Op deze pagina
- Customers determine the purposes and consent for experiment data collected on their own websites.
- Varypilot uses a small set of infrastructure and payment providers to deliver the requested service.
- Optional chat and external AI connections add recipients only when those services are used.
Controller and processor roles
The service operator determines how account, billing, security and its own enquiry/support information is used. A customer normally determines the purposes and legal basis for personal data collected through experiments on that customer’s websites.
Varypilot processes customer experiment information to provide the configured service. Customers must use appropriate identifiers, obtain required consent and give lawful processing instructions. This page is an operational overview, not a substitute for a required executed data-processing agreement. Contact hello@varypilot.com to arrange a DPA before supplying personal data that requires one.
Providers and purposes
| Provider / service | Purpose | Information involved |
|---|---|---|
| Vercel | Website and application hosting, delivery and operational request logs | Website requests and technical connection information |
| Vercel Web Analytics | Optionele samengevoegde statistieken voor website en documentatie | Bezoeken aan openbare pagina’s, verwijzende website, land, browser en apparaat; zonder URL-parameters en fragmenten |
| Supabase | Authentication, account and workspace database | Account details, permissions, configurations and service records |
| Cloudflare | Experiment delivery, event processing and storage | Project configuration, pseudonymous visitor identifiers and events |
| Stripe | Hosted checkout, subscriptions, invoices and fraud prevention | Billing identity, payment information and transaction records |
| Cloudflare, when chat is enabled and requested | Support conversation delivery and session continuity | Chat messages and technical chat-session information |
| OpenAI Codex, when AI support is used | Product-support responses grounded in public documentation | Recent support messages and public Varypilot guides |
| Google, if you choose Google sign-in | Optional account authentication | Authentication and profile information you authorize |
Provider notices
A provider’s legal role depends on the service it supplies. For example, payment or authentication providers may act independently for some fraud-prevention or account-processing activities. The following links identify their own notices and processing terms.
Access and data controls
Workspace roles restrict access to configuration, results and administration. Server credentials should be kept on servers and scoped to the intended project and environment. Customer visitor exports, deletion and retention controls are available through the workspace.
AI-client connections have explicit scopes and can be revoked. The support assistant uses public documentation and recent conversation messages; it has no tools to access a customer workspace, change billing or execute arbitrary application actions.
Locations and transfers
Hosting and provider operations can span several jurisdictions. No statement on this page guarantees that all processing takes place in France or exclusively in the EEA. The applicable agreements and provider transfer safeguards govern any international processing. Ask us for the arrangements relevant to your workspace or proposed contract.
Assistance and requests
For account privacy requests, contact hello@varypilot.com. For data collected on a customer’s website, contact that customer first as controller. We assist with requests relating to the processing performed for that customer. Security and DPA enquiries can be sent to the same address without passwords, private keys or sensitive records.
Let’s make it clear.
For a privacy request, billing question or a specific agreement, write to our team.