes in it and why; we process it on your behalf to provide the service.

0x02 // this websiteverseta.ai

This site is static. It sets no cookies, runs no analytics or tracking, and loads no third-party scripts, fonts or images. Amazon CloudFront, which delivers the pages, necessarily handles your IP address, browser user agent and the address you requested in order to serve them; we have not turned on access logging.

If you email us, we keep the email and your address so we can reply and follow up.

0x03 // what we storeWhat The Service Stores

• Account data. Your email address and sign-in records (through Amazon Cognito), plus your workspace's agents, routes and settings.
• Verseta API keys. Only a one-way hash. We can't read a key back after we show it to you once.
• Your model-provider keys. If you give us an Anthropic or OpenAI key so we can forward your calls, it is encrypted with an AWS KMS key, bound to your workspace and that purpose, used only to make those calls, and never shown back except masked.
• Traffic traces. For each successful call: the full request (system prompt, messages, tool definitions, tool calls and results, model settings) and the full response, with metadata such as the time, agent, model, token counts and latency. Traces are the training data. They are stored in Amazon S3, encrypted at rest.
• Usage counters. Daily request and token counts per agent, for your dashboard and billing.
• Operational logs. Metadata only: request ID, workspace, agent, status, latency and token counts. Logs never contain prompts, responses or keys.
• Specialists. The models we train on your traces, and their quality scores against your original model.

Prompts carry whatever your users and agents put in them, which can include personal data. Don't send protected health information, payment card numbers or government identifiers through Verseta unless we have agreed to it in writing. We do not sign business associate agreements yet.

0x04 // how it's usedHow We Use It

• To run the service: authenticate your calls, route each one to a proven specialist or to your original model, and forward it to your provider when needed.
• To train your specialists: we group your traces into the jobs your app repeats and fine-tune a specialist for each job on them. Training runs on GPU machines Verseta operates.
• To prove and watch them: each specialist is judged against your original model on your traffic before it takes a job, and keeps being judged after. These checks may send samples of your traces to Anthropic or OpenAI models under Verseta's API account, whose API terms do not let them train on that data.
• To support and secure the service: answer your questions, debug problems you report, and detect abuse.
• To talk to you about your account and the service.

We do not:

• use your traffic to train, tune or evaluate anything for another customer, or any shared, general-purpose or base model;
• let one workspace's data or specialists serve another workspace;
• sell your data, share it for advertising, or use it to profile your users;
• publish results from your workspace without your written permission.

0x05 // retentionHow Long We Keep It

When a trace is deleted, any specialist already trained on it stays until you remove that specialist.

0x06 // your choicesYour Choices

Email admins@verseta.ai to get a copy of your traces, delete some or all of them, delete specialists, or close your account and delete everything. We act on requests within 30 days and confirm when it's done.

If you are an end user of one of our customers' apps, your request is best sent to that customer, since they decide what their app sends us. Write to us and we'll pass it on and help them act on it.

Depending on where you live, you may have rights to access, correct, delete or export your personal data, or to object to how it is used. Email us to use them; we won't treat you differently for doing so.

0x07 // subprocessorsWho Else Processes It

Calls Verseta forwards to your own model provider with your key are made under your account with that provider, and its terms with you govern them.

We'll update this list, and email customers, at least 14 days before a new subprocessor starts handling your traffic.

0x08 // securitySecurity

Traffic is encrypted in transit with TLS and stored encrypted at rest. Every read and write is scoped to the signed-in workspace or the workspace of the calling key. Each part of the service has only the AWS permissions it needs. Keys are hashed or encrypted, and logs exclude content.

We design toward the controls in SOC 2, HIPAA, ISO 27001 and HITRUST, but Verseta is not certified or audited under any of them. If something goes wrong that affects your data, we'll tell you promptly.

Verseta is a business service and is not meant for children.

0x09 // changesChanges

When this policy changes, we update the date at the top. For a change that affects how we use or share customer traffic, we email customers before it takes effect.

0x0A // contactContact

Questions, requests or security reports: admins@verseta.ai.