Privacy policy

Effective date: October 6, 2026

This Privacy Policy explains how VERSO Health LLC ("VERSO", "we", "us") collects, uses and shares personal information when you visit ver.so, place an order, manage a subscription, contact us, or otherwise use our online store and related services (together, the "Services"). Nothing in this policy limits rights you have under privacy or consumer laws that can't be waived or excluded where you live.

The short version

• We collect what we need to sell and ship your order, run your subscription, support you, and market VERSO (with your consent where required).
• We use cookies and similar tools from Shopify and partners such as Google, Meta, TikTok, Microsoft, AppLovin, Klaviyo and others listed in Section 8. Some of these tools, such as Microsoft Clarity, record how you interact with our pages (for example, clicks, scrolling and mouse movement).
• Under some U.S. state laws, some of our advertising and marketing use counts as a "sale" or "sharing" of personal information. You can opt out using Your Privacy Choices or by turning on Global Privacy Control (GPC) in your browser.
• We do not sell lists of customer names, emails or phone numbers for money. We never see your full payment card number.
• Questions or privacy requests: email go@ver.so with the subject "Privacy".

1. Who we are

VERSO Health LLC

817 Bowsprit Road

Chula Vista, CA 91914

USA

Email: go@ver.so (subject "Privacy")

Contact page: ver.so/pages/contact

2. Personal information we collect

We collect the following kinds of personal information. Where helpful, we note the matching category under the California Consumer Privacy Act (CCPA), which many other state laws use in similar ways.

• Contact and identity details (identifiers): name, email address, phone number, shipping and billing address, and account login.
• Order and subscription details (commercial information): products you buy, subscription plan and frequency, order history, discount codes, returns, and messages about your orders.
• Payment details (financial information): handled by our payment providers, such as Shopify Payments, Shop Pay and the other payment methods shown at checkout. We receive only limited details, such as card type, last four digits and expiry date. We never receive your full card number.
• HSA/FSA payments: if you choose Truemed at checkout to pay with a health savings account (HSA) or flexible spending account (FSA), Truemed acts as the payment provider for that purchase. Truemed handles that payment and any eligibility steps it asks you to complete under its own privacy policy. We receive limited information about the order, such as whether it was paid through Truemed.
• Device and usage information (internet or other electronic network activity): IP address, browser and device type, time zone, approximate location derived from IP, pages and products viewed, search terms, referring site, and how you interact with our pages (such as clicks, scrolling and mouse movement), our emails and our texts.
• Marketing preferences: whether you signed up for emails or texts, consent records, and how you respond to our messages.
• Pop-up, quiz and survey answers: optional answers you give in our sign-up pop-ups, quizzes or surveys, such as which wellness goal you are most interested in.
• Customer support and feedback: what you tell us when you contact us, plus product reviews or survey answers. Please do not send us detailed health information you do not need to share. If you do (for example, telling us about a reaction to a product), we use it only to help you, handle product-safety reporting, and meet legal obligations.
• Affiliate and wholesale information (professional information): business name, website or social handles, and tax or payout details for partners.
• Inferences: limited preferences we derive from the above (for example, that you might like one product because you bought another).

Sensitive information. Account login credentials and precise payment data are "sensitive personal information" under some laws. We use them only to provide the Services, for security and fraud prevention, and as otherwise permitted by law. We do not use sensitive information to infer characteristics about you. Purchase, browsing and quiz data for wellness products can be sensitive in some contexts. See Section 9.

3. Where we get it

• From you, when you order, create an account, subscribe, sign up for emails or texts, answer a pop-up or quiz, enter a promotion, leave a review, apply to our affiliate or wholesale programs, or contact us.
• Automatically, through cookies, pixels, tags, session-recording tools, server logs and similar tools (see Section 8).
• From partners, such as payment providers (fraud and payment results), fulfillment and shipping partners (delivery status), affiliates (referral codes), advertising, analytics and direct mail partners (campaign performance and, in some cases, matching a site visit to a postal address), and social platforms when you interact with us there.

4. How we use it

• Orders and subscriptions: process payments, ship products, send order and shipping updates, handle returns and refunds, and manage recurring deliveries.
• Support: answer questions, resolve problems, and handle product feedback or adverse-event reports.
• Marketing: send emails and texts you agreed to receive, show you ads on other sites and apps, send postcards or other mail, offer promotions (including a sign-up discount), suggest products based on your answers and activity, and measure what works.
• Improving the Services: analytics, testing, session replays and heatmaps, and understanding which products and content are helpful.
• Safety: prevent fraud, abuse and security incidents, and enforce our Terms of Service.
• Legal obligations: tax, accounting, consumer protection, product safety, and responding to lawful requests.

Legal bases (EEA, UK and similar laws): contract (to deliver your order), consent (marketing emails and texts, and non-essential cookies where required), legitimate interests (security, analytics, improving the Services, and limited direct marketing where permitted), and legal obligation.

Automated decisions. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Our payment and platform providers use automated fraud screening (for example, temporarily blocking an IP address or card linked to repeated failed payments). If an order is declined, contact us and a person will review it.

5. Who we share it with

We do not rent or sell lists of customer names, emails or phone numbers. We share personal information with:

• Service providers who work on our behalf under contract, including: our e-commerce platform (Shopify); payment providers (Shopify Payments, Shop Pay and other payment methods shown at checkout, and Truemed for HSA/FSA payments); subscriptions (Seal Subscriptions); email, SMS, sign-up forms and product reviews (Klaviyo); pop-ups, quizzes and sign-up offers (Alia); inventory management and fulfillment (Zenventory); shipping carriers (such as USPS and FedEx); international shipping and customs (Passport Global Shipping); analytics and attribution (Shopify Analytics, Google Analytics, Microsoft Clarity and Triple Whale); site apps we use for promotions, gifts, social feeds and product tools; our affiliate program app (Simple Affiliate); and professional advisers.
• Advertising, marketing and social media partners, such as Meta, Google, TikTok, Microsoft Advertising, AppLovin (Axon), PostPilot and Instant. These partners may receive device, browsing and purchase-event data through cookies, pixels or server-side integrations. We may use them to measure ads, show VERSO ads to you and people like you, recognize returning visitors so we can send reminders where permitted, and send VERSO postcards or other mail (PostPilot and its data partners may match a site visit to a postal address for this purpose). Under California and other state laws, this may be a "sale" or "sharing" for cross-context behavioral or targeted advertising. You can opt out (Section 7).
• Affiliates and referral partners, limited to what is needed to credit and pay a referral (for example, that an order used their link or code). We do not give affiliates your contact details.
• Legal, safety and corporate transactions: authorities when required by law; to protect rights, safety and property; and to a buyer or successor if VERSO is involved in a merger, acquisition or sale of assets.
• With your direction or consent.

Shopify's privacy policy is at https://www.shopify.com/legal/privacy. Microsoft's privacy statement, which covers Microsoft Clarity and Microsoft Advertising, is at https://privacy.microsoft.com/privacystatement.

6. How long we keep it

We keep personal information only as long as we need it for the purposes above, then delete or de-identify it. Typical periods:

• Order, payment and tax records: typically about 7 years after the order (tax and accounting).
• Subscription records and proof of your consent to auto-renewal: typically at least 3 years, or 1 year after your subscription ends, whichever is longer.
• Customer account: while your account is active, and for a reasonable period after your last activity, unless you ask us to delete it sooner and we are not required to keep it.
• Email and SMS marketing records: until you unsubscribe, then a suppression record (so we do not message you again) plus consent records for as long as typically needed for compliance.
• Support conversations: typically a few years.
• Session recordings (Microsoft Clarity): typically about 30 days, with a small number of saved recordings and heatmap data kept longer.
• Analytics and advertising data: typically up to about 14 to 26 months, depending on the tool.
• Affiliate and wholesale records: typically the length of the relationship plus about 7 years.

7. Your privacy choices

• Opt out of "sale", "sharing" and targeted advertising: use Your Privacy Choices, or enable Global Privacy Control in your browser. When we detect GPC, we treat it as an opt-out of sale, sharing and targeted advertising for that browser. If you are logged in or we can otherwise link the browser to you, we apply it to your account too.
• Cookies: use our cookie banner or cookie settings (where shown), or your browser controls. See Section 8.
• Email: click "unsubscribe" in any marketing email.
• Texts: reply STOP (or tell us in any other reasonable way). Help: reply HELP, or email go@ver.so.
• Direct mail: email go@ver.so with the subject "Privacy" and ask us to stop sending you postcards or other marketing mail.
• Industry and platform ad opt-outs: Digital Advertising Alliance, Network Advertising Initiative, Canada AdChoices, Microsoft ad settings, and the Google Analytics opt-out browser add-on.
• Do Not Track: browsers' "Do Not Track" settings have no common standard, so we do not respond to them. We do honor GPC as described above.

8. Cookies and similar technologies

We and our partners use cookies, pixels, tags, local storage, scripts and server-side integrations (together, "cookies" in this policy) to run the store, remember your choices, analyze traffic, and measure and personalize advertising.

• First-party cookies are set by ver.so (through Shopify and the apps we use). Third-party cookies are set by partners such as Google, Meta, TikTok, Microsoft, AppLovin and Klaviyo.
• Session cookies disappear when you close your browser. Persistent cookies stay until they expire or you delete them.

Categories

• Strictly necessary: cart, checkout, login, security, fraud prevention, and saving your privacy choices.
• Analytics: understanding traffic, how pages perform, and how visitors use them, including session replays and heatmaps.
• Marketing and advertising: measuring ads, retargeting, building audiences on ad platforms, sign-up pop-ups and offers, direct mail, and recognizing email or SMS subscribers so we can send relevant messages.
• Embedded content: playing embedded videos and showing social content (for example, an Instagram feed).

Session replay and heatmaps. We may use Microsoft Clarity to understand how visitors use our site. Clarity records how you interact with our pages, such as clicks, taps, scrolling, mouse movement and the pages you visit, and uses this to create session replays and heatmaps. Clarity masks sensitive fields, such as text you type into forms, before that data is sent to Microsoft. We use Clarity to find and fix problems and improve the site, not to identify you. Microsoft processes this data as described in its privacy statement at https://privacy.microsoft.com/privacystatement.

Where the law requires consent (for example, in the EEA, UK and Quebec), we ask for your consent before using non-essential cookies, for example through a cookie banner. In the U.S., you can opt out at any time as described in Section 7. Blocking cookies in your browser may break cart and checkout. Blocking cookies may not stop all data sharing through server-side integrations. Using Your Privacy Choices or GPC does.

Videos. Our pages may include embedded YouTube or Vimeo videos. Those providers may set their own cookies when a video loads or plays.

To learn more about managing cookies in your browser, visit https://www.allaboutcookies.org/.

Cookie list

Cookie names and durations change when vendors update their tools, so this list is a guide rather than a complete inventory. Durations are upper limits. We review this list periodically. Last reviewed: October 6, 2026.

Strictly necessary (always on)

These make the store work: your cart, checkout, login, security, fraud prevention and remembering your privacy choices. You cannot switch them off in our banner, but you can block them in your browser (the site may stop working properly).

• Name: _shopify_essential, cart, cart_sig, cart_ts, cart_ver, cart_currency, checkout, checkout_token, secure_customer_sig, storefront_digest, keep_alive, _secure_session_id, localization, _shopify_country
  • Provider: Shopify (first party)
  • Purpose: Shopping cart, checkout, customer login, store localization and session security
  • Duration: Session to 1 year (secure_customer_sig up to 20 years)
• Name: _tracking_consent, _cmp_a, _shopify_tm, _shopify_tw, _shopify_m
  • Provider: Shopify (first party)
  • Purpose: Stores your cookie and privacy choices (including Global Privacy Control signals)
  • Duration: 30 minutes to 1 year
• Name: shopify_pay, shopify_pay_redirect, _shop_app_essential, hide_shopify_pay_for_checkout, dynamic_checkout_shown_on_cart, tracked_start_checkout, previous_step, remember_me
  • Provider: Shopify / Shop Pay
  • Purpose: Accelerated checkout and payment flow
  • Duration: Session to 1 year
• Name: _GRECAPTCHA (and related reCAPTCHA storage)
  • Provider: Google reCAPTCHA
  • Purpose: Protects forms and checkout from bots and fraud
  • Duration: Up to 6 months
• Name: Seal Subscriptions storage (names set by the app)
  • Provider: Seal Subscriptions
  • Purpose: Shows subscription options and runs the subscription customer portal
  • Duration: Session to 1 year

Analytics and performance

These help us understand how people use the site so we can make it better.

• Name: _shopify_analytics, shopify_client_id, _shopify_y, _shopify_s, _shopify_sa_p, _shopify_sa_t, _y, _s, _landing_page, _orig_referrer, _shopify_d, _shopify_evids
  • Provider: Shopify Analytics (first party)
  • Purpose: Store analytics: visits, landing pages, referrals, conversion reporting
  • Duration: 30 minutes to 1 year
• Name: _ga, _ga_*
  • Provider: Google Analytics
  • Purpose: Measures site traffic and how visitors use pages
  • Duration: Up to 13 months
• Name: _clck, _clsk, CLID, MUID, ANONCHK, SM, MR
  • Provider: Microsoft Clarity
  • Purpose: Session replays and heatmaps that show how visitors click, scroll and move through pages (sensitive fields are masked)
  • Duration: Session to about 13 months
• Name: TriplePixel and related storage (names set by the app)
  • Provider: Triple Whale
  • Purpose: Marketing attribution and analytics dashboards
  • Duration: Typically up to 1 year

Marketing and advertising (you can opt out in the U.S.)

These help us and our advertising and marketing partners show you VERSO ads or mail and measure whether they work. Under some U.S. state laws this counts as "sharing" or "selling" personal information or "targeted advertising". You can turn them off with Your Privacy Choices or a Global Privacy Control signal.

• Name: _fbp, _fbc, fr
  • Provider: Meta (Facebook and Instagram) pixel
  • Purpose: Ad measurement, retargeting and audience building
  • Duration: Up to 90 days
• Name: _gcl_au, _gcl_aw, _gcl_ls, IDE, test_cookie
  • Provider: Google Ads / Google Marketing Platform
  • Purpose: Ad conversion tracking and remarketing
  • Duration: Up to 13 months
• Name: _uetsid, _uetvid, MUID
  • Provider: Microsoft Advertising (Bing)
  • Purpose: Ad conversion tracking and remarketing
  • Duration: 1 day to about 13 months
• Name: _ttp, _tt_enable_cookie, ttcsid
  • Provider: TikTok pixel
  • Purpose: Ad measurement and retargeting
  • Duration: Up to 13 months
• Name: _axwrt, ax_visitor, _ax_last_event, _ax_session_data
  • Provider: AppLovin (Axon)
  • Purpose: Ad measurement and audience targeting
  • Duration: Up to 1 year
• Name: __pp_pid, __pp_sid, and identifiers set by PostPilot's data partners
  • Provider: PostPilot
  • Purpose: Measures site visits and helps us send VERSO postcards or other mail, including to visitors matched to a postal address
  • Duration: Session to about 13 months
• Name: Instant storage (names set by the app)
  • Provider: Instant
  • Purpose: Recognizes returning visitors so we can send cart or browsing reminders where permitted
  • Duration: As set by the provider, typically up to 1 year
• Name: __kla_id, klaviyoOnsite, and related Klaviyo storage
  • Provider: Klaviyo
  • Purpose: Recognizes email and SMS subscribers on the site, powers sign-up forms, reviews, back-in-stock alerts and browse or cart reminder messages
  • Duration: Up to 2 years
• Name: Alia storage (names starting with "alia")
  • Provider: Alia
  • Purpose: Shows sign-up pop-ups, quizzes and first-order offers, and remembers whether you have seen or completed them
  • Duration: Session to 1 year
• Name: Affiliate referral cookie
  • Provider: Simple Affiliate
  • Purpose: Credits a purchase to the affiliate link or code that referred you
  • Duration: For the referral period set in our affiliate program

Embedded content and functionality

• Name: VUID, player cookies
  • Provider: Vimeo (embedded videos)
  • Purpose: Plays embedded videos and measures plays
  • Duration: Up to 2 years
• Name: YSC, VISITOR_INFO1_LIVE, NID
  • Provider: Google / YouTube (embedded videos)
  • Purpose: Plays embedded videos
  • Duration: Session to 6 months
• Name: Storage used by site apps (names set by each app)
  • Provider: Instafeed (Instagram feed), Giftbee (gift-with-purchase offers) and Printful (product tools)
  • Purpose: Displays social content, applies offers, or supports product tools
  • Duration: Session to 1 year

9. Health-related information

VERSO sells dietary supplements, not medical services. We do not ask for your medical history to buy our products. However:

• the products you buy and pages you view can suggest something about your health or wellness goals;
• you may choose to tell us which wellness goal interests you (for example, sleep or energy) in an optional pop-up or quiz;
• you may choose to tell us health details when you contact support.

We use this information to provide the Services, support you, suggest products, meet legal and safety obligations, and, where permitted, personalize our own messages to you. Our advertising and analytics partners may receive standard shopping events, such as which product you viewed or bought, as described in Sections 5 and 8. You can opt out of that use through Your Privacy Choices or GPC. We do not sell your quiz answers or support messages, and we do not intentionally provide them to advertising platforms.

10. U.S. state privacy rights

Depending on where you live (including California and other states with similar laws), and subject to legal exceptions and thresholds, you may have the right to:

• Know / access the personal information we have about you, including categories, sources, purposes and categories of third parties we disclose it to, and get a copy in a portable format.
• Correct inaccurate information.
• Delete information we collected from or about you.
• Opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects (we do not do that kind of profiling).
• Limit or consent to use of sensitive data where required. We do not use sensitive data in ways that require a separate "limit" right beyond what is described in this policy, other than as state health-data laws may separately require.
• Get a list of specific third parties to which we disclosed personal information, where your state's law provides that right.
• Appeal our decision if we deny your request.
• Not be discriminated against for using your rights. We will not deny you products, charge different prices, or give you a different level of service because you exercised your rights (though some programs, like a sign-up discount, require an email address or phone number to work).

How to make a request. Email go@ver.so with the subject "Privacy Request". For opt-outs of sale, sharing or targeted advertising, use Your Privacy Choices or GPC. No verification is needed for those opt-outs. For access, correction and deletion, we will verify your identity by matching information you give us to what we have (for example, your email and a recent order number). We respond within the time required by law, usually 45 days. Where the law allows, we may extend that once, and we will tell you why.

Authorized agents. You can use an authorized agent. We will ask for proof of their authority (such as a signed permission or power of attorney) and may ask you to verify your identity directly.

Appeals. If we decline your request, reply to our decision email with "Appeal" in the subject within 45 days. We will respond within the time required by your state's law (usually 45 or 60 days). If you are still unhappy, you can contact your state Attorney General.

Teens. We do not knowingly sell or share personal information of consumers under 16 (or under 18 where state law requires parental consent for that activity).

California notice at collection and additional disclosures

In the last 12 months we collected the categories listed in Section 2 from the sources in Section 3 for the purposes in Section 4, and kept them for the periods in Section 6.

• Disclosed for a business purpose (to service providers and contractors): identifiers, commercial information, financial information (to payment providers), internet or network activity (including session-replay data), approximate geolocation, inferences, professional information (affiliates and wholesale), and electronic communications such as support emails.
• "Sold" or "shared" (to advertising, marketing and analytics partners through cookies, pixels and similar tools): identifiers (such as cookie IDs, IP address, hashed email or phone where enabled, and, for direct mail, a postal address a partner matches to a visit), internet or network activity, commercial information (purchase events), approximate geolocation, and inferences.
• Sensitive personal information: account login credentials and payment card data, used only as permitted by CCPA regulations (to provide the Services, security and fraud prevention). We do not sell or share sensitive personal information as those terms are defined for that purpose.

Notice of financial incentive (sign-up discount). When you give us your email address or mobile number and agree to receive marketing, we may offer you a discount on your first order (for example, 15% off) or other perks. The information involved is your name (if provided), email address, phone number, any optional pop-up or quiz answers, and related purchase activity. We estimate the value of your data to be roughly equal to the value of the discount offered, based on our expected revenue from marketing to subscribers minus the cost of the program. You can opt in through the sign-up form, and you can withdraw at any time by unsubscribing (a discount already used is not affected). Joining is voluntary.

Shine the Light (Cal. Civ. Code § 1798.83). We do not share personal information with third parties for their own direct-marketing purposes as defined by that law. California residents may request information by emailing go@ver.so.

Nevada. We do not sell "covered information" as defined by Nevada law (NRS 603A) for monetary consideration. Nevada residents can still submit an opt-out request to go@ver.so.

11. Canada (including Quebec)

If you live in Canada, we handle your personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector (as amended by Law 25), to the extent they apply.

• Privacy contact: go@ver.so.
• Consent: we rely on your consent, which may be implied where appropriate (for example, to ship your order) and express for marketing emails and texts (as required by Canada's Anti-Spam Legislation) and for non-essential cookies where required.
• Storage outside Canada: we and our service providers store and process information in the United States and other countries. It may be accessible to courts, law enforcement and national security authorities there. Before transferring Quebec residents' information outside Quebec, we assess whether it will receive adequate protection.
• Your rights: access, correction, and withdrawal of consent (subject to legal or contractual limits). Quebec residents may also have rights such as data portability in a structured, commonly used format, and related rights under Quebec law.
• Complaints: contact us first. You can also contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
• Breaches: we will notify you and regulators as required by law, for example where a breach creates a real risk of significant harm (or a risk of serious injury in Quebec).

12. Australia

If you live in Australia, we handle your personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), to the extent they apply to us.

• Kinds of information, how we collect and hold it, and why: see Sections 2 to 6. We hold information electronically with our service providers.
• Anonymity: you can browse without identifying yourself, but we need your details to sell and deliver products.
• Direct marketing: we send marketing only as allowed by the APPs and the Spam Act 2003. Every message lets you unsubscribe, and you can ask us not to use your information for direct marketing at any time.
• Overseas disclosure: we are based in the United States, so your information is disclosed to and stored in the United States, and may be handled by service providers in other countries where they operate.
• Access and correction: ask us at go@ver.so. We aim to respond within 30 days and will not charge you to make a request.
• Complaints: contact us first. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (1300 363 992).

13. EEA and UK

If you live in the European Economic Area or the UK, you have the right to access, correct, delete, restrict or object to processing, data portability, and to withdraw consent at any time. You can complain to your local data protection authority. Your information is transferred to the United States and other countries. Where required, we and our providers use safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework (where a provider is certified). Orders shipped to the EU may be sold and fulfilled by our partner Passport Global Shipping, which acts as the seller for those orders (for example, orders of €150 or less) and handles your information under its own privacy notice for that role.

14. Children

The Services are for adults 18 and older. We do not knowingly collect personal information from children under 13 (or under 16 in regions where that is the applicable age for consent). If you believe a child has given us information, contact go@ver.so and we will delete it.

15. Security

We use reasonable administrative, technical and physical safeguards, such as encrypted checkout and access controls. No system is perfectly secure, so please use a strong, unique password for your account.

16. International transfers

We are based in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States and other countries where our service providers operate. Those countries may have different data-protection laws than your home country. See Sections 11 to 13 for region-specific notes.

17. Links and third-party services

Our site links to other sites and social platforms (for example Instagram, Facebook or YouTube). Their privacy practices are their own. We are not responsible for those sites.

18. Changes to this policy

We will update this policy when our practices or the law change. We will post the new version here with a new effective or "last updated" date and, for material changes, notify you by email or a notice on the site before the change takes effect where required.

19. Questions

Email go@ver.so with the subject "Privacy", or reach us through our contact page.

VERSO Health LLC, 817 Bowsprit Road, Chula Vista, CA 91914, USA.