Privacy and GDPR: what Varly stores and for how long

Varly is built to learn how people use your site, not who they are. This article explains what is stored, so you can describe it in your privacy policy. Whether that is enough for your situation is something you decide with your own privacy advisor; this article is not legal advice.

Only after consent

Varly measures nothing until a visitor accepts statistics or analytics cookies in your cookie banner. Before that, no cookie is set and no data about the visit is sent. See Cookie consent.

What Varly stores

For each visit, after consent:

• A random visitor ID and session ID. The visitor ID is kept in a first-party cookie, _varly_id, for one year, with a copy in the browser's local storage. Both are removed when a visitor withdraws consent. It is a random code, not linked to a name or email address.
• Which pages were viewed: the page path (such as /products/blue-shoe), the referring website (only its domain), and campaign tags such as utm_source.
• The device: device type (desktop, mobile, tablet), browser and operating system family, and window size.
• The country, worked out from the connection. The IP address itself is not stored.
• What happened on the page: clicks (position, element and its visible label, hidden in the same way as text in recordings), scroll depth, page speed, and JavaScript errors. Email addresses and long numbers are removed from error messages.
• Session recordings, unless you switch them off. New sites record all visits; you choose the share under Settings → Session recordings → How many visits to record. Text is hidden in the visitor's browser (Hide text in recordings): hidden text never reaches Varly. Recordings store page addresses without the part after ? or #. See Recording privacy.
• Survey answers, if a visitor answers one of your surveys. Open questions store what the visitor types.
• Test results: which version of a test a visitor saw.
• Orders, if you connect your shop: order number, time, amount, currency, number of items, and the visitor and session ID. Names, email addresses and postal addresses are not stored.

What Varly never stores

• IP addresses. Varly uses the IP address only for a moment: to check it against your Exclude IP addresses list and to block floods of requests. It is never saved.
• What visitors type into your site's form fields. Form fields are always masked in recordings.
• Anything from pages listed under Never track these pages, such as your checkout and cart. The snippet does nothing there.

Where and how long

Varly stores data in the EU and deletes it automatically after these periods:

Data	Kept for
Pageviews and events	13 months
Clicks for heatmaps	6 months
Orders, test results and survey answers	25 months
Session recordings	30 days
Recordings you add to your favorites	13 months

Only favorites are kept longer. Adding a note to a recording also adds it to your favorites; removing it from your favorites brings it back to 30 days. You can delete data sooner yourself. See Delete data.

Who can see the data

Only people on your team who have access to the site, and AI assistants (such as Claude or ChatGPT) that a team member connects to Varly. If your organization adds an AI key, the AI features send the research data of the site they work on to the provider of that key (Anthropic, OpenAI, Google, DeepSeek or Mistral, whichever you chose). They never see data from your other clients.

If your site uses Google Analytics 4 and you leave Send test data to GA4 on under Settings → Experiments, the snippet also tells your own GA4 which test version a visitor saw, only for visitors who accepted cookies. That data then follows your GA4 settings. Choose Don't send anything to GA4 to turn this off. See See your A/B tests in Google Analytics 4.

Sample text for your privacy policy

Analytics and A/B testing (Varly)

We use Varly to understand how visitors use our website and to test improvements. Varly only measures your visit if you accept statistics cookies. It then places one cookie, _varly_id, with a random ID that is kept for one year, keeps the same ID in your browser's local storage, and uses your browser's storage for the current visit.

Varly records which pages you view, how you click and scroll, your device type, browser, screen size and country. If session recordings are on, a replay of your visit is made. What you type in form fields is never recorded, and [numbers and email addresses / all text] on the page are hidden in your browser before anything is sent. Your IP address is not stored. We may also link orders to a visit to measure the effect of tests; Varly does not store names or contact details for this.

The data is stored in the EU and deleted automatically: pageviews after 13 months, click data after 6 months, recordings after 30 days (13 months for recordings we mark as a favorite), and orders, test results and survey answers after 25 months.

You can withdraw your consent at any time through [link to your cookie settings].

Common questions

Is the visitor ID personal data? It is a random code, but it does recognize a returning browser. Many privacy rules treat that as personal data, which is why Varly waits for consent.

A visitor asks us to delete their data. Varly doesn't know who a visitor is. You can delete a single recording yourself. All other data is deleted automatically after the periods above, or when you delete the site.