Privacy Policy

Who we are

Varman is a compliance automation service operated by CloudDrove Inc., an Ontario, Canada company ("Varman", "we", "us"). This policy explains what personal data we handle, why, and the choices you have. It covers this website (varman.io) and the Varman product (app.varman.io, portal.varman.io and api.varman.io).

Our role

When a company uses Varman to run its compliance program, that company decides what data is connected and why. For that data the customer is the controller and we act as its processor, following its instructions and our agreement with it. If your employer uses Varman and you have a question about your data, your employer is the right first contact.

For account, billing and website data, we are the controller.

Data we collect

Account data: name, work email, organization, role, and a password hash or sign-in token when you create an account or are invited to one.

Customer data: what a customer connects or uploads to run its program. This includes policies, evidence files, risk and vendor records, questionnaire answers, and data read from connected systems such as cloud accounts, identity providers and code hosts. It can include personal data about the customer's staff, for example names, work emails, account status, training and policy acknowledgements, and device security posture reported by the device agent.

Integration credentials: tokens and keys a customer provides so we can read from its systems. These are encrypted at rest.

Usage and log data: IP address, browser type, pages and actions in the product, timestamps, and audit log entries.

Messages: anything you send us by email.

This website does not set advertising or analytics cookies. Our hosting provider keeps standard server logs, and fonts are loaded from Google Fonts, which receives your IP address when the page loads. The product sets cookies that are needed to keep you signed in.

How we use data

To provide the service: collect evidence, evaluate controls, show results, send notifications, and support audits.

To secure the service: authenticate users, prevent abuse, investigate incidents, and keep audit trails.

To communicate with you about your account, changes to the service, and requests you make.

To meet legal obligations.

We do not sell personal data and we do not use customer data to train AI models.

AI features

Some features use large language models, for example drafting policies or summarizing evidence. When a customer uses these features, the relevant content is sent to our AI providers for processing and the result is returned to the product. Customers can choose not to use these features.

Legal bases

Where the GDPR or similar law applies, we rely on performance of a contract (providing the service), legitimate interests (securing and improving the service), consent where we ask for it, and legal obligation.

Who we share data with

Service providers that process data for us under contract: Cloudflare (network, DNS and email routing), Netlify (hosting for this website), and OpenAI and OpenRouter (AI features). We will update this list when it changes.

Auditors and other parties a customer chooses to share its workspace or Trust Center with.

Authorities, when the law requires it. A successor, if the business is reorganized or sold, under terms that protect the data.

International transfers

Our providers may process data in countries other than yours. Where required, we use recognized transfer safeguards such as standard contractual clauses.

Retention

We keep customer data for as long as the customer's account is active. After an account is closed we delete or return customer data within a reasonable period, except where the law requires us to keep it. Backups expire on a rolling schedule. Logs are kept for as long as needed for security and audit purposes.

Security

We use encryption in transit, encryption of credentials at rest, access controls, audit logging and regular backups. No system is perfectly secure. If we learn of a breach affecting your data we will notify the affected customer without undue delay.

Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to certain processing, and to complain to a data protection authority, which in Canada is the Office of the Privacy Commissioner. To make a request, email privacy@varman.io. If your data was added by an organization that uses Varman, we will pass your request to that organization.

Children

Varman is a business service and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

We may update this policy. We will change the date above and, for material changes, notify account owners.

Contact

Questions or requests: privacy@varman.io.