Privacy Policy

2. How we use information

• Provide, operate, maintain, and secure the Services;
• Process payments, subscriptions, orders, refunds, and returns;
• Create and manage your VarYar Account;
• Provide customer support and respond to inquiries;
• Deliver custom development / enterprise engagements per contract;
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service, including CSAM and child-exploitation detection as described in Section 8;
• Comply with legal obligations, respond to lawful requests, and enforce our agreements;
• Send you transactional communications (e.g., receipts, security alerts) and, with your consent where required, service updates or marketing communications, which you may opt out of at any time.

3. Legal bases for processing (EEA/UK/India users)

• Performance of a contract (e.g., providing the Service you signed up for);
• Consent (e.g., optional marketing communications, which you can withdraw at any time);
• Legitimate interests (e.g., security, fraud prevention, service improvement), balanced against your rights;
• Compliance with legal obligations (e.g., tax, law enforcement requests, child-safety reporting).

Where we rely on legitimate interests you may object to that processing at any time (see Section 9); where we rely on consent you may withdraw it as easily as you gave it.

4. Free vs. paid accounts

The data we collect is generally the same regardless of tier, but usage and retention differ:

• Free accounts: subject to standard data retention and support-priority limits described on our pricing pages; free-tier usage data may be retained for a shorter period and used in aggregate/anonymized form to improve the Services.
• Paid accounts and enterprise customers: may have additional contractual data-handling terms (e.g., data processing agreements, extended retention or deletion commitments) set out in the applicable order form or MSA, which take precedence over general retention practices described here.

5. How we share information

• Payment processors: Razorpay and Stripe, to complete transactions.
• Hosting and infrastructure: Vercel, which hosts and delivers our websites and sees your IP address and request details when you visit.
• Database: Supabase, which stores data such as waitlist sign-ups and store content on our behalf.
• Email delivery: Brevo, which sends our transactional emails (for example waitlist confirmations) and delivers the contents of the contact and support forms you submit to our team.
• Other service providers: logistics/shipping (for hardware) and customer support tooling, under contractual confidentiality and data-protection obligations.
• Legal and safety: law enforcement, regulators, or courts when required by law, or to protect the rights, safety, or property of VarYar, our users, or the public — including mandatory reporting of CSAM to NCMEC or equivalent authorities.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
• With your direction: when you explicitly authorize sharing (e.g., integrations you enable).

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising (as those terms are used in the CCPA). These providers may use personal data only to provide their services to us, not for their own marketing. We update this list when our providers change, and you can ask for the current list at [email protected].

6. Data retention

We retain personal data for as long as necessary to provide the Services, comply with legal obligations (including tax and accounting records, typically 7 years in India), resolve disputes, and enforce agreements. CSAM-related reports and records may be retained as required by applicable law (e.g., NCMEC reporting obligations) even after account termination. You may request deletion as described in Section 9, subject to these exceptions.

Deletion. When you delete content or your account, or we confirm a deletion request, we remove the data from our live systems within 30 days. Copies held in encrypted backups are overwritten on our normal backup cycle, which completes within 90 days, and are not used for anything other than disaster recovery (if a backup is ever restored, the deletion is re-applied). Data we must keep by law (for example tax records, or records relating to fraud, abuse, or child-safety reports) is kept only for the period the law requires, and is not used for any other purpose. Waitlist and newsletter addresses are removed when you unsubscribe or ask us to.

7. Data security

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, access controls, and hashed password storage. No system is completely secure; you should also take steps to protect your account, such as using a strong, unique password. If a security incident affects your personal data, we will notify the affected users and the relevant authorities within the timelines required by applicable law (for example CERT-In, the DPDPA, and GDPR).

8. Children’s privacy and child safety

8.1 Age requirement. Our accounts, subscriptions, and purchases are intended for users 18 years of age or older. The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 (including under the U.S. Children’s Online Privacy Protection Act). We also do not knowingly process the personal data of anyone under 18 (India’s DPDPA) or below the applicable age of digital consent in the EU/UK (13–16, depending on the country) without the verifiable consent of a parent or guardian where the law requires it. We do not track, behaviorally monitor, or target advertising at children.

8.2 If we learn of a child’s data. If we learn that we have collected personal information from a child in violation of applicable law, we will promptly delete it and close any associated account. Parents/guardians who believe their child has provided personal information to us may contact [email protected] to request review and deletion.

8.3 Zero tolerance for CSAM. Consistent with our Terms of Service, VarYar has a zero-tolerance policy for child sexual abuse material (CSAM) and content that endangers minors. We use automated tools (including hash-matching against known CSAM databases where feasible) and human review to detect such material, and we report confirmed or suspected violations to the National Center for Missing & Exploited Children (NCMEC), India’s National Cyber Crime Reporting Portal, and/or other appropriate authorities, and preserve related records as legally required. Accounts involved are suspended or terminated immediately upon detection.

8.4 Reporting. To report suspected CSAM or child exploitation, contact [email protected] or use the in-product report tool. Do not download, save, or forward suspected material — report it directly so it can be escalated safely.

9. Your privacy rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your data, subject to legal retention requirements;
• Object to or restrict certain processing;
• Request a portable copy of your data;
• Withdraw consent for optional processing (e.g., marketing) at any time;
• Lodge a complaint with your local data protection authority (e.g., India’s Data Protection Board, or your EU/UK supervisory authority).

To exercise these rights, contact [email protected] or manage your data directly through account settings at accounts.varyar.com. We will verify your identity before fulfilling requests and respond within the timeframe required by applicable law (generally within 30 days, or one month under GDPR), free of charge unless a request is manifestly unfounded or excessive. If you are in California, you also have the right to know, delete, and correct your personal information, to opt out of its sale or sharing (which we do not do), and not to be discriminated against for exercising these rights; you may use an authorized agent. If you are in India, you may also nominate another person to exercise your rights on your behalf if you die or become incapacitated. If we decline a request you may appeal by replying to our response, and you may always complain to your local authority.

10. International data transfers

As a company serving users in India and globally, we may transfer, store, and process personal data in countries other than your own, including India and the United States (where some of our hosting, database, and email providers operate). Where required, we implement appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

11. Cookies and similar technologies

We use strictly necessary cookies/local storage (e.g., to keep you logged in at accounts.varyar.com and maintain session security). We do not currently use third-party advertising or analytics cookies. If this changes, we will update this Policy and provide any consent mechanism required by law.

12. Third-party links and services

The Services may link to third-party websites or integrate third-party payment processors. This Policy does not apply to those third parties; please review their respective privacy policies.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Services or by email, and we will update the “Last updated” date above and, where practicable, give at least 30 days’ notice of material changes. Where the law requires your consent to a change in how we process your data, we will ask for it rather than rely on your continued use of the Services.

14. Contact us

If you have questions about this Privacy Policy or our data practices, contact:

• VarYar — Privacy Team (data controller for the Services)
• Grievance Officer (India — IT Act and DPDPA): write to [email protected] with “Grievance” in the subject line; we acknowledge within 48 hours and resolve within 30 days
• Email: [email protected]
• Trust & Safety / Child Safety reports: [email protected]
• Accounts: accounts.varyar.com