1. Overview
This Privacy Policy explains how VarYar ("VarYar", "we", "us", or "our") collects, uses, discloses, and safeguards information when you use varyar.com and the products connected to it, including the VarYar Account Manager (accounts.varyar.com), VarYar E-Commerce (ecommerce.varyar.com), and any other application, API, or SDK that links to this policy (together, the "Services").
By using the Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Services.
2. Information We Collect
We collect information in three broad ways:
- Information you provide directly — such as your name, email address, business details, and authentication information when you create an account, verify your identity, or contact us.
- Information collected automatically — such as device and browser information, IP address, pages visited, referring URLs, and interaction events, collected via first-party telemetry (for example, our
@varyar/vy-ecom-telemetrypackage) and standard server logs. - Information from your use of the Services — such as products, categories, inventory records, team/squad membership, and API usage associated with a business account.
We do not collect more than we need to operate the Services, consistent with our engineering philosophy of reducing unnecessary complexity and unnecessary data.
3. Cookies & Similar Technologies
Some parts of the Services, including storefronts built on VarYar E-Commerce, use cookies and similar technologies for essential functionality (such as keeping you signed in) and, where you consent, for analytics. Where required by law, a consent banner is shown before any non-essential cookie is set, and you can withdraw consent at any time through that banner or your browser settings.
4. How We Use Information
- To create and secure your account, including passkey and one-time-code sign-in, session management, and fraud/abuse prevention.
- To operate core features of VarYar E-Commerce and the VarYar Account Manager, such as product, category, and inventory management, team/squad permissions, and the API marketplace.
- To provide analytics, such as usage funnels and retention data, primarily to business account owners about their own storefronts.
- To communicate with you about the Services, including security notices and, where you've agreed, product updates.
- To comply with legal obligations and enforce our Terms & Conditions.
5. How We Share Information
We do not sell personal information. We may share information with:
- Infrastructure providers that host our data and run our services, such as our database and hosting providers, under contractual confidentiality obligations.
- Business account collaborators — for example, information a member or sub-host adds to a shared business account is visible to other members of that account, according to the roles and permissions the account owner configures.
- Authorities, where required to comply with a legal obligation, protect our rights, or protect the safety of any person.
6. Data Security
We use encryption in transit and at rest where applicable, encrypted session handling (including our internal VarYar Choco Chips session-token library), and access controls scoped to the minimum permissions a given role needs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Data Retention
We retain personal information for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. You can request deletion of your account and associated data at any time, as described in Section 9.
8. Your Rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. The VarYar Account Manager includes a self-service data export and permissions history for your account. To exercise any other rights, contact us using the details in Section 11.
9. Account & Data Deletion
You may delete your account from the VarYar Account Manager, or request deletion by emailing us. We will delete or anonymize your personal information within a reasonable period, except where we are required or permitted to retain it (for example, for legal, tax, or security reasons).
10. Children's Privacy
The Services are not directed to children, and we do not knowingly collect personal information from children under the age of digital consent in their jurisdiction. If you believe a child has provided us with personal information, please contact us so we can remove it.
11. Contact Us
If you have questions about this Privacy Policy or how your information is handled, contact us at [email protected].
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice.