Privacy Policy

This policy explains how [Company legal name], trading as Varly ("Varly", "we"), handles personal data as a controller: when you visit varly.ai, join the waitlist, have a Varly account, receive our emails, or contact us.

Visited a website that uses Varly? Then that website decides what is measured about your visit, and Varly processes the data on its behalf. Please contact that website, and see its privacy policy. Our Data Processing Agreement describes what Varly does for its customers.

Who we are

[Company legal name], [Registered address], registered with the Dutch Chamber of Commerce (KvK) under number [KvK number].

For anything about privacy, email [Privacy contact email].

When you visit varly.ai

varly.ai does not use analytics, advertising or social media trackers, and does not load scripts from other companies.

• Technical data. Like every website, our server receives your IP address and browser details to send you the page. We don't keep a log of the pages you visit. We use your IP address for a moment to block floods of requests, for example on the waitlist form, without saving it.
• Error reports. When a page fails on our side, we store the page path (without the part after ?) and the error message, to fix the problem. These reports are deleted after 60 days.

Cookies and browser storage

We only use cookies and browser storage that the site needs to work or that remember a choice you made:

Because these are needed for the site or set by your own choice, we don't ask for consent for them.

When you join the waitlist

We store your email address, whether you run a shop or an agency, and what you choose to tell us: your website, how many client websites you manage and your goal. We also store which page you signed up on, the website that referred you, and campaign tags (such as utm_source) in the address.

We use this to send you a confirmation, to decide who to let into the private beta, to send you your personal sign-up link, and to understand how people find Varly. The legal basis is your request to join (taking steps before a contract) and our legitimate interest in understanding where sign-ups come from. We keep your entry until you ask us to delete it.

When you have an account

• Account data: your name, email address, password (stored only as a salted hash), and your profile photo if you add one.
• Organizations and roles: which organizations, clients and sites you have access to, and your role.
• Logged-in devices: for each device where you are logged in, the browser, operating system and IP address, and when it was last used. You can see these under Account → Where you're logged in, and log devices out.
• Connected apps: AI assistants you connect to Varly, such as Claude or ChatGPT, and what they may do.
• Settings: such as your email preferences.
• Voice notes: if you speak a note into Varly, the audio is turned into text on our own server and deleted right away. Only the text is kept, and only if you send the note.

We use this to provide Varly to you and to keep your account secure. The legal basis is our contract with you or your organization. We keep your account data until you delete your account under Account → Delete account. Logged-in device records are deleted when you log that device out or delete your account.

What you and your team put into Varly about your websites, such as ideas, notes and research, belongs to your organization. Varly processes it on your organization's behalf under the Data Processing Agreement.

Emails we send

We send emails that belong to the service: a confirmation when you join the waitlist, your sign-up link, a welcome email, password reset links, team and report review invitations, alerts about your organization's AI key and AI limit, notifications you set up, and a weekly summary. You can turn off the weekly summary under Account. The other emails are needed to run your account.

We don't send marketing emails without asking you first.

When you contact us

When you email us, use Report a problem on an error page, or rate a help article, we store what you send us: your message, your email address if you give it, and for problem reports the page path and your browser. To limit problem reports to 5 per hour, we store a one-way hash of your IP address, never the address itself. If you are logged in, we link your report or rating to your account.

We use this to help you and to improve Varly, based on our legitimate interest. We keep it as long as we need it for that, and delete it sooner if you ask.

Who receives your data

We never sell your data and never use it for advertising. We share it only with companies that help us run Varly, under a contract that binds them to our instructions:

• Hetzner Online GmbH (Germany) hosts our servers and databases.
• Resend (Plus Five Five, Inc., USA) sends our emails, from its EU region.
• Cloudflare, Inc. (USA) provides DNS for varly.ai and stores off-server copies of our backups in the EU.
• Our email and office software providers, when you email us.

Your data may also be shared when the law requires it, for example with a court or authority.

If you connect an AI assistant to Varly, or your organization adds an AI key, that provider receives what you ask it to work on, under your own agreement with them.

Where your data is stored

We store your data in the European Union, on servers in Germany. Some of the companies above are based in the United States. Where data is transferred outside the European Economic Area, the transfer is covered by an adequacy decision of the European Commission or by the Standard Contractual Clauses. See Sub-processors for details.

How we protect it

All connections to Varly use HTTPS. Passwords are stored only as hashes, AI keys are encrypted, and access to our systems is limited and logged. Annex 1 of the Data Processing Agreement describes our measures in more detail.

Your rights

You have the right to ask us for access to your data, and to have it corrected, deleted or handed over to you in a common format. You can also object to processing based on our legitimate interest, and ask us to restrict processing.

You can change your name, photo, password and email preferences, log out devices and delete your account yourself under Account. For anything else, email [Privacy contact email]. We answer within one month.

If you think we handle your data wrongly, please tell us first. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.

Children

Varly is a business tool and is not meant for children under 16. We don't knowingly collect data from them.

Changes to this policy

When we change this policy, we update the version and date at the top. If a change matters for account holders, we email them before it takes effect.