This policy covers VerseDocs, the document automation solution VerseBlocks publishes for Microsoft Power Platform, and the licensing service behind buying a key for it. It describes what the software actually does, checked against the code that does it, rather than what a product of this kind usually does.
vdocs_TelemetryOptOut environment variable to true.VerseBlocks LLC, trading as VerseBlocks, is responsible for the data described here. To ask what is held about your organization, to get a copy of it, or to have it deleted, write to admin@verseblocks.com. Section 10 explains what to include so the request can be matched to your records.
VerseDocs ships as a Dataverse managed solution: plug-ins registered as vdocs_*
Custom APIs, running in the Microsoft plug-in sandbox in your own environment. When you generate a
document, the template, the data merged into it, and the finished file are handled in memory inside
that sandbox and written back to Dataverse. They are never transmitted anywhere outside your tenant
by VerseDocs.
This is a property of how the product is built, not a promise bolted on afterwards. The document code has no network access of any kind. The only outbound HTTP call anywhere in the shipped plug-ins belongs to the three reporting APIs described in sections 3 to 5, and no document operation ever calls it.
So none of the following is ever sent to VerseBlocks by VerseDocs:
One distinction matters here, because section 3 explains that usage counts are aggregated from a
Dataverse table and that can read as a contradiction of the list above. Your business
data is what lives in your own tables: accounts, contacts, cases, orders, whatever your
environment holds, plus the templates and documents built from it. None of that is read for a
report, ever. VerseDocs' own operational rows are a different thing: the
vdocs_usage table is written by VerseDocs itself, one row per action it runs, and holds
no business data at all. Telemetry counts those rows. That is the whole of the overlap.
Nothing in the product uploads a document to VerseBlocks for processing, because nothing in the product can. If you ever see VerseDocs trying to send a document somewhere, that is a bug worth reporting immediately.
The vdocs_SendTelemetry action assembles one JSON report and posts it to VerseBlocks.
It contains exactly these fields and nothing else:
| Field | What it is |
|---|---|
| Event type | The word telemetry. All three reporting actions post to one
URL, and this field is how the receiving end tells a usage report from a registration or a piece of
feedback. |
| Org ID | The GUID of the Dataverse environment. Identifies the environment, not a person. |
| Tenant ID | The GUID of your Microsoft Entra tenant. Empty if it cannot be resolved. |
| License edition and status | The edition (Standard or Pro; a
VerseDocs Premium key reports Pro), whether the key validated, and the reason code if it
did not. |
| Template count | How many rows are in the VerseDocs template table. A number. No names. |
| Usage counts | For each action and each calendar month, how many times it ran. For example: vdocs_TemplateDocx, 2026-08, 412. |
| Registration details | Company name and contact email, only if a previous registration stored them in this environment or the caller passed them on this call (section 4). Absent otherwise. |
| Timestamp | When the report was assembled, in UTC. |
The usage counts are aggregated from the vdocs_usage table your environment already
keeps, which VerseDocs writes for itself and which holds no business data (section 2). Only two
columns of that table are read: which action ran, and when. The rest of the row, including the input
and output byte sizes and the Dataverse user ID of the caller, is not read and is not sent. No user
names, user IDs, or email addresses appear anywhere in this report.
The report is posted server to server by the plug-in sandbox in your environment, not by anyone's browser. It carries no cookies, no browser or device identifiers, and no IP address as a field, and receiving a usage report does not cause any address to be stored. Every HTTP request does arrive from somewhere, though, and one of the three reporting actions records that: registration, in section 4.
Only when something calls vdocs_SendTelemetry. It is a Custom API in its own right.
Generating, converting, watermarking, or merging a document never triggers it, and the solution
does not schedule it for you: the report happens when you or an administrator set up something to
call it, such as a scheduled Power Automate flow.
Separately, nothing is sent by any of the three reporting actions unless the
vdocs_TelemetryEndpoint environment variable holds a destination. It ships unset, and
the product contains no fallback URL. With it unset, these calls do nothing and send nothing.
Set the vdocs_TelemetryOptOut environment variable to true (or
1). Two ways to do it:
vdocs_TelemetryOptOut, then publish customizations.The flag is read first, before anything is gathered. When it is set, the action returns immediately without querying your usage table, without reading your template count, and without assembling a report at all. Opting out prevents collection, not merely transmission.
The opt-out covers this periodic report. It deliberately does not gag the two actions below, because those only ever run when a person chooses to run them, and silently swallowing a deliberate click would be worse than leaving them outside the toggle.
The vdocs_Register action tells VerseBlocks who an environment belongs to, since an
org ID on its own is not a name. When it is called it sends the event type (registration),
a company name, a contact email, the org ID, the tenant ID, and a timestamp. Nothing else.
Calling it is a deliberate act, and calling it is the consent for that one message. It never runs on its own, and the Licensing page in the Admin app no longer offers it: it is a Custom API that you or an administrator invoke directly, typically from a Power Automate flow.
Registration is the one part of VerseDocs that causes a network address to be
recorded. The receiving service reads the address the request arrived from, out of the
X-Forwarded-For header, and stores it on the activation record it writes (section 6).
Because the call is made by the plug-in inside your environment rather than by a browser, that
address is your environment's outbound address rather than any individual's device. An IP address is
personal data under the GDPR either way, and this policy is not going to pretend otherwise. Usage
telemetry and feedback do not store one.
The company name and email are also stored back into your own environment, in the
vdocs_RegisteredCompanyName and vdocs_RegisteredContactEmail environment
variables, so that later telemetry reports can include them without you retyping them. If you want
them out of future reports, clear those two variables in the maker portal. Clearing them stops them
being included from that moment on. To have what was already sent deleted, see section 10.
The Send feedback form on the Licensing page calls
vdocs_SubmitFeedback. It sends the event type (feedback), the message you
typed, exactly as you typed it, an optional contact email if you filled one in, the org ID, the
tenant ID, and a timestamp.
Submitting the form is the consent for that message to be sent. Nothing is sent until you press the button, nothing is retained by the form afterwards, and the message is not gathered from anywhere else in the product.
The form sends free text, so treat it as free text: it reaches a human at VerseBlocks as an email. Do not paste document content, personal data about your customers, or anything confidential into it. If you leave the contact email blank, VerseBlocks has no way to reply to you.
Worth being exact about, because the wording on screen is easy to over-read. When the page says Sent. Thank you. it means the report was accepted by VerseBlocks' receiving endpoint. It does not mean a person has it. Turning that report into an email happens afterwards, on the VerseBlocks side, and can still fail: if the mail service is misconfigured or rejects the send, the failure is recorded in VerseBlocks' logs and the page will already have thanked you.
What is guaranteed is the other direction. If this environment has no telemetry endpoint
configured, or the endpoint cannot be reached at all, the page tells you the message could not be
delivered and leaves your text in the box rather than thanking you for feedback that went nowhere.
So: a failure notice is reliable, a thank you is not a delivery receipt. If you need an answer, treat
the form as best effort and follow up by email to admin@verseblocks.com, the address
your license key email comes from.
Sections 3 to 5 describe what leaves your environment. This is what becomes of it on the other side, so that the retention periods in section 9 are about records you have actually been told exist.
Up to three rows, created together the first time an environment registers:
versedocs), a free identity-only
license for that org, a hash and short prefix of its key, its status, and the org ID it was
registered for. This path issues no signed VerseDocs key and grants no entitlement; it exists so the
org is addressable for support and reporting.A repeat registration from an email that already holds a VerseDocs license is recognized and does not create a second set.
One row per report received, holding:
Nothing is written to a database. The message is turned into an email to the VerseBlocks mailbox, carrying your text, the org and tenant IDs, and your contact email if you gave one. From there it lives in that mailbox like any other email.
VerseDocs is sold as one plan, VerseDocs Premium, licensed to your whole Microsoft tenant rather than to a single environment. When you press Buy on the Licensing page, VerseDocs sends the VerseBlocks licensing service:
versedocs) and the plan (premium). The service resolves
that pair to whichever Stripe price is currently live, so no price and no amount is baked into the
page installed in your environment.tenant) and your Microsoft Entra tenant ID, which travels twice, once as
the scope ID and once as the tenant ID.Your environment's org ID is deliberately not sent. It used to be, when a key covered one environment; sending it now would issue a single-environment key to someone paying to cover the tenant. The licensing service refuses a VerseDocs checkout that is not tenant scoped rather than quietly issuing the narrower key.
Keys issued earlier and scoped to a single org keep working, and the Licensing page describes what your key actually covers based on the scope of the key you hold, not on what is sold today.
No card details are involved at this stage, and none pass through Dataverse at any stage.
Payment is handled entirely by Stripe, on Stripe's own hosted checkout page, opened in a new browser tab. You enter your card details there, on Stripe's page, under Stripe's privacy policy. VerseBlocks never sees, receives, or stores card numbers, expiry dates, or security codes. There is nowhere in VerseBlocks' systems that could hold them.
Stripe also receives whatever else you enter on that page, typically your name, email address, and billing address, along with your tenant ID, passed through as the session's client reference and in its metadata so the key that comes back is scoped to the right tenant.
When Stripe confirms the payment it notifies the licensing service, which records:
The issued key itself is held in readable form only until it is collected once. The Licensing page fetches it immediately after checkout, and that copy is erased from the database on the first successful retrieval. After that the key exists in your environment and in the email that was sent to you, and only as a hash on the VerseBlocks side.
The key is emailed to the address you gave at checkout, from admin@verseblocks.com,
sent through Microsoft 365. A copy stays in that mailbox's sent items, so the email address, name,
and key you were issued are also in VerseBlocks' mailbox until deleted.
VerseBlocks does not sell this data, does not share it with advertisers, and does not use it to build profiles of individuals. It is used to issue and support licenses, to bill correctly, to answer feedback, and to understand which parts of the product get used.
vdocs_usage rows are not VerseBlocks' data at all. They live
in your Dataverse environment, under your retention policy, and VerseDocs never deletes them for
you. Telemetry only ever counts them.vdocs_TelemetryOptOut to
true (section 3). Nothing further is gathered from that point.vdocs_TelemetryEndpoint. With no endpoint, telemetry, registration, and feedback all
have nowhere to go and send nothing.vdocs_RegisteredCompanyName and vdocs_RegisteredContactEmail.Records are not all filed under the same identifier, so include all three of these that apply:
The Licensing page in the VerseDocs Admin app shows the org ID and tenant ID with a copy button next to each.
Deleting purchase records is limited by the retention above: a paid invoice cannot be erased on request where the law requires the record to be kept.
This policy is versioned and dated at the top. When what the software sends changes, this page changes in the same release, and the version and date change with it. The AppSource listing and the in-product Licensing page both link here, so the current version is always the one describing the build you are running.