Privacy Policy

VarShield, Inc. (“VarShield,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, products, and services.

1. Information We Collect

Metadata we analyze (never content)

• OAuth application identifiers and granted scopes
• Connection timestamps and frequency patterns
• API call metadata (endpoint, method, status code)
• Application names, versions, and developer information
• Permission change events

Account information

• Email address (for account creation and communication)
• Name (optional, for personalization)
• Organization name (for enterprise accounts)
• Billing information (processed by our payment provider)

Usage data

• Pages visited, features used, and actions taken
• Device type, browser, and operating system
• IP address (anonymized after 30 days)
• Referral source

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Detect and report AI-related security risks in your environment
• Generate security posture scores and recommendations
• Send service notifications and security alerts
• Communicate product updates and relevant content (with your consent)
• Comply with legal obligations
• Improve our detection algorithms using aggregated, anonymized data

We do not sell your personal information. We do not use your data to train AI models. We do not share individual account data with third parties except as described below.

3. Data Storage & Security

• All data is encrypted at rest (AES-256) and in transit (TLS 1.3)
• OAuth tokens are stored in hardware-backed secret managers
• We support EU, US, and APAC data residency options for enterprise customers
• Access to production systems follows zero-trust principles with no standing access
• We conduct regular security audits and penetration testing
• Metadata is retained for the duration of your subscription plus 30 days, then permanently deleted

4. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate personal data
• Deletion — Request deletion of your personal data
• Portability — Request your data in a structured, machine-readable format
• Objection — Object to processing of your personal data for certain purposes
• Withdrawal — Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

5. Third-Party Services

We use a limited number of third-party services to operate VarShield. These include cloud infrastructure providers, payment processors, and analytics tools. Each third party is bound by data processing agreements and is prohibited from using your data for their own purposes.

6. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

7. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Last updated” date. Your continued use of VarShield after changes are posted constitutes your acceptance of the updated policy.