Privacy Policy

1. Who is responsible for your data

The controller of your personal data is VesCir Ltd., a company headquartered in Taiwan (Unified Business Number 53560699), at 10F-1, No. 155, Section 3, Xinyi Road, Da'an District, Taipei City 106, Taiwan. VesCir Ltd. is the party that contracts with RegaaS customers and receives their payments.

For matters concerning the EU, you can also contact our EU office, VesCir Holland B.V., Simon Vestdijksingel 69, 2652 KR Berkel en Rodenrijs, the Netherlands, at the same email address: service@vescir.com.

We have not appointed a data protection officer. Questions about this policy and requests about your data are handled by our team at service@vescir.com.

2. Personal data we collect

Account data

When you create an account: your username, email address and password (we store only a hashed form of the password, never the password itself). Optionally, your phone number (with country code) and company name. We send email verification links from our own system to the address you give us. We also record the choices you make about our terms and about marketing email: what you chose, when, where, and which version of the wording you saw.

Content you submit

• The label images you upload for review.
• The text extracted from those images, which we store (cache) so it does not have to be extracted again.
• Your analysis results, and the product names and regulation scope saved to your history.
• The messages you exchange with the AI assistant about a report.
• Logs of the prompts and responses exchanged with AI models for each analysis, which we use to operate the service, find and fix errors, and improve its reliability.

Label images and product names may contain information about you or other people, for example a company contact name on a label. Please upload only content you are entitled to share.

Billing data

Purchases are processed by our payment provider, which acts as merchant of record. It collects your card details, billing address and tax information directly; we never receive your full card number. We receive the status of your orders, payments and refunds and, if you save a payment method, only its type, brand and last four digits.

Contact form

When you write to us through the contact form: your first name, last name, email address and message.

LinkedIn lead forms

When you fill in a RegaaS form on LinkedIn, for example to download a checklist: your first name, last name, email address, country, job title and company name, your answers to the questions on the form, whether you ticked the box to receive marketing email, and when you submitted the form. LinkedIn collects these under its own privacy policy and passes them to us.

Business contact data from other sources

To find companies that may need RegaaS, we collect business contact details from public sources, such as company websites and trade directories, and may obtain them from business-data providers that are permitted to supply them. This covers company names, websites and general company email addresses and, for people whose job relates to product labeling or regulatory compliance, their name, job title, employer and work email address. We do not collect this data from LinkedIn profiles.

Website and device data

When you visit the website, our servers record access logs containing your IP address, the time of the request, the page requested and your browser information. The third-party services described in sections 5 and 9 also receive technical data such as your IP address. Analytics and advertising measurement data are collected only if you consent (see section 9).

Data you must provide

Your username, email address and password are needed to create an account and provide the service; without them we cannot open an account for you. Your phone number and company name are optional.

3. Why we use your data and our legal bases

To provide the service (performance of a contract)

We use your account data and the content you submit to create and run your account, sign you in, verify your email address, carry out the reviews you request, show your history and reports, let you ask the AI assistant about a report, manage your credits and purchases, and respond to your support requests.

To keep the service secure and reliable (legitimate interests)

We use AI prompt and response logs, server access logs and bot protection on the contact form to operate the service, detect and fix errors, prevent abuse and improve reliability. Our legitimate interest is running a secure, working service. You can object to this processing (see section 10).

To answer enquiries (legitimate interests, or steps before a contract)

We use contact-form submissions to reply to you and follow up on your enquiry.

To meet legal obligations

We keep billing and transaction records as tax and accounting law requires, and we disclose data to authorities where the law obliges us to.

To measure website use and advertising (consent)

With your consent only, we use Google Analytics, Google advertising measurement and the LinkedIn Insight Tag to understand how the website is used and whether our advertising works, and to show RegaaS ads on LinkedIn to people who have visited the website. You can withdraw consent at any time through "Cookie settings" in the website footer; this does not affect processing carried out before you withdrew it.

To send you marketing email (consent)

Only if you tick the box for it, when you sign up, in the app, in Settings or in a RegaaS form on LinkedIn, we email you news about RegaaS: new features, product updates and offers. It is about RegaaS only. When you tick the box in RegaaS itself, it is sent only to an email address that has been verified. Every marketing email has an unsubscribe link and, if you have an account, you can also switch it off in Settings at any time; this does not affect emails sent before you did. We keep a record of each choice so that we can show what you agreed to. Emails about your account, such as email verification, password reset, credit and billing notices, are part of the service and are sent whatever you choose here.

To email businesses about RegaaS (legitimate interests)

We may send a small number of emails about RegaaS to the work email address of people whose job relates to product labeling or regulatory compliance at companies that make or sell food or cosmetics, including people who filled in a RegaaS form on LinkedIn without ticking the marketing email box. We do this only where the law of the recipient's country allows such emails without prior consent; where it requires consent, we email you only if you have given it. Our legitimate interest is offering a business service to the professionals it is designed for, and we write only about matters relevant to your job. Every such email tells you where we obtained your address and how to stop further emails at no cost to you. If you object, we stop and do not contact you this way again.

Purposes under Taiwan's PDPA

Under the categories of specific purposes published by Taiwan's Ministry of Justice, we collect and use personal data for: (040) marketing (with your consent or, for business contacts, where the law allows it without consent); (063) collection, processing and use by non-government agencies in accordance with statutory obligations; (069) contract, quasi-contract or other legal relationship matters; (090) consumer and customer management and services; (091) consumer protection; (136) information and database management; (148) online shopping and other e-commerce services; (157) survey, statistics and research analysis; and (181) other business operations consistent with our registered business items.

If we want to use your data for a purpose other than those described in this policy, we will tell you first and, where the law requires, ask for your consent.

No automated decisions about you

RegaaS uses AI to review product labels, not people. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

4. How AI processing works

To produce a review, the label images you upload, the text extracted from them and your messages to the AI assistant are sent to AI model providers:

• OpenRouter (USA), which routes requests to AI model providers including Google (Gemini models) and Anthropic (Claude models).
• Google's Gemini API (USA), to which some requests are sent directly.

These providers handle the data under their own terms. We have not enabled zero-data-retention with them, so they may keep inputs for limited periods under their own policies, for example to monitor for abuse.

We do not use your uploads to train or fine-tune our own models.

5. Who we share your data with

We share personal data only with the following recipients, and only as far as they need it for the purposes above:

• Hosting: Amazon Web Services and Oracle Cloud Infrastructure, which operate the cloud servers, located in Japan, that run the website, the application and its database. Every request to the website passes through these servers, so they receive your IP address.
• AI processing: OpenRouter, Google and Anthropic, as described in section 4.
• Payments: our payment provider, which acts as merchant of record and collects payment details directly from you.
• Google LLC (USA): Google Tag Manager, Google Analytics 4 and Google advertising measurement (only with your consent); Google Fonts, whose servers deliver the website's font files and therefore receive your IP address; Google Workspace (Gmail), through which we send emails to you: account emails such as email verification and password reset, marketing email if you opted in, and the business emails described in section 3; and Google Apps Script, which receives contact-form submissions (first name, last name, email address and message) and delivers them to us.
• Google Cloud (BigQuery), with data stored in Taiwan: holds the details we receive from LinkedIn lead forms, so that we can follow up on them and measure our LinkedIn advertising.
• LinkedIn (only with your consent): the LinkedIn Insight Tag, loaded through Google Tag Manager, sends LinkedIn the page you visit, the page you came from, your IP address (which LinkedIn truncates or hashes), browser and device details, and the time. LinkedIn uses this to report the results of our LinkedIn advertising (such as sign-ups), to give us aggregated reports about the website's visitors, and to let us show RegaaS ads on LinkedIn to people who have visited the website. We only see reports that do not identify you. LinkedIn processes this data as an independent controller under its own privacy policy: LinkedIn Ireland Unlimited Company for visitors in the EU, EEA and Switzerland, and LinkedIn Corporation (USA) for visitors elsewhere. LinkedIn says it removes direct identifiers within 7 days and deletes the remaining data within 180 days.
• Cloudflare, Inc. (USA): Cloudflare Turnstile, which protects the contact form against automated abuse.
• Authorities, courts and professional advisers (such as lawyers and accountants), where the law requires it or where it is needed to establish, exercise or defend legal claims.

If you consent to advertising measurement, after you submit the contact form or sign up we may send Google a hashed (SHA-256) version of your email address so that Google can measure conversions from our advertising.

We do not sell your personal data.

6. International transfers

Your personal data is processed in Taiwan (where VesCir Ltd. is based), in Japan (where our cloud servers, operated by Amazon Web Services and Oracle Cloud Infrastructure, are located) and in the United States (where our AI, analytics and other service providers are based). These countries are outside the European Economic Area.

• Japan: transfers of EU personal data to Japan rely on the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419).
• United States: we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, for providers that participate in it, the EU-U.S. Data Privacy Framework.
• Taiwan: there is no EU adequacy decision for Taiwan. We rely on appropriate safeguards, such as Standard Contractual Clauses, or on another transfer ground permitted by the GDPR, such as a transfer necessary to perform our contract with you.

You can ask us for more information about the safeguards we rely on by writing to service@vescir.com.

7. How long we keep your data

• Account data, uploaded label images, analysis results, the extracted-text cache, AI prompt and response logs, and AI assistant messages: kept until you ask us to delete them.
• Your choices about our terms and about marketing email: kept while your account exists, and afterwards for as long as we may need to show what you agreed to.
• Billing and transaction records: kept for as long as tax and accounting law requires, even after you ask us to delete your account.
• Contact-form messages: kept as long as needed to handle your enquiry and any follow-up, and deleted on request.
• Details from LinkedIn lead forms and business contact data: kept for up to 12 months after our last contact with you, unless you become a customer or ask us to stay in touch, and deleted on request.
• If you unsubscribe or object to our emails: we keep only your email address and the date on a do-not-contact list, so that we do not email you again.
• Server access logs: kept for security and operations, and only as long as they are needed for those purposes.
• Analytics data: kept according to the retention settings of Google Analytics. Data collected by the LinkedIn Insight Tag is kept by LinkedIn, as described in section 5.

Deleting an item from your history in the app removes it from your history list. To have the underlying files and logs deleted, or your whole account, email service@vescir.com from the email address registered to your account. We complete deletion within one month of verifying the request, except for the billing and transaction records described above.

8. How we protect your data

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS) between your browser and our servers, storing passwords only in hashed form, and short-lived sign-in tokens: the access token is kept only in your browser's memory, and the refresh token expires after about 24 hours.

No system is completely secure. If a personal data breach occurs, we will notify the affected users and the competent authorities where the law requires us to.

You can help by keeping your password to yourself and signing out after using RegaaS on a shared or public computer.

9. Cookies and browser storage

We use cookies and similar browser storage (localStorage and sessionStorage). Strictly necessary storage is always on; everything else is used only as described below.

Strictly necessary (always on)

• regaas.refresh_token (localStorage, or sessionStorage if you sign in without "Remember me"): keeps you signed in. It is valid for about 24 hours without use, and for at most 7 days.
• regaas.refresh_tab (sessionStorage): set only when you sign in without "Remember me". It lets a duplicated tab know that the sign-in belongs to the original tab.
• regaas.remembered_email (localStorage): the email you last signed in with while "Remember me" was ticked, so the sign-in form can fill it in. Signing in without "Remember me" removes it.
• regaas.cookie_consent (localStorage): records your cookie choices.
• NEXT_LOCALE (cookie): remembers your language preference.
• Session and state keys (sessionStorage): used during checkout and navigation, and cleared when you close the tab.
• Cloudflare Turnstile: protects the contact form against automated abuse.

Testing (only while an A/B test is running)

• ab_variant (cookie, 14 days): keeps you on the same version of a page while we compare versions.

Analytics and advertising measurement (only with your consent)

• Google Analytics 4 (_ga, _ga_* cookies), loaded through Google Tag Manager, to measure how the website is used.
• Google advertising measurement, loaded through Google Tag Manager, to measure the results of our advertising.
• LinkedIn Insight Tag, loaded through Google Tag Manager, to measure our LinkedIn advertising, give us aggregated visitor reports, and show our ads on LinkedIn to people who have visited the website. It sets li_fat_id and li_giant on this website, and LinkedIn sets its own cookies on linkedin.com (such as bcookie, lidc, li_sugr, UserMatchHistory and AnalyticsSyncHistory). LinkedIn's Cookie Policy describes them.

These are off by default: we use Google Consent Mode, and analytics and advertising storage stay denied until you accept them. The LinkedIn Insight Tag is not loaded at all unless you accept; if you decline, or make no choice, it never loads.

Fonts

The website loads its fonts from Google Fonts. This does not set cookies, but Google's servers receive your IP address when the fonts are loaded.

Changing your choice

You can change or withdraw your choice at any time through "Cookie settings" in the website footer. You can also delete cookies and site data in your browser settings; if you delete strictly necessary storage you will be signed out.

10. Your rights

Under the GDPR

If the GDPR applies to you, you have the right to:

• access your personal data, including where we obtained it, and receive a copy;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict our processing of your data;
• object to processing based on our legitimate interests and, at any time, to direct marketing, which we will then stop;
• receive the data you gave us in a structured, machine-readable format (portability);
• withdraw your consent at any time, without affecting processing carried out before you withdrew it;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where the alleged infringement took place (in the Netherlands, the Autoriteit Persoonsgegevens).

Under Taiwan's PDPA

Under Taiwan's Personal Data Protection Act, you have the right to:

• inquire about and review your personal data;
• request copies of your personal data;
• request that your personal data be supplemented or corrected;
• request that we stop collecting, processing or using your personal data;
• request that your personal data be deleted.

How to exercise your rights

RegaaS does not have a self-service tool for exporting or deleting data. To exercise any of these rights, email service@vescir.com, preferably from the email address registered to your account. We may ask you to confirm your identity before acting on a request. We respond within one month, as the GDPR requires (extendable by two further months for complex requests, in which case we will tell you), and within the periods set by the PDPA.

Withdrawing consent to analytics is done through "Cookie settings" in the website footer. To stop marketing email or the business emails described in section 3, use the unsubscribe link in any such email, switch marketing email off in Settings if you have an account, or write to service@vescir.com. If you ask us to delete your account data, we can no longer provide the service to you.

11. Age requirement

RegaaS is intended for businesses and professionals, and you must be at least 18 years old to use it. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy when our service or the law changes. We will publish the updated policy on this page and change the "Last Updated" date. If a change materially affects how we use your personal data, we will tell you in advance by email or by a notice on the website.

13. How to contact us

For questions about this policy or to exercise your rights, contact us:

• Company: VesCir Ltd., Unified Business Number 53560699
• Address: 10F-1, No. 155, Section 3, Xinyi Road, Da'an District, Taipei City 106, Taiwan
• Email: service@vescir.com
• Telephone: +886 2 2507 6729
• Service hours: Monday to Friday, 09:00–17:30 (Taiwan time, UTC+8)
• EU office: VesCir Holland B.V., Simon Vestdijksingel 69, 2652 KR Berkel en Rodenrijs, the Netherlands (same email address)