Privacy Policy

Last updated: October 11, 2026

1. Introduction

Sage Mode, LLC, doing business as Verrly ("Verrly," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, applications, and services (collectively, the "Service"). For the personal data of account holders, Verrly is the controller. For the personal data of people you email through the Service (see section 6), you are the controller and Verrly is your processor.

2. Information We Collect

2.1 Information You Provide to Us

2.2 Information Collected Automatically

2.3 Information from Third Parties

2.4 Mailbox access (Gmail and Outlook)

If you connect a mailbox, we ask for these permissions: Gmail (send, read-only and modify) or Microsoft (Mail.Send, Mail.Read, Mail.ReadWrite). We use them to send your outreach from your own address, to find replies to that outreach, and to mark messages. To detect replies we look at the sender, subject and threading headers of recent inbox messages (the last day at each sync) and keep a record only when a message is a reply to an email Verrly sent for you. When a reply is found, its text may be sent to an AI provider to classify it (for example interested or not interested). We do not use mailbox content to advertise to you or to train AI models. You can disconnect the mailbox in Settings at any time, which removes our access tokens.

3. How We Use Your Information, and Our Legal Bases

If you are in the EEA or UK, these are the legal bases we rely on (GDPR Article 6):

We also use information to comply with legal obligations.

4. Data Sharing and Service Providers

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use the following service providers (sub-processors) to run the Service. Some are used only for certain features or only when they are configured and you use the feature.

These providers process data under their own terms and security commitments. We may also disclose information if required by law, in a business transfer (merger, acquisition), or with your consent.

5. Data Security

We protect data with HTTPS encryption in transit, hashed passwords, encrypted storage of mailbox tokens and two-factor secrets, access controls, and optional two-factor sign-in. No method of transmission or storage is completely secure. If a breach affects your personal data, we will notify the people and authorities we are required to notify, without undue delay and within the time limits that apply (for example 72 hours to a GDPR supervisory authority where required).

6. People You Email Through Verrly

When you send outreach through Verrly, we process the recipient’s name, business email address, company and domain, the message, and whether it was delivered, opened, replied to or unsubscribed, on your behalf and on your instructions. We keep this for as long as your account is active. Every outreach email includes an unsubscribe link; when someone unsubscribes, we stop further outreach to that address from that sender (the customer whose email they unsubscribed from). The unsubscribe applies to that sender only, so another Verrly customer could still email the same address from their own account. A recipient who does not want outreach from anyone using Verrly can write to us (see below) and we will handle the request in line with applicable law. Recipients can ask us to see or delete their data, or to stop emails, through our contact form; we will pass requests to the sending customer where they are the controller and act on them where we are.

7. Data Retention

We keep account and campaign data while your account is active. When you confirm account deletion in Settings, we delete your personal information from our live database straight away. Exceptions: payment records are kept in anonymized form (no link to your account) for tax and bookkeeping, and a one-way hashed record of your email address is kept so that the free trial can be used once per person (it cannot be turned back into your email). Encrypted database backups are kept for 14 days and then deleted, so deleted data can remain in a backup for up to 14 days; we do not restore deleted accounts from them. Support messages are anonymized rather than deleted. Server logs are kept only as long as needed for security and troubleshooting.

8. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your information, to restrict or object to processing, and to withdraw consent. You can export and delete your data yourself in Settings. For anything else, use our Contact Us form; we respond within 30 days. If you are in the EEA or UK you can also complain to your local supervisory authority.

9. Cookies and Tracking Technologies

We use essential cookies to keep you signed in and secure. Google Analytics runs only if you accept analytics cookies, and you can change your choice any time from "Cookie settings" in the footer or, when signed in, in Settings under Account. We use Sentry for error monitoring; it runs without a cookie choice because it is needed to keep the Service working, and it receives technical error details (page, browser, error message), not marketing data. Outreach emails sent through Verrly can contain a small tracking image that records an open, and links that record a click; this is described in the footer of those emails. We do not use advertising or remarketing cookies. See our Cookie Policy. We do not currently respond to browser "Do Not Track" or Global Privacy Control signals, because we do not sell personal information or share it for advertising.

10. International Data Transfers

Verrly is based in the United States and our providers may process data in the United States and other countries. Where required, transfers rely on safeguards such as Standard Contractual Clauses.

11. EEA and UK Users (GDPR)

The legal bases for processing are listed in section 3. You have the rights in section 8. We have not appointed an EU or UK representative or a Data Protection Officer; send privacy questions through our contact form. Customers who need a data processing agreement can request one through our contact form.

12. California Residents (CCPA/CPRA)

In the last 12 months we collected these categories of personal information: identifiers (name, email, IP address); commercial information (plan and payment history); internet activity (usage and log data); business information you provide; and, if you connect a mailbox, email metadata and content as described in section 2.4. We collect them to provide and secure the Service, as described in section 3, and disclose them to the providers in section 4. We do not sell personal information and do not share it for cross-context behavioral advertising. California residents may ask to know, correct or delete their information, and will not be treated differently for doing so; use the contact options in section 8. If you connect a mailbox, the email content described in section 2.4 may count as sensitive personal information under California law. We use it only to send your outreach, find replies and mark messages as described there, not to infer characteristics about you or for any other purpose, and we keep it as described in section 7.

13. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16.

14. Third-Party Links

The Service may link to third-party websites. We are not responsible for their privacy practices.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time and will post the new policy here with an updated "Last updated" date. For material changes we will also email account holders.

16. Contact Us

Questions about this Privacy Policy? Use our Contact Us form. We aim to reply within 1-2 business days. You can also reach us by mail at Sage Mode, LLC (dba Verrly), PO BOX 280865, Northridge, CA, 91328, United States.