Legal

Verlix Privacy Policy

Last updated: October 24, 2026

This policy explains what personal information VerlixAI, Inc. ("Verlix", "we", "us") collects, why we collect it, who receives it and the choices you have. It covers our marketing site at verlix.ai, our documentation at docs.verlix.ai, the Verlix platform at platform.verlix.ai, the Verlix API and the emails we send. It does not cover the websites or services of other companies, including the tools our customers connect to Verlix.

1. Who we are and the two roles we play

1.1 Verlix is a US company that provides a billing and revenue platform to businesses, whom we call our customers.

1.2 We act as a controller for the personal information we collect for our own purposes: from visitors to our websites, from people who contact us or subscribe to our updates, and from the people who use the platform on behalf of our customers, to the extent we use it to run our own business.

1.3 We act as a processor, or a service provider under California law, for the personal information our customers place in their Verlix workspaces. That includes information about our customers' own clients, whom we call end customers. For that information, the customer's own privacy notice applies, and the Verlix Data Processing Agreement governs what we may do with it. If you are an end customer, please contact the business that bills you. If you contact us instead, we will pass your request to that business.

2. Information we collect

2.1 From visitors and prospective customers:

what you enter when you book a demo: your name, company, work email, annual billed revenue band and message, and your phone number and country code if you choose to give them;
your email address if you subscribe to our newsletter or join a waitlist, such as the waitlist for European data residency, and the date you confirmed;
how you use our websites, recorded by our own website code: the pages and sections you view, the links and controls you use, the kind of site that referred you, a rounded time on page, a rounded screen size, and whether you start, submit or leave a form and which check a field failed, but never what you type in it;
the technical details your browser sends with every request, such as your IP address, browser type and the time of the request.

2.2 From people who use the platform:

account details: your name, work email address, the workspace you belong to and the role you hold;
sign-in and security details: your password in a protected form held by our identity service, your multi-factor and single sign-on settings, and records of sign-ins and sessions;
an audit trail of the actions taken in each workspace, which records who acted under a pseudonymous identifier and a shortened IP address;
your settings and preferences, and the messages you send our support team;
if you allow product analytics, how you use the platform, tied to a random browser identifier and, once you sign in, to your account;
for the person who manages the Verlix subscription, the billing contact details we need to invoice and collect our fees. Card and bank details are collected and held by the payment provider that processes the payment.

2.3 On behalf of our customers, as a processor:

contact details of end customers and their staff, such as names, business email addresses, phone numbers, billing addresses and tax identifiers;
contracts and other documents, which may contain the names, titles and signatures of the people who signed them;
subscription, usage, invoice, credit note, payment and bank transaction records, including the payment method type and the partial account details a payment provider supplies;
collections emails sent to end customers and the replies they send;
records drawn from the tools our customers connect, such as their CRM, accounting ledger, payment providers, e-signature tool and bank data connection.

2.4 We do not ask for, and our customers agree not to submit, health information, government identification numbers, full payment card numbers or bank login credentials, other than in a field the platform designates for that kind of data.

3. How we use information

3.1 We use personal information to:

provide, maintain and support the platform, the API and the documentation;
keep the platform secure, including detecting and stopping fraud, abuse and unauthorized access;
answer demo requests and questions, and send the newsletter or waitlist news you asked for;
send service messages, such as security alerts, approval requests, billing notices and notice of changes to our terms;
understand how our websites and platform are used, so that we can fix problems and improve them;
invoice and collect our own fees;
meet our legal obligations and enforce our agreements.

3.2 If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases: performing our contract with you or your employer; our legitimate interests in running, securing and improving our business, where those interests are not overridden by your rights; your consent, for the newsletter and waitlists, which you may withdraw at any time; and compliance with our legal obligations.

3.3 Information we process for our customers is used only to provide the platform to them, under their instructions, as Section 1.3 describes.

4. AI processing

4.1 Verlix includes four AI agents, the Contract agent, the Invoice agent, the Collections agent and the Revenue agent, which read a workspace's contracts, invoices and payments to draft and check the customer's billing work.

4.2 Contract reading is on by default in each workspace. While it is on, the platform sends contract documents in full, together with the workspace context needed to interpret them, to AI model providers that we engage as sub-processors, and stores the results in the workspace. A workspace administrator can turn contract reading off, and can turn each agent off, in the workspace's Settings.

4.3 We never use customer data to train shared models, and we require our AI model providers not to use it to train theirs.

4.4 The agents work on business billing records under the settings and approval rules each customer chooses. No agent approves an invoice, posts a journal entry or issues a refund without a person in the customer's team. Verlix does not use personal information to make decisions that have legal or similarly significant effects on individuals.

5.1 We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5.2 We share personal information only as follows:

with sub-processors that help us run the platform, in these categories: cloud hosting and storage in the United States; email delivery, for the messages the platform sends and receives; and AI model processing;
with the tools a customer chooses to connect, such as its CRM, accounting ledger, payment providers, e-signature tool and bank data connection, which receive information only on that customer's instruction and under the customer's own agreements with them;
with our professional advisers, such as lawyers and auditors, under duties of confidentiality;
with authorities, when the law requires it or when it is needed to protect the rights, safety or property of Verlix, our customers or others;
with a buyer or successor, if Verlix is involved in a merger, acquisition or sale of assets, under the protections this policy describes;
with anyone else, when you ask us to or agree to it.

5.3 The named list of sub-processors is available on request from privacy@verlix.ai.

5.4 Every sub-processor is bound by a written agreement that limits its use of personal information to the service it provides to us and requires it to protect that information.

6. How long we keep information

6.1 We keep personal information only as long as we need it for the purposes in this policy, and then delete or de-identify it.

6.2 In particular:

demo requests are kept for two years after our last contact with you, unless you become a customer;
newsletter and waitlist subscriptions are kept until you unsubscribe or the waitlist closes;
account details are kept while you belong to a workspace, and deleted when the workspace is deleted under the Data Processing Agreement;
server and application logs rotate on our hosts as they grow, each service keeping only its few most recent log files, and are never archived;
the audit trail is kept for seven years to protect the integrity of our customers' financial records, and identifies people only by pseudonymous identifiers and shortened IP addresses;
issued invoices and credit notes are kept unaltered for seven years from their issue date, because financial records must be kept for that long;
backups expire within 35 days.

6.3 Information we process for a customer is kept and deleted as that customer instructs, under the Data Processing Agreement.

7. How we protect information

7.1 We encrypt information in transit with TLS 1.2 or higher and encrypt it at rest. Credentials for the tools our customers connect are encrypted again, field by field, before they are stored.

7.2 Each customer's data is kept strictly apart from every other customer's, and each workspace's test data is kept apart from its live data.

7.3 Access to production systems is limited to the staff who need it for their work, and every service holds only the permissions it uses. Inbound email is scanned for malware before any part of the platform reads it.

7.4 We scan our software for known vulnerabilities, fix serious ones on fixed timelines, and have the platform tested by an independent firm each year. Our SOC 2 Type I examination is in progress.

7.5 No system is perfectly secure. If a security incident affects your personal information, we will notify you, or the customer responsible for it, as the law requires.

8. International transfers

8.1 We store and process personal information in the United States. European data residency is planned, and you can join the waitlist on our website to hear when it opens.

8.2 When we receive personal information from the European Economic Area, the United Kingdom or Switzerland, we protect the transfer with the European Commission's Standard Contractual Clauses and the matching UK and Swiss terms, which are part of our Data Processing Agreement for the information we process for customers.

9. Your privacy rights

9.1 Wherever you live, you can ask us what personal information we hold about you, ask us to correct it, and ask us to delete it where we no longer need it.

9.2 If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access your personal information, to correct it, to have it erased, to restrict or object to our use of it, including for direct marketing, to receive it in a portable form, and to withdraw any consent you gave. You may also complain to your local data protection authority.

9.3 California residents have these rights under the California Consumer Privacy Act, as amended:

to know the categories and specific pieces of personal information we collect about you, where it comes from, why we use it and with whom we share it;
to delete personal information we collected from you, subject to legal exceptions;
to correct inaccurate personal information;
to opt out of the sale or sharing of your personal information, although we do not sell or share it as that law defines those terms;
not to be treated differently for exercising any of these rights.

9.4 For California residents, in the past 12 months we collected these categories of personal information: identifiers, such as name, email address and IP address; commercial information, such as billing records; internet activity, such as pages viewed on our websites; professional information, such as company and role; and account login details. We collected them from you, from your employer or the business you deal with, and from the tools our customers connect. We used and disclosed them for the business purposes in Sections 3 and 5. We use account login details only to provide and secure the platform, and not to infer characteristics about you.

9.5 Residents of other US states with comprehensive privacy laws, such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, have similar rights to access, correct, delete and port their personal information and to opt out of targeted advertising, sale and profiling. We do not sell personal information, use it for targeted advertising, or profile people in ways that have legal or similarly significant effects. If we decline your request, you may appeal by replying to our decision, and we will respond to the appeal within the time your state's law sets.

10. How to exercise your rights

10.1 Email privacy@verlix.ai, saying which right you want to exercise. Users of the platform can also ask their workspace administrator to update their account details.

10.2 We will confirm your identity before acting, usually by asking you to reply from the email address we hold for you. An authorized agent may make a request for you if they show us your signed permission, and we may still ask you to confirm your identity with us directly.

10.3 We respond within one month under European and UK law and within 45 days under US state laws, and will tell you if we need more time as those laws allow.

10.4 If your request concerns information we process for one of our customers, we will pass it to that customer and help them answer it.

11. Cookies and similar technologies

11.1 Our websites and platform set four cookies they need to work: one that keeps you signed in, one that protects your forms against cross-site request forgery, one that secures sign-in through an external identity provider, and one that lasts 30 minutes while you link a bank account. Because these cookies are strictly necessary, they do not need your consent and cannot be switched off without breaking the service.

11.2 Two more cookies, both our own, belong to product analytics, which stay off until you choose. One remembers your choice, whether you allowed or declined analytics, for 13 months from the day you made it. The other holds a random browser identifier: it is set only after you allow analytics, links your use of the platform to your account once you sign in, and is deleted when you withdraw your choice.

11.3 Our website code also keeps a marker in your browser's session storage, which is cleared when you close the tab, so that it can tell the first page of a visit from the rest. The events our websites record about how you use them carry no cookie and no identifier.

11.4 We do not use advertising cookies, and we do not let other companies track you across our websites. Because we do not sell or share personal information, our handling does not change when your browser sends a Global Privacy Control or Do Not Track signal.

12. Children

The Verlix websites and platform are meant for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact privacy@verlix.ai and we will delete it.

13. Changes to this policy

We may update this policy as our services or the law change. We will post the new version on this page with a new "Last updated" date, and if a change materially affects how we use personal information, we will also tell our customers' administrators by email or in the platform before it takes effect.

14. Contact

Privacy questions and requests: privacy@verlix.ai

Legal notices: legal@verlix.ai

VerlixAI, Inc.