Privacy Policy
Last updated: 2026-11-08 · effective from that date
1. Who we are
SuVerse is operated by SuVerse LLC, a Florida company. Contact for everything on this page: info@suverse.io.
2. What SuVerse is
SuVerse is a catalogue of local businesses for AI assistants («agents»): one card per business with what it sells, its prices and the links to order, book or contact it. Agents read the cards through our MCP server (https://www.suverse.io/mcp). Business owners use www.suverse.io to find, claim and edit their card. Every card also has a public page at /b/{name}.
3. Data we collect
a) Public business information
From the business's own website, from Google Places and from other public pages: name, address, telephone, the business e-mail shown on its site, opening hours, menus, products and services, prices, links to order or book. Each value keeps the page it was read from. To read public web pages we use our own reader; pages are fetched with robots.txt respected, sometimes through a network proxy provider. AI models help read the text of public pages.
b) Business owners who claim or edit a card
- The contact you choose to confirm with — always an e-mail or telephone number already published by the business — and the code we send (stored only as a hash; it expires after 15 minutes).
- If you confirm through our Telegram bot: your Telegram chat id. If you press «Share my phone», the number of your own Telegram account is compared with the number on the card and not stored.
- The changes you make to your card, and when you made them.
c) Connected stores (Shopify, Square)
- Shopify (read-only scopes
read_products,read_inventory): products, variants, images, prices, currency, stock, and the store's name and domains (to match the store with your card). We do not read customers or orders. - Square: your business profile, items, inventory, appointment services and free slots, and your online-store site list. Square's permissions also let us create an order or a booking when an agent asks for one on a customer's behalf — then the customer's name and contact given for that order or booking are passed to Square and kept with the order record.
- Access tokens are stored encrypted (AES-256-GCM) and used only for these reads and the orders and bookings agents request.
d) Visitors and agents
- Your IP address is turned into a one-way hash for rate limits; the address itself is not stored. To show nearby businesses first, we look up an approximate city from the IP in a database on our own server — the address is not sent to anyone for this.
- Requests to our MCP server: the tool, its parameters (for example the search words and the place) and timing, kept for 90 days to improve search. Agents do not need an account, and we do not store their IP addresses with these requests — only a short keyed hash of the address, which cannot be turned back into it, to tell clients apart and apply limits. For quote_order the record includes the delivery address the agent sent.
- Technical logs (errors, timings) on our server, deleted after 14 days.
- Cookies: one,
versum_owner, set only after you confirm you own a business; it keeps you signed in for 2 hours. Our staff use one more (versum_admin). No advertising or analytics cookies.
e) Requests to a business
If a business that has claimed its card accepts requests on its /b/ page, the form sends your name, your e-mail or phone, the date and time you want and your message to that business — by e-mail or to its Telegram — and the business's answer back to you by e-mail.
f) What an AI assistant sends through SuVerse on your behalf
Some MCP tools act for a person. Assistants are told to use them only after the person has agreed. What each one passes on:
- request_to_owner — the text of your request is passed to the business's owner: what you want, the date and time, how many, which branch, your note, and your name and e-mail or phone. It goes to the owner's Telegram or e-mail (the channel the verified owner connected), or — for a business that takes requests on WhatsApp — into a WhatsApp link that you send yourself. We keep the request and the owner's answer, and we e-mail you a notice that it was sent and the owner's answer when your contact is an e-mail address.
- place_order — Shopify and Square: only the items and quantities; you give your details and pay on the platform's own checkout page, and we never see your card. A business that connected WhatsApp Business for orders: your contact and note are sent to the business as a WhatsApp message (through Meta).
- book_slot — your name, e-mail, phone (if given) and note are passed to the business's Square account, which creates a customer record and the booking there.
- quote_order — only the delivery address (postcode, state, city and, if given, street) is sent to the shop's own public cart to price delivery; no name, e-mail or phone. The address stays in our MCP request record (see d) and 7).
- We keep the order or booking record (items, status, and the customer details given for it) — see 7).
g) Counting links and page views
When someone opens a business's link through www.suverse.io/go/…, or views a /b/ or guide page, we count it with the time, the page or link, the referring site and the kind of browser (a person, a search engine or an AI crawler, from the user-agent). No IP address, no cookie and nothing that identifies you. For MCP clients we keep the client's own name and version (for example «claude-ai») with the keyed address hash described in d).
h) The open reader's shared cache
The open SuVerse reader can share the card it read from a public website with us: the page's public data, the reader's version and an anonymous install id (stored hashed again, with the sender's IP as a hash for limits). Turn it off with --no-share or VERSUM_SHARE=0.
4. How we use data
- To build and keep business cards current, and to answer agents' and visitors' searches.
- To confirm that a person claiming a card owns the business, and to keep owners signed in.
- To show a connected store's live items, prices and availability, and to pass on orders and bookings agents request.
- To deliver requests from visitors to a business and its answers back.
- To keep the service secure and within fair limits, and to fix errors.
5. Who we share data with
Service providers that process data for us: cloud hosting and our database provider (Supabase); e-mail delivery (Resend); Telegram (for owners who use our bot); Google (Places, for public business listings); Anthropic (AI models that read the text of public web pages — never owners' or customers' contact data); a network proxy provider (to fetch public pages); Shopify and Square (only for stores their owners connect). The businesses themselves receive what you or your assistant send them through SuVerse: a request (by Telegram, e-mail or a WhatsApp link you send), an order or a booking (see 3 f). A shop's public cart receives the delivery address for a quote. Business cards are public and are given to anyone who asks, including AI agents. We do not sell personal information, and we do not share it for advertising.
6. AI agents
Card data is public and is served to agents through the MCP server. The contact an owner confirmed with, codes, Telegram ids, the changes history and the requests visitors send are not given to other agents. An assistant that sent a request can read its status and the owner's answer with its request id. The telephone and e-mail on a card are the business's own published contacts.
7. How long we keep data
| data | kept |
|---|---|
| public business cards | while the business appears in public sources, or until it asks us to remove it |
| a confirmed ownership claim and the owner's changes | while the card is claimed; removed with the card |
| claims never confirmed | 30 days |
| requests sent to a business (through its page or by an AI assistant), with the owner's answer | 12 months |
| MCP request records (tool, parameters, timing, client name, keyed address hash) | 90 days |
| link and page-view counts (no personal data, see 3 g) | kept as statistics |
| cards shared by the open reader | 12 months |
| orders and bookings placed through a connected store (with the customer details given for them) | 24 months |
| store access tokens | until the store is disconnected or the app uninstalled |
| technical server logs | 14 days |
8. Your rights
You can ask to see, correct or delete personal data we hold about you: write to info@suverse.io. We answer within 30 days.
California (CCPA/CPRA). You have the right to know what personal information we collect and how we use it, to delete it, to correct it, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising. Send requests to info@suverse.io; we answer within 45 days.
EEA and UK (GDPR). We rely on legitimate interests to publish public business information and to secure the service, and on your request (contract) when you claim a card, connect a store or send a request to a business. You may access, correct, erase, restrict or object to processing, and receive your data; write to info@suverse.io (we answer within one month). You may also complain to your data-protection authority.
9. Business owners
To claim and edit your card, find it on www.suverse.io and choose «Verify it's me». To correct or remove your business, use «Remove this business» at the bottom of its page or write to info@suverse.io from a contact published by the business; we act within 30 days.
10. Shopify and Square
- Disconnecting a store on your card (or uninstalling the Shopify app) revokes our access on the platform where it allows it, deletes the token, and takes the store's live items off your card at once.
- Shopify's privacy requests: customer data request — answered and logged; we hold no Shopify customer data. Customer erasure — anything that could name that customer is deleted. Shop erasure (48 hours after uninstall) — everything about the store is deleted: the connection, its token, its items and any record of orders sent to it.
11. Security
Store tokens are encrypted; confirmation codes and IP addresses are stored only as hashes; owner sessions are signed and short; access to the database is limited to our service.
12. Children
SuVerse is not for children under 13, and we do not knowingly collect their personal information.
13. Promotion pages
What we keep. For a business named on a SuVerse promotion page (see the Terms, section 13) we keep: the facts on its SuVerse card; what we read on its own public website (only pages its robots.txt allows); the links to its social pages that its own website shows; every version of the pages we write, and who approved each one and when; for a programme page, the owner's photo permission (the exact sentence, when and by whom); the answers to the control questions we ask AI assistants by hand; and the counts in its reports.
What we do not collect. We do not log in to a business's accounts and do not read its private messages, customers, orders or sales. We do not read Facebook or Instagram pages automatically — their robots.txt does not allow it — and we do not collect personal data of people who follow or visit a business's social pages.
Visitors to SuVerse pages. We count visits and clicks on SuVerse's own links, telling people from robots by the browser's own description of itself. We keep no visitor profile and no visitor id, so we cannot tell how many different people visited. Clicks on our links pass through www.suverse.io/go/ so we can count them; the address you land on may carry a «utm» note saying the click came from SuVerse.
Models. Pages, checks and report explanations are written with Claude models from Anthropic, which are sent the business's public facts only — never a visitor's personal data.
Correcting and deleting. A business owner can correct any fact, ask us to take down any page, take back a photo permission, or ask us to delete the promotion material about the business by writing to info@suverse.io. We do it within 7 days and confirm by e-mail. The approval log (what was approved or published, when and by whom) is kept for 12 months and then deleted.
14. Changes
When this policy changes we update the date at the top of this page; important changes are also announced on www.suverse.io.
15. Contact
SuVerse LLC, Florida, USA · info@suverse.io