Privacy Policy

1. Who this policy covers

VAREVO is business software: an organization that signs up (“you”) enters data about its own contacts, employees, and customers into the Service. This policy describes how [Company legal name] processes that data as the Service operator. If your organization uses VAREVO to manage its own customers' data, your organization is responsible for its own obligations to those customers under applicable law (e.g. having a lawful basis to store their contact details) — this policy covers our role as the platform, not your organization's.

2. What we collect

Account and organization data: your name, email, and role, and your organization's name.

Data you enter to use the Service: contacts, companies, jobs, quotes, invoices, payments, products, tasks, activities, and any automation rules you configure.

Usage data: standard web server/application logs (timestamps, routes accessed, error events).

3. Where it's hosted

The database (Supabase, PostgreSQL) is hosted in Zurich, Switzerland. The application itself (Vercel) runs in the United States. This means data is processed in both Switzerland and the US in the course of operating the Service — relevant if your organization needs to represent this to its own customers under Swiss FADP or EU GDPR.

4. Sub-processors

The following third parties may process data on our behalf:

• Supabase — database, authentication, and file storage (invoice/quote PDFs).
• Vercel — application hosting.
• Your organization's own SMTP provider — outbound email (quotes, invoices, reminders) is sent through the mailbox account your organization configures in Settings, not a shared platform mailbox; that provider processes the content of those emails.
• Stripe — only once your organization subscribes to a paid plan (not available yet); processes billing and payment information.
• bexio — only if your organization explicitly connects a bexio account in Settings; processes the specific contact/invoice records you choose to export.
• An AI provider (Anthropic or OpenAI) — only once a platform operator configures AI credentials (not active by default). When active it powers four optional features, and what is sent differs by feature: the dashboard summary receives only figures the page has already calculated; the quote assistant receives the job description you type and your product names; the read-only assistant receives a snapshot of your own records relevant to the question — which includes quotes, invoices and payments when the person asking is allowed to see them; and registering a vehicle from a photograph sends that photograph for one reading. A photograph is not stored by us and is not kept by us after the reading, and the holder's name and address on such a document are never read out of it or saved. Nothing is sent to an AI provider through any other path, and no feature sends anything unless someone uses it. Your organization's owner can switch the assistant off entirely in Settings: with it off, no request leaves your organization for an AI provider at all, the AI features stop appearing, and everything else in VAREVO keeps working.
• Sentry — only once a platform operator configures error monitoring (not active by default); receives error events (which may include limited request context) to help us fix bugs.

5. How long we keep data

Deleting a record (a contact, company, job, quote, invoice, or an entire organization) moves it to Trash for 30 days, during which an OWNER or ADMIN can restore it; after 30 days it is permanently deleted and cannot be recovered. We do not currently offer a separate retention or export policy for data that hasn't been deleted — if your organization needs a defined retention schedule for active data, this is not yet built; contact us to discuss.

6. Security

Every organization's data is isolated at the database level (row-level security keyed to organization membership) so one organization cannot query another's data even in the event of an application bug. Traffic to the Service is encrypted in transit. Passwords are handled entirely by Supabase Auth; we never see or store your password in plain text.

7. Cookies

We use a session cookie (Supabase Auth) to keep you signed in, and a cookie to remember your preferred language. Neither is used for advertising or cross-site tracking.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. Account and organization data can be exported or deleted directly from the Service (Settings); for anything else, contact [contact email].

9. Changes to this policy

We may update this policy from time to time; material changes will be reflected by an updated “last updated” date above.

10. Contact

Questions about this policy, or a data access/deletion request: [contact email].