Privacy Policy & Browser Extension Data Disclosure
Verisource (https://verisource.dev) collects only the account, billing, and domain-level telemetry required to run B2B Generative Engine Optimization audits and meter Paid /mcp requests. We do not sell customer data or cross-site browsing logs.
1. Chrome Extension Permissions (Manifest V3)
The Verisource Chrome Extension requests two permissions only: sidePanel and activeTab.
- Zero background browsing collection: The extension never reads tabs in the background and requests zero
<all_urls>host permissions. - Explicit user trigger: The current tab hostname is inspected only when you click the Verisource toolbar action or press Inspect Active Tab inside the side panel.
- Readiness probe payload: Only the public domain hostname (for example,
aurearoasters.com) is sent tohttps://verisource.dev/api/graderto inspect/robots.txt,/llms.txt, and/agents.md. Cookies, passwords, and form inputs on visited pages are never read or transmitted.
2. Account, Billing & MCP API Key Storage
Work email authentication and workspace data are stored in Supabase PostgreSQL with Row-Level Security (RLS) enforced per tenant. Payment card details are processed directly by Stripe Checkout; Verisource stores only Stripe customer and subscription identifiers. Minted vs_live_ MCP keys are hashed with SHA-256 prior to database storage—raw secret values are shown once at creation and never logged in plaintext.
3. First-Party AI Attribution Pixel (`/api/pixel`)
Merchants who install the optional 10-line attribution snippet send only the referring AI engine name (such as chatgpt or perplexity), landing path, and order total USD to https://verisource.dev/api/pixel. The pixel sets zero third-party cookies and stores zero shopper names, email addresses, or IP addresses in ai_attribution_events.
4. Data Deletion & Contact
Account owners may revoke MCP API keys or delete tracked domains at any time from /dashboard. For full account deletion or privacy inquiries, email support@verisource.dev.