Privacy Policy

The controller of your personal data under the EU General Data Protection Regulation (GDPR) is Vascora OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia, represented by Julian Busarello. Contact: hello@getsari.com.

This policy also reflects applicable data protection laws in the countries we serve, including the Philippines Data Privacy Act (RA 10173), Vietnam Decree 13/2023/ND-CP (PDPD) and Thailand PDPA. Where those laws require more, we follow the stricter rule.

• Account data: email address, display name, password (hashed), avatar.
• Profile data: skills, rates, categories, preferences, match vector.
• Usage data: jobs viewed/saved/applied, credit usage, feature usage.
• Content you provide: CVs, notes, invoices, time entries, finance records, chat messages.
• Optional integrations: Telegram chat ID (if you connect Telegram), Google account (if you log in with Google).
• WhatsApp: your phone number and message content, when you contact us via WhatsApp (see section 11).
• Payment data: we do not store your card details. Payments are handled by Stripe.

• Provide and operate the Service (performance of the contract).
• Authenticate you and keep your account secure (contract; legitimate interest).
• Process payments and subscriptions (contract; legal obligation).
• Send service notifications and (with consent) Telegram push messages (contract; consent).
• Improve the Service through aggregated, non-personal statistics (legitimate interest).
• Comply with legal obligations (e.g. tax and accounting law) (legal obligation).

We share data only with processors needed to run the Service:

• Supabase – database, authentication, storage.
• Vercel – application hosting.
• Stripe – payment processing (their own privacy policy applies to payment data).
• Google – optional sign-in (OAuth).
• DeepSeek – AI features (pitch generation, scam analysis, WhatsApp assistant). Content you submit to AI features may be sent to DeepSeek for processing.
• Meta Platforms (WhatsApp Business Platform) – messaging when you contact us via WhatsApp. Meta processes the messages as a separate controller under its own privacy policies.
• Telegram – notifications, if you opt in.

Job listings shown in the Service come from public third-party platforms. We do not disclose your data to them.

Your data may be processed outside the EEA (e.g. by AI and hosting providers). Where we transfer personal data outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or adequacy decisions. For processors in the Philippines, Vietnam and Thailand, we rely on their local data protection obligations.

We keep your data only as long as needed for the purposes described, or as required by law (e.g. accounting records). If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep it for legal or tax reasons.

Depending on your location you may have the following rights:

• Right of access (GDPR Art. 15; PH RA 10173; TH PDPA; VN PDPD).
• Right to rectification (Art. 16).
• Right to erasure (“right to be forgotten”, Art. 17).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21).
• Right to withdraw consent at any time (Art. 7).
• Right to lodge a complaint with a supervisory authority (in Estonia: the Andmekaitse Inspektsioon, aki.ee).

To exercise any right, email hello@getsari.com. We respond within the timeframe required by law (usually 30 days). We may ask you to verify your identity first.

We use HTTPS, hashed passwords, Supabase Row Level Security and role-based access to protect your data. No method of transmission or storage is 100% secure; you use the Service at your own risk regarding risks beyond our control.

The Service is not intended for minors under 18. We do not knowingly collect data from children. If you believe a child provided us data, contact us and we will delete it.

We may update this policy. Material changes will be announced by email or in-app. The “last updated” date above reflects the current version.

We offer contact via WhatsApp through Meta's WhatsApp Business Platform, including from "Click-to-WhatsApp" ads. This section explains how your data is handled there.

• What we receive: your phone number, display name, your message content and metadata (timestamps, delivery/read status).
• Why: to answer your enquiry, qualify you (e.g. as a potential VA, client or partner) and book a free audit call. When you message us, parts of the conversation may be processed by our AI assistant (DeepSeek) so we can reply and qualify you quickly.
• Legal basis: taking steps at your request before entering into a contract and our legitimate interest in responding to enquiries (GDPR Art. 6(1)(b) and (f)); where we send promotional messages, we rely on your consent. Equivalent grounds apply under the Philippine DPA, Thai PDPA and Vietnamese PDPD.
• Data shared with Meta: WhatsApp is operated by Meta Platforms, Inc. When you message us, Meta processes your data as a separate controller under the WhatsApp Privacy Policy and the Meta Privacy Policy. We do not store your WhatsApp messages beyond the conversation needed to answer you (see Retention).
• Ads & measurement: if you reached us through a Click-to-WhatsApp ad, Meta may use interaction and conversion data to measure and optimise our ads. Where required (e.g. in the EEA/UK), we only load the Meta Pixel and enable such signals after you accept cookies in our banner.
• Your choices: you can ask us to delete the conversation, stop AI processing, or opt out of any promotional messages at any time (see "Your rights"). You can also block or report us directly in WhatsApp.

Data protection enquiries: hello@getsari.com or Vascora OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia.