Privacy Policy
Last updated: April 2026 · 2026-10-11
This Privacy Policy explains how Vara Lab ("Vara", "we") collects, uses, stores and shares your personal information. It is drafted with reference to the EU GDPR and California CCPA. Specific rights for EU/UK/California residents are in Section 7.
1. Data Controller
The data controller is the Vara operating team (organized in the United Kingdom, or the then-disclosed operating entity). Data protection contact: privacy@varaos.com privacy@varaos.com.
2. Information We Collect
- Account info: email, username, hashed password; for OAuth, public profile from Google / WeChat (name, avatar, OpenID)
- User content: uploaded PDFs, images, run-log attachments; projects, experiments, parameters, steps, notes you create
- Usage data: page views, feature usage, API call counts (for billing and abuse prevention)
- Technical data: IP address, browser User-Agent, device type, timezone (for security and troubleshooting)
- Payment data: handled by our Merchant of Record (Creem.io). We do not store full card numbers, only subscription status, transaction IDs and last 4 digits
- AI assistant connections: if you authorize an AI assistant such as Claude, ChatGPT or Cursor to connect to your Vara account, we keep a record of that connection (app name, time of authorization, access level and last use), hashes of its tokens, and, for each tool call, the tool name, whether it succeeded and how long it took. We do not store the parameters or results of tool calls, and we do not receive your conversations with the AI assistant, only the individual operations it sends to complete your request
3. Purposes & Legal Bases (GDPR Art. 6)
| Purpose | Legal Basis |
|---|---|
| Providing the Service (login, storage, AI parsing) | Contract (Art. 6(1)(b)) |
| Account emails, security alerts | Contract + legitimate interest |
| Abuse prevention, rate limits, audit logs | Legitimate interest (Art. 6(1)(f)) |
| Billing and invoicing | Contract + legal obligation |
| Aggregated / de-identified analytics | Legitimate interest; tracking cookies require consent |
Onboarding emails: in the first 8 days after you sign up, we send at most two emails about getting started. Each one has an unsubscribe link at the bottom, and you can also unsubscribe in one click where your email app supports it. If an experiment you created has no runs logged after 14 days, we may also send a reminder (at most once per experiment and once every 30 days), and you can unsubscribe from that too. Unsubscribing does not affect account, sign-in, password or billing emails.
4. Special Protections for Experiment Data
- Admins cannot view your experiment content — only project names and aggregate stats (unless you voluntarily share content in a support request)
- Strict isolation via database-level userId ownership checks on every query
- Never used for model training by Vara or by the AI providers Vara uses (see the table in Section 5). If you use a connector to give Vara data to a third-party AI assistant you have chosen, such as Claude or ChatGPT, how that assistant uses the data, including for training, is decided by its provider's policies and your settings with that provider. See "Connecting Vara to AI assistants" in Section 5
- Never sold or shared with advertisers or data brokers
5. Sub-processors
Where your data is stored: your account and experiment data are stored in a database in Singapore (Neon PostgreSQL), and the application runs in Vercel's Singapore region.
| Service | Purpose | Data |
|---|---|---|
| Vercel | Hosting + Blob storage | All |
| Neon PostgreSQL | Database | Account + experiment |
| Volcengine Ark (a ByteDance company; servers in Beijing, mainland China) | AI text processing: document parsing, AI chat, paper reproduction, etc. The default model and the optional DeepSeek, Doubao, MiniMax, Kimi and GLM models all run through Ark | Text you submit for AI processing, plus related experiment content attached to an AI chat |
| Xiaomi MiMo (servers in mainland China) | Image and PDF page recognition; backup for text processing when Ark is unavailable; can also be picked directly in chat | Images you upload for recognition, plus the same kinds of text as above |
| Alibaba Cloud (Hong Kong) | A relay server run by Vara that forwards some AI requests to the two AI services above; it only forwards and does not store request content | Same as the two rows above |
| DeepSeek official API (servers in mainland China) | Backup, used only when the primary services are unavailable: when both Volcengine Ark and Xiaomi MiMo fail, it takes over some shorter text requests | The text of that request, same scope as the Volcengine Ark row |
| Crossref, Unpaywall, Semantic Scholar, protocols.io | Public scholarly databases: look up paper metadata and open-access full text by DOI, literature search by the AI assistant, search of public protocols.io protocols | DOIs and search keywords (including queries the AI assistant generates when searching literature for you); requests do not include your account data |
| Upstash (Redis) | Caches protocols.io public-protocol search results and translations to avoid repeated requests | Search keywords and public protocol content; no account data |
| Apple (APNs push service) | Only if you use the iOS / macOS app with notifications on: delivers push notifications (e.g. parsing-complete alerts) to your device | Device push token, notification title and body (a parsing-complete body may be the name of a file you uploaded) |
| Google, WeChat (social sign-in) | Only if you choose to sign in with Google or WeChat: identity verification | Public profile you authorize (name, avatar, OpenID) |
| Google Analytics (Google) | Website analytics (requires consent in the UK, EU and similar regions, see Section 8) | Page visits, referrers, browser and device info |
| Resend | Transactional and onboarding email | Email address |
| Creem.io | Payment & subscription (MoR) | Billing info |
What the AI services receive: only content you choose to have processed by AI, namely document text to be parsed, images to be recognized, your questions in AI chat, and related experiment content attached to answer them. We do not send your email, password, payment details or other account data. The servers of Volcengine Ark and Xiaomi MiMo are located in mainland China, so when you use AI features that content is transferred to and processed in mainland China. Backup services are used only when the primary services are unavailable: text may then be handled by the DeepSeek official API (mainland China). Image recognition is handled only by Xiaomi MiMo, with no backup service.
Bring your own key (BYOK): if you configure and select your own model key in Settings, the main text features such as AI chat and document parsing are sent directly to the provider you chose (such as OpenAI, Anthropic, Google Gemini, xAI, DeepSeek, MiniMax, Moonshot, Zhipu, Alibaba Cloud Model Studio, Volcengine Ark, OpenRouter, SiliconFlow, or an OpenAI-compatible address you entered) and bypass Volcengine Ark and Xiaomi. Image recognition does not support BYOK and is still handled by Xiaomi MiMo (with no backup service); a few features not yet wired to BYOK are also still handled as in the table above.
Sub-processors are bound by data processing agreements. For cross-border transfers (e.g. EU user data to the US), we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards. Institutional customers may request a DPA.
Connecting Vara to AI assistants (connectors)
You can authorize AI assistants that support the Model Context Protocol, such as Claude, ChatGPT and Cursor, to connect to your Vara account and read or change your Vara data when you ask them to.
- How you authorize: when you connect, the assistant sends you to a Vara authorization page. After you sign in to Vara, the page shows the name of the app requesting access and its callback address, and you choose "Read only" or "Read and write" before confirming. We never give your Vara password to the assistant. The assistant receives a token that only works with Vara's connector endpoint; it expires after 1 hour and is renewed automatically
- What access covers: a read-only connection can view your experiments, sub-experiments, steps, parameters, run records, plan items, literature library, materials and attachment information. A read and write connection can also create and edit these records, upload and delete attachments, archive references and delete plan items. No connection can delete experiments, sub-experiments or run records, or access your account profile, password, payment details, API keys or bring-your-own-key (BYOK) model keys
- What the AI assistant sees: each time the assistant calls Vara, the result Vara returns (for example experiment names, steps, parameters, run notes and reference details) becomes part of your conversation with that assistant and is processed and stored by its provider (such as Anthropic, OpenAI or Anysphere), usually in the United States. How that provider uses and retains this data, including whether it is used for training, is governed by its privacy policy and your settings with that provider, not by this policy. These providers are not Vara's sub-processors and are not listed in the table above
- AI processing a connector may trigger: when you import an experiment through a connector as plain text rather than structured data, Vara parses the text with the AI services listed above (Volcengine Ark and Xiaomi MiMo, servers in mainland China). When you add a reference from a PDF through a connector, the text at the start of the PDF is sent to Xiaomi MiMo to read the title, authors and DOI. The scope and location of this processing are the same as when you use these features in the Vara web app
- How to revoke: you can see and revoke connected apps at any time in Vara under Settings > API. Revoking invalidates that connection's tokens immediately, and the assistant can no longer access your Vara data. Content that is already in your conversation with the assistant has to be deleted in that assistant
6. Retention
- While account is active: retained
- After account deletion: experiment data hard-deleted within 30 days; account metadata kept 180 days for fraud dispute then fully deleted
- Billing records: 7 years per tax law
- Server logs: 90 days
- AI assistant connections: access tokens expire after 1 hour; renewal tokens expire after 30 days without use; a revoked connection stops working immediately, and its related records are deleted within a reasonable period. Tool call records (tool name, success, duration) are used only for security and troubleshooting
- AI call context: not persisted; cleared after processing
7. Your Rights
Under GDPR / UK GDPR / CCPA and other applicable laws, you have the right to:
- Access — know what we hold about you
- Rectification — correct inaccurate data
- Erasure ("right to be forgotten")
- Restriction and Objection
- Portability — download a full copy of your data yourself under Settings → Data → Export all my data (a ZIP with JSON, CSV and attachments), or export single experiments as Word / PDF / PPT; for anything missing from the self-serve export, email us to request it
- Withdraw consent (where processing relies on consent)
- Lodge a complaint with your supervisory authority (EU: your national DPA; UK: ICO; California: CPPA)
To exercise these rights, email the data protection contact. We respond within 30 days.
9. Children
The Service is not directed to users under 18. If we learn we have collected data from a minor, we will delete it promptly.
10. Security Measures
- Site-wide HTTPS/TLS
- bcrypt one-way password hashing
- HttpOnly + Secure session cookies
- Private Vercel Blob with server-side auth
- Authentication and ownership checks on every API
- Rate limiting and anomaly alerts
- AI assistant connections use the OAuth 2.1 authorization code flow with mandatory PKCE; only token hashes are stored; renewal tokens are replaced on every use, and reuse of an old renewal token after a short grace period revokes the whole connection
- Regular database backups
11. Breach Notification
If a data breach is likely to pose a high risk to your rights, we will notify the supervisory authority within 72 hours of discovery, and notify you directly when required.
12. Changes to This Policy
Material changes will be announced in-app and reflected in the date at the top.
13. Contact
Privacy questions, rights requests, or DPA signing: support@varaos.com