Your data,
plainly.

Verseau is a bar and restaurant operations platform, operated from Michigan, USA. This policy covers the Verseau application (app.verseau.bar), its public demo bar, and this marketing site (verseau.bar). Questions and requests: aidan@zefren.com.

Account information for the people your organization invites (name, username, email address, role); the operational data your venue enters or imports (inventory, counts, item photos, invoices, sales, costs, recipes, purchase orders); and integration credentials you choose to give us. We request read-only access where possible. We do not collect your guests' data, and we don't collect employee data beyond the staff accounts you create.

Anyone can explore The Meridian Room, our fictional demo bar, without an account. If you choose to leave your email (and, optionally, where you work) in the demo, we store it with the demo role you were viewing, the screen you were on, and your browser type, and use it only to contact you about Verseau. We don't sell it or add it to anyone else's list. Ask us at any time and we'll delete it. Anything you change inside the demo bar is shared sample data and is wiped every few hours.

verseau.bar doesn't use analytics or advertising cookies. The contact and demo-request buttons open your own email app; nothing you type there is sent to us until you send that email. Fonts are loaded from Google Fonts, which receives your IP address as part of serving them.

PDFs and photos of invoices that you or your distributor reps send to your venue's private import address are stored so they can be filed against your invoices, and are reviewed before they change anything in your account.

To run the service for your organization: costing, counting, variance, ordering, and reporting on your own data, and to support you when you ask. We never sell your data, and we don't use it to train AI models.

A small set of providers run parts of the service on our behalf, under their own security and confidentiality terms: Railway (application hosting and database), Vercel (this website), Postmark (receiving invoices emailed to your import address), and Anthropic (reading invoice documents and answering questions in Celest, when those features are switched on for your organization). Anthropic's commercial terms don't allow it to train models on the data we send. We only share what each provider needs to do its job.

Integration credentials (POS, distributor logins) are encrypted at rest with AES-256-GCM, bound to your organization, never shown again after entry, never returned by any API, and erased when you disconnect the integration.

The application sets one session cookie to keep you signed in (HTTP-only, secure), and stores a few things in your browser: preferences such as your chosen location and dashboard layout, and, so counting works offline, your in-progress count until it syncs. We don't use advertising cookies.

Our server logs record request metadata only (method, path, status, timing) and never request or response bodies, secrets, or tokens.

The application and its database run on Railway in the United States; the marketing site runs on Vercel. All traffic is served over HTTPS. Encrypted off-host backups are stored in private cloud storage separate from the server.

What each person in your organization can see is controlled by roles your organization assigns; seeing costs is its own separate permission. Changes to costs, counts, roles, credentials, and invoice approvals are recorded in an append-only audit log.

You can ask to see, correct, export, or delete the personal information we hold about you by writing to aidan@zefren.com. We'll confirm the request and answer within 30 days. If your account belongs to a venue's organization, some requests go through that organization, and we'll tell you if so.

You can request a full export of your organization's data at any time. When an organization closes its account, we delete its data from the live service within 30 days; backup copies are removed as they age out of the backup schedule. Demo emails are kept until you ask us to remove them, or for 24 months without contact, whichever comes first.

Verseau is a business tool for people who work in bars and restaurants. It isn't meant for anyone under 18, and we don't knowingly collect information from children.

If an incident affects your data we contain it, assess the scope, and notify you without unreasonable delay, aiming for 72 hours, with what happened and what to do. Where personal information is involved, we follow the notice requirements of the Michigan Identity Theft Protection Act and any other law that applies.

If we change this policy we'll post the new version here with a new effective date, and tell account owners by email before a material change takes effect. Reach us any time at aidan@zefren.com.