Privacy Policy

This Privacy Policy explains how Varda LLC, doing business as Varda (“Varda,” “we,” “us,” or “our”), collects, uses, and shares information when you use vardapp.com and the Varda web application (together, the “Service”). It should be read alongside our Terms of Service.

1. Information We Collect

We collect the information described below to provide and improve the Service.

• Account information — your name, email address, business name, and password (stored securely, never in plain text).
• Connected financial data — when you connect an account through Plaid, we receive transaction dates, descriptions, vendors, categories, amounts, account names, account types, and balances. We do not receive your bank login credentials.
• Uploaded files — CSV, Excel, and QuickBooks files you choose to upload.
• Usage data — how you interact with the Service, collected through PostHog, to help us understand what’s working and fix what isn’t.
• Support communications — messages, feedback, and other information you send us directly.
• Payment information — handled by our payment processor; Varda does not store full card numbers.

We do not collect bank login credentials, Social Security numbers, full bank account numbers, or precise GPS location or demographic/protected-class data.

2. How We Use Your Information

• To provide the Service — reviewing your connected transactions, surfacing changes, and highlighting potential fraud, errors, or unusual activity;
• To operate Ask Varda, our optional AI-assisted question-and-answer feature, when you submit a question (see Section 4);
• To communicate with you about your account, respond to support requests, and send service-related emails through Resend;
• To monitor and improve the Service, including diagnosing technical issues through Sentry; and
• To comply with legal obligations and enforce our Terms.

3. How We Share Information

We share information only as needed to run the Service:

• Plaid — to establish and maintain your connection to financial institutions;
• Supabase — for authentication and database infrastructure;
• Vercel — for application hosting;
• PostHog and Sentry — for product analytics and error monitoring, with sensitive-data controls in place;
• Resend — for service-related emails; and
• OpenAI — only when you submit a question through Ask Varda (see Section 4).

We may also disclose information if required by law, to protect the rights and safety of Varda or others, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you as required by law.

4. Ask Varda and AI Transparency

Ask Varda is an optional AI-assisted feature that uses OpenAI to explain information already calculated by Varda. It runs only when you submit a question. Varda’s transaction totals, categories, subscription detection, and alerts are calculated before AI is involved.

To answer a question, Varda may send relevant structured context to OpenAI, including business summaries, vendor names, categories, transaction descriptions, amounts, dates, account display names or types, and alert details. We do not send bank login credentials, Plaid access tokens, or complete account numbers to our AI provider.

OpenAI API data is not used to train OpenAI models by default. OpenAI may retain API content for a limited period for abuse monitoring under its API data controls unless different retention controls apply to our account. Ask Varda’s responses may be incomplete or inaccurate and should not replace professional accounting, tax, legal, or financial advice.

We save Ask Varda conversations and responses in your Varda account so you can return to them. You can delete individual conversations from Ask Varda. AI cannot move money, modify records, or resolve alerts by itself; any supported change requires your confirmation.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

6. Data Security

Data is protected in transit with TLS and encrypted at rest by our infrastructure providers. Row-level access controls help ensure each user can access only their own Varda data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your Choices and Rights

• You can access, update, or delete your account information at any time from within the app.
• You can disconnect a connected financial account at any time.
• You can choose not to use Ask Varda without affecting the rest of the Service, and you can delete saved Ask Varda conversations.
• Depending on where you live, you may have additional rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. To exercise these rights, contact us using the information in Section 10.

8. Children’s Privacy

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from anyone under 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. If we make material changes, we will provide a more prominent notice. Your continued use of the Service after changes take effect means you accept the revised policy.

10. Contact Us

Questions about this Privacy Policy or your data? Contact us at:
Varda LLC
Email: contact@vardapp.com