On this page
- We use account and billing information to provide the service you request.
- Appearance preferences, website analytics and support chat are controlled by your cookie choices.
- Customers control the visitor data and consent on their own websites.
Who this notice covers
This notice covers varypilot.com, app.varypilot.com and docs.varypilot.com. Varypilot is the service brand; service contact and hosting information are available in the legal notice. For privacy requests, contact hello@varypilot.com.
For account administration, subscriptions, enquiries and our own support, the service operator determines the purposes of processing. For experiment data supplied by a customer, the customer normally determines those purposes and Varypilot processes the data to provide that customer’s service.
Information we handle
- Account and workspace information: name, email, authentication information, workspace membership, permissions, experiment configuration and service activity.
- Billing information: the selected plan, billing identity, subscription status, invoice references and payment status. Payment details are entered in Stripe’s hosted interface; the Varypilot application does not provide a card-entry form.
- Experiment data: the visitor identifiers, assignments, exposures, conversions and revenue events that customers choose to send. Do not send names, email addresses or sensitive personal information as visitor identifiers or event properties.
- Enquiries: name, business email, company, optional website, traffic range and the message submitted through the contact form.
- Support: messages and session information when you request chat. AI support receives recent conversation messages and public product documentation; it has no account-management or payment tools.
- Technical information needed for delivery and security: network and request information, error records and short-lived abuse-prevention fingerprints. Raw network addresses are not stored with sales enquiries.
- Website analytics, when you allow it: aggregate public-page visits, referring website, country, browser and device information. URL queries and fragments are removed; private account, authentication and workspace pages are excluded.
Why we use it
| Purpose | Basis where GDPR applies |
|---|---|
| Account access, workspace operation and requested subscriptions | Performance of the service contract or steps you request before a contract |
| Security, abuse prevention and responding to enquiries | Legitimate interests in operating and protecting the service, balanced against your rights |
| Billing records and legally required disclosures | Applicable legal obligations |
| Optional appearance storage, website analytics, support cookies and promotional emails | Consent or the specific preference you provide; it can be withdrawn |
Cookies, email and AI choices
Appearance storage, Vercel Web Analytics and support chat are optional. Analytics starts only after you choose it, uses no analytics cookies, and can be turned off in Cookie settings. Essential authentication, security, language and consent-choice storage remain available.
Trial-end, renewal, payment and essential account emails are service messages. Trial tips and promotional offers are optional and include an unsubscribe route. Submitting a sales enquiry does not subscribe you to marketing.
If you connect an external AI client to your workspace, that client receives the access and information you authorize. Read access can include experiment configurations and aggregate results; additional administration access can include team email addresses and credential metadata. Review your chosen AI provider’s own terms. Passwords and server credential secrets are not returned by the MCP service.
Service providers and transfers
We use infrastructure and payment providers to operate the application. Support providers are used only when the corresponding support service is enabled and requested. Authorized teammates can access workspace information according to their assigned role. Information may also be disclosed where required by law or necessary to protect the service and its users.
Provider operations can involve processing outside the European Economic Area. The applicable service agreement, provider data-processing terms and transfer safeguards govern those transfers. Contact us for information about the arrangements relevant to your workspace; no all-data-in-France guarantee is made.
How long information stays
- Account and workspace records remain while the workspace exists and as needed to provide the service, respond to requests and meet applicable legal obligations. Contact us to request account closure or deletion.
- Experiment-visitor data follows the workspace’s supported retention settings and deletion controls. Customers can request visitor exports and erasure through their workspace.
- Sales enquiries are scheduled for removal after one year by routine maintenance. Support messages and reply records are removed after 30 days by scheduled cleanup. Recent messages and public guides are sent to OpenAI Codex to generate an answer.
- The cookie choice is remembered for 180 days. Appearance storage remains on the browser until cleared or removed after the preference is withdrawn. The support-session cookie lasts up to 24 hours.
- AI-client access tokens expire after one hour; refresh tokens rotate and expire after 30 days, with a maximum connection duration of 90 days. Connections can be revoked. Expired or revoked grants are cleaned up after one year and mutation-retry records after seven days.
- Billing and transaction records may be retained for applicable accounting, tax or dispute obligations even when a workspace closes.
Your rights and requests
Where applicable, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent without affecting processing already lawfully carried out.
Email hello@varypilot.com with the request and enough information to locate the relevant account or conversation. We may ask for proportionate information to verify that the request concerns you. Do not send passwords, private keys or payment-card details.
Requests are handled within the applicable legal time limits, normally one month under GDPR. You can complain to your competent data-protection authority, including the CNIL in France. For data collected on a customer’s website, contact that customer as controller; we assist with requests relating to the processing we perform for it.
Updates and contact
We update this notice when the service or its data practices change. The revision date appears above. Where a change requires a new consent, optional features remain subject to that choice. Privacy contact: hello@varypilot.com.
Let’s make it clear.
For a privacy request, billing question or a specific agreement, write to our team.