Legal
Privacy Policy
1. Who is responsible
Ctruh Technologies Private Limited ("Ctruh", "we") runs Verse and decides how the personal data described here is used. For paid plans, Dodo Payments acts as merchant of record and is responsible for the payment data it collects at checkout. Contact: hello@ctruh.com. Grievance Officer under Indian law (IT Rules, 2011 and the Digital Personal Data Protection Act, 2023): Jayant Siktia, Director, CEO's Office, Ctruh Technologies Private Limited, 3rd Floor, Obeya Silk, Siddappa Layout, Madiwala Post, Bommanahalli, Bengaluru, Karnataka 560068, India · legal@ctruh.com.
2. What we collect and why
| Data | Where it comes from | Why |
|---|---|---|
| Account: the name you give, an account id, a secret account token, plan and subscription status, Studio seat members, brand-kit logo | You, in Studio | To run your account, apply your plan and show your brand |
| Uploads: 3D models, floor plans, images and the files we derive from them (compiled scenes, previews, furnished layouts, exports) | You, through the browser, the plug-ins, the API or WhatsApp | To convert, store and stream your scenes to the people you share them with |
| Viewer analytics: per-scene opens and, every ~2 s while a scene is open, a row with a random session id, position and view direction in the scene, and whether it was streaming or stalled | The viewer and embeds | To show owners where visitors went and to fix slow loading. No IP address is stored with these rows. Viewers opt out with Do-Not-Track, ?analytics=0, or the embed option analytics: false. |
| WhatsApp: your phone number, WhatsApp profile name, the messages and files you send and our replies | You, by messaging Verse on WhatsApp (via Meta) | To answer you and turn your files into scenes; to follow up if you asked us to |
| Enterprise callback: name, company, phone, email, team size, use case, message | The form on /pricing | To call you back as promised |
| Payments: Dodo (or Razorpay) collects card / UPI details, billing address and tax details. We receive only the customer and subscription ids, status, plan and period dates — never card numbers. | The payment provider | To apply the plan you bought |
| Technical logs: IP address, user agent, request paths, errors; a rate-limit counter keyed by a hash of the IP | Your browser or client | Security, abuse prevention, rate limits and debugging |
Legal bases where these apply: performing our contract with you (account, uploads, plan), your consent (WhatsApp, callback, optional analytics), and our legitimate interests (security, product improvement). We do not sell personal data and do not use it for third-party advertising.
3. Cookies
Verse uses a few first-party cookies: a sign-in cookie holding your session after you log in, and on staging/preview sites a cookie that remembers the site password. We also use one functional first-party cookie, verse_src, to remember the website, campaign or link that first brought you to Verse. It lasts 7 days, holds only short labels (the source, medium and campaign of the link, and the domain of the site you came from), and is saved with your account when you sign up so we can see which sources bring in customers. It is not used for advertising and is not shared. We do not use advertising or cross-site tracking cookies. The viewer may keep small preferences (such as theme or currency) in your browser's local storage.
4. Who we share with
- Hosting and storage (Railway, and an S3-compatible object store where enabled) — to run the service and keep backups.
- Dodo Payments (merchant of record) and Razorpay — to take payments.
- Meta (WhatsApp Cloud API) — to send and receive WhatsApp messages.
- Anthropic — to generate Verse Chat answers from the text of your question.
- An email provider (Resend) — to send transactional and sales emails.
- Viewers — anyone you give a scene link or embed to sees that scene.
- Authorities, when the law requires it.
Some of these providers process data outside India, including in the United States. [Counsel to confirm cross-border transfer wording under the DPDP Act / GDPR.]
5. How long we keep it
- Account-owned scenes: as long as your account exists, or until you delete them.
- Scenes uploaded without an account: they may be removed automatically when storage is needed, least recently viewed first.
- Viewer analytics raw rows: a rolling window (about the last 64 MB of rows); owners' aggregated heatmaps and counts are kept with the scene.
- Metadata backups: 30 days.
- WhatsApp conversations and callback leads: [retention period to be set — proposed 24 months].
- Billing records: as long as tax law requires.
6. Your rights
You can ask to access, correct or delete your personal data, withdraw consent, or nominate someone to act for you, by writing to hello@ctruh.com. We will answer within 30 days. You can also complain to the data protection authority where you live. Deleting your account deletes its scenes; payment records held by Dodo or Razorpay are governed by their policies.
7. Security
Data travels over HTTPS. Account tokens are compared in constant time and kept in state files that are never publicly served; payment webhooks are signature-checked. No system is perfectly secure; we will notify you and the authorities of a breach as the law requires.
8. Children
Verse is for businesses and adults. It is not directed at children under 18, and we do not knowingly collect their data.
9. Changes
We will post changes here and, for material changes, tell account holders before they take effect.