Vermilleon — Consent, Data Ethics & Acceptable Use

Last updated: 25 July 2026

Template notice. This is a template drafted for a pre-incorporation product. It is not legal advice. Have it reviewed by a qualified lawyer in [JURISDICTION / GOVERNING LAW] before you publish or rely on it. Anything shown in square brackets or marked "to be confirmed" is a placeholder to complete before launch.

1. Our stance in plain language

Vermilleon analyzes private conversations. That is a serious thing to build, and we treat it seriously.

Why we require permission. When you upload a chat, you're uploading someone else's words. That person — the one you're trying to understand — is a real human being with rights over their own personal data. They didn't create an account. They can't see what we produce about them. The only thing standing between "a tool that helps you communicate better" and "a tool for spying on people" is your permission to use those messages. So we ask for it, clearly, and we ask every time.

What we're for. Clarity. Vermilleon exists to help you understand a conversation you're already part of — to see patterns you might have missed, to check your own read against the evidence, to decide how you want to respond. Every read comes with quoted evidence and a confidence level so you can judge it yourself.

What we refuse to be. We are not a surveillance tool. We are not a manipulation coach. We will not help anyone monitor a partner, control an ex, build a dossier on a colleague, or "figure out how to get" someone to do something. The moment the goal shifts from understanding a conversation you're in to gaining power over another person, you are outside what Vermilleon is for — and outside what our terms permit.

What we can't do. We can't tell you what someone is really thinking. We can't diagnose anyone. We can't detect lies. We produce interpretations, and we label them as interpretations.

2. Consent model

2.1 The two-layer consent gate

Vermilleon uses two layers of consent, both required:

1. Standing onboarding consent — a hard gate during onboarding. You cannot reach the upload flow until you have confirmed, once, that you understand the rules and have the right to use this product on other people's messages. This is recorded against your account.
2. Per-upload confirmation — a confirmation shown before every single upload. Standing consent does not waive it. Each conversation is a fresh decision, because each conversation involves a different person and a different set of rights.

2.2 What the account holder must attest before every upload

Before an upload is accepted, the account holder must be able to truthfully affirm all of the following:

• Lawful right to upload. You have the legal right, permission, or other lawful basis to upload and analyze this conversation, and to have it processed by Vermilleon and its AI provider.
• Basis for sensitive details. Where the conversation reveals special-category (sensitive) data about the other person — health, sexuality, religion, political opinions, and the like — you have a valid GDPR Article 9 basis for sharing it (for example the person's explicit consent, or that they have manifestly made the information public). See Section 2.3.
• You are a participant. This is a conversation you were part of — between you and the other person — not a chat you obtained by accessing someone else's device or account.
• Purpose. You are using this to understand your own communication and relationship, not to harass, stalk, coerce, surveil, profile, or gain leverage over anyone.
• No prohibited targets. The conversation is not with a minor, and you are not using Vermilleon in any of the prohibited contexts in Section 5.
• Third-party rights. You understand the other person has rights over their own data, and that Vermilleon will honor verified requests from them (Section 3).

2.3 Roles, lawful basis, and special-category data

Roles. For the raw conversation you choose to upload, you act as an independent controller — you decided to collect those messages and to bring them here. But we don't pretend to be a passive pipe. For the analysis we derive and store (persona cards, reads, signals, scores), for our choice of AI provider, and for the retention we set, Vermilleon is a controller too (jointly with you where the law treats it that way). Because both of us make decisions, responsibility is shared: your warranty covers your right to upload and share the content; our obligations cover how we process, secure, and delete what we hold — and we answer directly to the analyzed person for that (Section 3). If your warranty turns out to be false, that part is on you, and we may suspend your access; that does not relieve us of our own controller duties.

Ordinary personal data. For the messages you upload, our processing rests on your instruction plus your warranty that you have a lawful basis to share them — typically your own legitimate interest in understanding a conversation you are part of, or the other person's consent where you have it.

Special-category (sensitive) data — the hard part. Chats can reveal health, sexuality, religion, political opinions, and similar special-category data about the other person. Under GDPR Article 9 this kind of data needs a specific condition, and a non-consenting person's messages generally cannot satisfy one through your warranty alone. We are honest about this: we do not claim that a reliable Article 9 condition exists for incidental sensitive data about the analyzed person. Instead we (a) require you to warrant that you hold a valid Article 9 basis — such as the person's explicit consent, or that they have manifestly made the information public — before you upload, and (b) reduce the risk by design: we do not target, index, or advertise on sensitive traits, we minimize and summarize rather than hoard, we do not sell or share data, and we honor erasure. This is a known legal exposure of the product, and [JURISDICTION / GOVERNING LAW] counsel must confirm the Article 9 approach before launch.

2.4 Recommended exact copy

The copy below is the recommended production wording for the in-app flow. It is written to be specific, honest, and quotable.

(a) Onboarding consent screen

Title: Before you begin

Body: Vermilleon reads a conversation between you and another person, and gives you an evidence-backed read of how they communicate.

That other person is real, and their messages are their private data. They haven't signed up. So using Vermilleon comes with rules:

• I will only upload conversations I have the right to upload — chats I was part of, not messages taken from someone else's device or account.
• Where a chat reveals sensitive details about them (health, sexuality, religion, politics), I have a valid basis to share those too.
• I will use Vermilleon to understand and communicate better — never to harass, stalk, control, surveil, or manipulate anyone.
• I understand these are interpretations, not facts — not therapy, not a diagnosis, not a lie detector.
• I understand the other person has rights over their data, and that Vermilleon will honor their verified requests.
• I am 18 or older.

[ Checkbox ] I understand and agree to all of the above.

[ Primary button ] I agree — continue [ Secondary link ] Read the full Consent & Ethics page

(b) Per-upload confirm sheet

Title: Confirm before uploading

Body: You're about to upload a conversation with [person name] for analysis. It will be encrypted, sent to our AI provider (DeepSeek, based in China) to produce your read, kept in active storage for about 7 days, and then moved to an encrypted archive that is deleted when you delete this person or your account.

I confirm I have permission to upload and analyze this conversation.

This is a chat I was part of. I'm not using it to harass, surveil, or control anyone, and this isn't a conversation with a minor. If it reveals sensitive details about them (health, sexuality, religion, politics), I have a valid basis to share those.

[ Primary button ] Confirm & analyze [ Secondary button ] Cancel

(c) Just-in-time reminder (short)

Shown inline at the moment of file selection, or when re-analyzing:

These are someone's private messages. Only upload chats you have the right to use — and only to understand, never to control.

3. The other person's rights

The person whose messages you analyze is a data subject. They have rights over their personal data even though they never signed up for Vermilleon, and even though the account and the analysis belong to you.

What we hold about them. When you analyze a conversation, Vermilleon derives and stores information about that person: a "persona card" (a short summary that can include verbatim example messages, behavioral notes, and relationship history), a person summary, structured reads, signals, and dimension and mood scores. The raw transcript is retained in active storage for a short window (see Section 7) and then moved to an encrypted offline archive — it is not immediately deleted (see Section 7 for archive retention).

Our commitment. If a person believes their private messages have been uploaded and analyzed on Vermilleon, they can contact us, and we will honor verified requests to access or delete the data we hold about them, subject to verification and to any legal obligations we have to retain certain records.

How they reach us. There is a dedicated route:

• Email: [email protected] (to be confirmed)
• Privacy contact: [DPO / PRIVACY CONTACT NAME]
• Entity: [ENTITY NAME], [REGISTERED ADDRESS]

How a request works.

1. The person contacts [email protected] describing the conversation and, where possible, identifying details (e.g. the phone number, handle, or name used in the chat) that let us locate the relevant data.
2. We verify the request carefully. Our encryption at rest is server-side, not end-to-end (see Section 7), so we technically can decrypt content and must do so to run an analysis or to locate data for a verified request — but we limit that access by policy and design, and we do not routinely read transcript content. Because we must also not disclose one person's data to another, verification is deliberate: we will ask for what we genuinely need and no more.
3. Once verified, we act on the applicable right — typically access (what we hold) or erasure (deletion of the persona card, reads, signals, summary, and any retained transcript relating to them, including copies held in our encrypted offline archive). For content already transmitted to our AI provider, see Section 7 for what DeepSeek retains and how far our erasure can reach.
4. We respond within the timeframe required by applicable law.

A note on tension. Sometimes the account holder's interest and the analyzed person's interest will conflict — for example, the account holder wants to keep a persona, the analyzed person wants it deleted. We resolve these in line with data-protection law and the fact that the analyzed person has not consented to the service. A verified erasure request from the data subject is a strong signal we will act on.

4. Your rights and choices

Both the account holder and the person being analyzed have rights over personal data Vermilleon holds. Where the law gives you these rights, we honor them for both.

If you are in the EU / UK / EEA (GDPR / UK GDPR), you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — have your data deleted, subject to any legal retention duties.
• Restriction — ask us to pause processing while a dispute or accuracy question is resolved.
• Portability — receive your data in a structured, machine-readable format (our in-app export delivers this as JSON).
• Objection — object to processing carried out on the basis of legitimate interests.
• Withdraw consent — where we rely on consent, withdraw it at any time (this does not affect processing already carried out).
• Not be subject to solely automated decisions with legal or similarly significant effects. Vermilleon's reads are decision-support for a human (you); we do not make automated decisions about the analyzed person.
• Lodge a complaint with your supervisory authority.

If you are a California resident (CCPA / CPRA), you have the right to:

• Know — what personal information we collect, use, and disclose.
• Delete — request deletion of your personal information.
• Correct — fix inaccurate personal information.
• Opt out of "sale" or "sharing" for cross-context behavioral advertising. Vermilleon does not sell your personal information and does not share it for cross-context behavioral advertising — so there is nothing to opt out of, but we state it plainly.
• Limit the use of sensitive personal information — because Vermilleon processes, and may infer, sensitive characteristics, you can ask us to limit our use of sensitive PI to what is needed to provide the service (we already operate this way by design).
• Non-discrimination — we will not deny you service, charge you differently, or degrade your experience for exercising any of these rights.

How to exercise them. Account holders can use the in-app controls (export all data, delete an individual person, delete the account) or email [email protected]. Analyzed people can email the same address (see Section 3). We verify requests, respond within the timeframe the applicable law requires, and refuse only where a legal duty or another person's rights genuinely require it.

5. Prohibited uses

The following are never permitted on Vermilleon. This list mirrors the Acceptable-Use section of our Terms of Service and expands it with concrete examples. Using Vermilleon for any of these is a breach of your agreement with us and may be unlawful.

You must not use Vermilleon to:

• Coercive control or abuse. Analyze a partner's or family member's messages to control, isolate, punish, or dominate them — e.g. using reads to script arguments that corner someone, to "catch them out," or to decide how to retaliate.
• Stalking or monitoring an ex or current partner. Track, profile, or keep tabs on someone you're no longer with, or someone who has asked for space — e.g. uploading a running feed of an ex's messages to monitor their mood, availability, or interest in someone else.
• Surveillance of others' conversations. Upload chats you obtained from someone else's phone, account, backup, or by any access you weren't given — including a partner's, child's (adult or otherwise), employee's, or friend's device.
• Workplace surveillance. Analyze employees', reports', or coworkers' messages to monitor, evaluate, discipline, or build a case against them.
• Custody, litigation, or legal leverage. Generate "evidence," profiles, or behavioral claims for custody disputes, divorce proceedings, restraining orders, or any legal or quasi-legal action. Vermilleon's reads are interpretations, not evidence, and were never designed for this.
• Analyze a professional you rely on for care or counsel — e.g. your therapist, doctor, lawyer, or caseworker — in ways that undermine the relationship or the duties they owe you. Vermilleon is not a tool for second-guessing clinical or professional judgment.
• Analyze minors. Upload or analyze conversations with anyone under 18, or conversations that are substantially about a minor. Vermilleon is an 18+ product for adults analyzing conversations with other adults.
• Manipulate, deceive, or coerce. Use reads or the Sim to craft messages designed to manipulate, pressure, gaslight, love-bomb, or exploit someone's vulnerabilities.
• Harass, threaten, or dox. Support any campaign of harassment, intimidation, or exposure of another person.
• Discriminate or profile unlawfully. Use inferred sensitive characteristics (health, sexuality, religion, politics) to make decisions that would be discriminatory or otherwise unlawful.

If we become aware that an account is being used for any of the above, we may suspend or terminate it and, where required, cooperate with lawful authority.

6. Sensitive inferences & no-diagnosis policy

Vermilleon produces inferences about a real person, sometimes touching on sensitive topics that surface in a chat — health, sexuality, religion, politics, relationship dynamics. We handle this with deliberate restraint.

We rely on your Article 9 warranty. Because these inferences can touch special-category data about a real person who has not consented, our processing of them depends on the Article 9 basis you attested to at upload (Section 2.3). We minimize what we infer and store, do not target or advertise on sensitive traits, and honor erasure.

We label confidence and show evidence. Every read carries a confidence level and quoted evidence from the conversation. You are meant to check our reasoning against the actual messages, not take it on faith. A read is a lens, not a verdict.

We use everyday language, not clinical terms. We say things like "possible contradiction," "a pattern worth noticing," "mixed signals," or "a shift in tone" — not clinical or diagnostic labels. Vermilleon does not diagnose personality disorders, mental-health conditions, or pathologies, and does not apply clinical terminology to the person being analyzed. Signals such as "red flag," "green flag," "pressure signal," or "manipulation-style pattern" describe communication patterns in the text, not medical or psychological facts about the person.

No diagnosis, no clinical claims. Vermilleon is not a clinician and produces no medical or psychological diagnosis. If you have concerns about someone's wellbeing or your own, that's a conversation for a qualified professional, not an app.

No manipulation coaching. The Sim predicts how someone might reply to a draft so you can communicate more clearly — it is explicitly an estimate, generated by a model, and is not the real person and not a prediction you should treat as certain. We do not provide, and will not knowingly support, coaching on how to manipulate, pressure, or deceive the other person. The intended use is clarity and better communication, full stop.

Not a lie detector. Vermilleon cannot determine truthfulness. Signals about contradictions describe inconsistencies in the text, not proof that anyone is lying.

7. How we minimize

We limit what we hold, how long we hold it, and who can reach it.

• Encryption in transit and at rest. Everything moves over TLS (with HSTS). Uploaded transcripts and their archives are encrypted at rest with AES-256-GCM. (Note: this is not end-to-end encryption — producing a read requires our server to access the transcript in plaintext at the moment of analysis, and we hold the keys. We don't claim otherwise.)
• Transcript retention & archiving. Raw uploaded transcripts stay in active storage for about 7 days (configurable; default 7). After that they are moved to an encrypted offline archive controlled by the operator — not deleted. Re-analysis only works inside the active window; after that you'd re-upload. The archive is retained for the life of the related person-profile and is deleted when you delete that person or your account, including when we action a verified erasure request. Because the archive is offline, propagating a deletion to it can take longer than deleting from live systems, but we do carry it through. Sim conversation logs follow the same active-window-then-archive pattern.
• Summarize, don't hoard. For long-term use we keep a compact persona card (roughly 2–6 KB) and the derived reads, signals, summary, and scores — not an indefinite store of full raw chats. The persona card can include verbatim example quotes; deleting the person or the account deletes it.
• Per-user isolation. Your data is yours. The server derives your identity only from a verified access token, and every query is scoped to your user. Users cannot reach each other's data.
• Sensible engineering. Passwords are hashed with Argon2id; access tokens are short-lived (~15 min) with rotating, server-side-hashed refresh tokens; database access uses prepared statements; auth and analysis endpoints are rate-limited; our AI proxy applies prompt-injection mitigations and sends transcript content as data, not instructions; and our operational logs are structured to exclude message content and personal data.
• You control deletion. In-app you can export all your data (a full JSON of your profile, people, reads, signals, and ledger), delete an individual person (which cascade-deletes that person's transcript, persona card, reads, and signals, including archived copies), or delete your account, which irreversibly wipes your people, reads, signals, uploads, credit ledger, tokens, and user record.

Where analysis happens, and who else touches your data. To produce a read, Vermilleon sends the transcript and persona card to our AI provider, DeepSeek (platform.deepseek.com). The DeepSeek API key lives only on Vermilleon's server — the app never talks to DeepSeek directly, and we send transcript content as data, not instructions, with prompt-injection mitigations applied.

• DeepSeek retention and training. DeepSeek is operated by a company based in China. We are still finalizing our contractual terms with DeepSeek, so we do not yet assert that your content is excluded from model training, and we cannot yet promise a specific provider-side retention period. [DEEPSEEK RETENTION / TRAINING TERMS — to be confirmed in writing and stated here before launch.] Until we can confirm otherwise, assume that content sent to DeepSeek may be retained by DeepSeek under its own policies, and that our own erasure does not by itself delete copies DeepSeek holds. Where DeepSeek provides a mechanism to request deletion of transmitted content, we will pass verified erasure requests to it; where it does not, we will tell you plainly that we cannot reach that copy.
• International transfer safeguard. Sending data to DeepSeek is a cross-border transfer to China, for which there is no EU/UK adequacy decision. Our intended safeguard is Standard Contractual Clauses with DeepSeek plus a documented transfer impact assessment (TIA), supported by encryption in transit and data minimization; if SCCs cannot be put in place, we will rely on a specific GDPR Article 49 derogation or change providers before launch. [TRANSFER MECHANISM — SCCs + TIA / Art. 49 basis to be finalized before launch.] Our data-residency region is also still being finalized ([DATA REGION]).

Sub-processors. The parties below process personal data on Vermilleon's behalf. Full details, including any additions, live in our Privacy Policy.

8. Apple App Privacy "nutrition label" mapping

The table below maps Vermilleon's actual data handling to Apple's App Privacy categories, for entry into App Store Connect. Tracking is "No" across the board — Vermilleon uses no third-party analytics or ad SDKs, collects no advertising identifiers, and does not track users across other companies' apps or websites.

[Internal template note — remove before publishing, do not ship to users.] Confirm the "Diagnostics" and "Usage Data" rows against whatever crash-reporting or SDK you actually ship before submitting. If you add any analytics SDK later, these rows and the tracking answers must be re-checked. As a rule of thumb, treat uploaded chats and derived analysis conservatively: when in doubt, declare a data type as collected and linked, and declare inferred sensitive characteristics under "Sensitive Info."

9. Subscriptions, billing & related documents

Vermilleon offers a free tier and auto-renewing subscriptions. Credits and subscriptions are digital content.

• Plans. Free (5 credits) and paid tiers — indicatively Basic ($9/month, 50 credits), Pro ($19/month, 150 credits), and Max (~$39/month, 400 credits). The exact title, duration, and price per period of each subscription are shown in the App Store purchase flow and set in App Store Connect / RevenueCat and read at runtime; those in-store figures govern and prices here are indicative.
• Auto-renewal. Paid plans auto-renew each period until cancelled. Payment is charged to your Apple account at confirmation, and renewals charge within the window Apple specifies before each period ends. You can manage or cancel anytime in your Apple account settings; cancellation takes effect at the end of the current period. Refunds are governed by Apple / App Store policy.
• Credits. Credits are consumed per action (for example a full analysis, a re-analysis, a contradiction pack, a custom scenario, or a Sim message), have no cash value, and are non-transferable.
• Required disclosures and links. Apple's auto-renewable subscription disclosures (title, length, price per period) and functional links to our Terms of Service / EULA and Privacy Policy are presented in the App Store metadata and the in-app purchase flow, as Apple guideline 3.1.2 requires. They are also linked here:
  • Privacy Policy: [PRIVACY POLICY URL]
  • Terms of Service / EULA: [TERMS / EULA URL]
  • Subscription terms: [SUBSCRIPTION TERMS URL]

10. If you're the person being analyzed

Someone may have uploaded a conversation between you and them to Vermilleon, and asked our app for a read on how you communicate. We know that can feel unsettling.

Here's what's true: we don't build profiles of the general public, we don't sell or share data for advertising, and we hold only what's needed to give an account holder a read on a conversation they were part of. What we may hold about you is a short summary and analysis derived from that specific chat.

You have rights over that data, and you can act on them. Email [email protected] (to be confirmed) and tell us about the conversation — who uploaded it, if you know, and the name, number, or handle used in the chat so we can find the right data. We'll verify your request carefully (to protect everyone's privacy) and then honor it — including deleting the data we hold about you, in both live storage and our encrypted offline archive — subject to verification and any legal retention duties. Your full rights, and the limits on how far our erasure can reach content already sent to our AI provider, are set out in Section 4 and Section 7.

You can reach our privacy contact, [DPO / PRIVACY CONTACT NAME], at the same address. For anything else, [email protected] (to be confirmed).

Vermilleon is operated by [ENTITY NAME], [REGISTERED ADDRESS]. Governing law: [JURISDICTION / GOVERNING LAW]. This document is a template and not legal advice; have it reviewed by a qualified lawyer in the final jurisdiction before you rely on it.