Variafy / Legal

Privacy policy

Variafy is a service through which an AI assistant manages ad accounts on behalf of their owner.

Who processes the data

FOP Volynskyi Illia Oleksandrovych (ФОП Волинський Ілля Олександрович), Kyivska St. 76, apt. 5, Zhytomyr, Zhytomyr Oblast, 10012, Ukraine. Unified State Register of Ukraine (EDR) record No. 2010350000000479431 of 09.01.2024. Questions and requests: support@variafy.com.

The Variafy app on Meta's platform is registered with Meta by its developer, Denys Volynskyi, Poland, who builds and runs the service for the publisher above under a data processing agreement. The developer processes the data only on the publisher's instructions and only for the purposes in this policy. Requests about your data go to the address above.

In what role we act

The role differs by category of data, and merging them into one label would be untrue.

Customer and billing data: Controller. Email address, company name, plan and subscription status are data about our counterparty under our own contract. We determine the purpose and the retention period.
The customer's staff: Processor on the customer's instructions. Who is invited to the console, what role they get and when they are removed is decided by the customer, not by us. We store an email address, a name and a role because the customer asked us to.
Audit log and usage: Controller. Records of sign-ins, approvals and service usage are processed for our own purposes: to establish who authorized spending on an ad account, to issue invoices, and to protect the service. This is declared in advance and is outside the customer's instructions.
Ad account data: Toward the customer — processor: we act only on their instructions and for their purposes, and data belonging to different customers is stored separately. Toward Meta — an independent controller, as Meta's platform terms require; with Meta, this responsibility is carried by the app's developer, Denys Volynskyi, Poland.

What we store

About the customer: email address, company name, plan, billing status, Stripe identifiers. We never see or store card numbers — payment happens entirely on Stripe's side.
About the customer's staff: email address, name, role, last sign-in time. There is no password: sign-in uses a single-use link and an email code.
About activity: who signed in and when, which change they approved or rejected, on which ad account and for what amount. The IP address the request came from.
About connected ad accounts: ad account ID and name, currency, time zone, granted permissions, ad account health. The access token is stored encrypted.
About proposed changes: what was to be done, with which figures, who approved it and what the outcome was.
About a connected CRM (Pipedrive, HubSpot, Salesforce, Zoho CRM, Kommo, Bitrix24, HighLevel, Close, Freshsales or ActiveCampaign): its address or account id and the access to it — an API key, token or webhook, or the read-only access of the Variafy app — stored encrypted and used only to read. From its deals: the deal id, pipeline, stage, dates, value, currency, the ad tags and the ad click id. For paid deals, if the customer turns it on, a one-way hash (sha256) of the contact's e-mail, used only to send payments back to Meta; if the customer also sends lead stages to Meta, the same hash for deals created or qualified in the last week. Names, e-mails and phone numbers of the customer's own customers are not stored.
About a connected Google Sheet: the link to its export, stored encrypted and used only to read the sheet every few hours. From its rows — as from an uploaded file — only the columns we recognise: the payment or deal id, dates, amount, currency, stage and the ad tags; an e-mail column becomes a one-way hash. Other columns are not stored.
About Slack, if you connect it: the incoming webhook address you paste, stored encrypted and used only to post your daily advice to the channel you chose. Disconnect it in the console, and it is deleted.
About Telegram, if you connect it: the id of your chat with our bot and your Telegram username, to send you the daily advice there and to record the marks you tap. Disconnect it in the console or send /stop to the bot, and both are deleted.
If you join the waitlist: your email address, what you wrote about what you advertise, the assistant you chose and where you came from (for example, the page or the assistant that sent you). We use them only to decide whom to invite first and to invite you. We send you nothing until then. The IP address of the request is kept for one day against abuse.
About visits to this website: which public pages were opened, the site you came from, the campaign tag in the link, whether it was a phone or a computer, the country (our server looks it up from the IP address in its own copy of the DB-IP country database; the address is not sent anywhere and only the country code is kept), which links and buttons were clicked, how long a page stayed open on the screen and whether the page was touched at all (a tap, a key press or a scroll: a yes or no, nothing about what was typed). There are no cookies and nothing is stored on your device. To count one visitor once a day, we compute a mark from the IP address and the browser with a key that changes every day and is deleted the next day; the IP address and the browser string themselves are not stored. After that day the mark cannot be tied to you or to your visits on other days.

Google user data

If you connect a Google account, Variafy receives data from Google APIs only with the permissions you grant on Google's consent screen, and only for the features you use:

Google Ads: The accounts you choose to connect: their campaigns, ad groups, ads, keywords, targeting, settings, change history and performance figures. We read them to answer your requests through your AI assistant, to set the payments you send in beside the spend of each campaign, and to run the watchdog and the monitors you set up. Variafy does not create, change or delete anything in Google Ads.
Google Analytics: Reports of the GA4 properties you connect — sessions, landing pages, key events and traffic sources — read only, to check whether ad clicks reach your site and convert.
Search Console: Search performance of the sites you connect, read only, to show paid and organic search side by side.
Your Google account's email address: To show which Google account a connection belongs to.

What we keep: the access Google issued (stored encrypted), the Google account's email address, the ids, names, currency and time zone of the accounts you connect, counts of our calls to Google (no queries and no results), and the findings of the watchdog and the monitors with the figures behind each finding. Reports are read from Google when they are needed; apart from those findings, no copy is kept.

Limited Use. Variafy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features described above. We do not sell it, do not use or transfer it for advertising, including retargeting and personalized ads, and do not use it to develop, improve or train generalized artificial intelligence or machine learning models. No person at Variafy reads it, except with your consent for specific data, when needed for security (for example, to investigate abuse), to comply with the law, or when it is aggregated and anonymized for internal operations.

To disconnect, remove the Google connection in the console: Variafy revokes the access at Google, and from then on it can read nothing. You can also remove Variafy's access at any time at myaccount.google.com/permissions.

TikTok user data

If you connect a TikTok ad account, Variafy receives data from the TikTok API for Business only with the permissions you grant on TikTok's authorization page, and only for the ad accounts you choose:

TikTok ad accounts: The name, currency, time zone and status of each account; its campaigns, ad groups and ads with their settings and statuses; the change log; and performance reports. We read them to answer your requests through your AI assistant, to set the payments you send in beside the spend of each campaign, and to run the watchdog.
Changes: Variafy changes something in TikTok only when you ask for it in the conversation and confirm it. A larger budget always needs the approval of a signed-in person.

What we keep: the access TikTok issued (stored encrypted; TikTok's access does not expire on its own), the ids, names, currency and time zone of the accounts you connect, the permissions granted, and the findings of the watchdog with the figures behind each finding. Reports are read from TikTok when they are needed; apart from those findings, no copy is kept.

Who receives it: you and the people you invite to your console; the vendor of your AI assistant, which receives the answers to the requests you make in the conversation; and Resend, for the emails you turn on. Nobody else. We use TikTok data only to provide the features described above, in line with the TikTok For Business Developer Terms. We do not sell it and do not use or share it for anyone else's advertising.

To disconnect, remove the TikTok connection in the console: Variafy revokes the access at TikTok, and from then on it can read nothing. You can also remove the app's access in TikTok Ads Manager or Business Center.

Microsoft Advertising user data

If you connect a Microsoft Advertising account, Variafy signs you in the way you sign in to Microsoft Advertising — with your Microsoft account, or with your Google account if your Microsoft Advertising account uses Google sign-in — and receives data from the Microsoft Advertising API only with the permission you grant, and only for the ad accounts you choose:

Your Microsoft or Google sign-in: Your name and email address, to show in the console who granted the access. With Google sign-in we ask Google only for your basic profile and email address, and use them only to sign you in to Microsoft Advertising; this gives no access to your Google Ads or any other Google data.
Microsoft Advertising accounts: The name, number, currency, time zone and status of each account and the manager account it is reached through; its campaigns with their settings, budgets and statuses; and performance reports. We read them to answer your requests through your AI assistant.
Changes: Variafy does not change anything in Microsoft Advertising.

What we keep: the access Microsoft or Google issued (a refresh token, stored encrypted), the ids, names, currency and time zone of the accounts you connect, and the permission granted. Reports are read from Microsoft when they are needed; no copy is kept.

Who receives it: you and the people you invite to your console, and the vendor of your AI assistant, which receives the answers to the requests you make in the conversation. Nobody else. We use Microsoft Advertising data only to provide the features described above. We do not sell it and do not use or share it for anyone else's advertising.

To disconnect, remove the Microsoft Advertising connection in the console: Variafy deletes the access it holds, and from then on it can read nothing; access granted with Google sign-in is also revoked at Google. Microsoft does not let an app withdraw your consent itself, so to remove Variafy on Microsoft's side too, go to account.live.com/consent/Manage (personal Microsoft account) or myapps.microsoft.com (work or school account).

LinkedIn user data

If you connect a LinkedIn ad account, Variafy signs you in with LinkedIn and receives data from the LinkedIn Marketing API only with the permissions you grant on LinkedIn's consent page, and only for the ad accounts you choose:

Your LinkedIn sign-in: Your name and LinkedIn member id, to show in the console who granted the access.
LinkedIn ad accounts: The name, currency, status and your role in each account; its campaigns with their settings, budgets and statuses; and performance reports. We read them to answer your requests through your AI assistant, to prepare the briefs you turn on and to run the watchdog.
Changes: Variafy does not change anything in LinkedIn.

What we keep: the access LinkedIn issued (stored encrypted), the ids, names and currency of the accounts you connect, the permissions granted, and the findings of the watchdog with the figures behind each finding. Reports are read from LinkedIn when they are needed; apart from those findings, no copy is kept, and the findings are deleted within 10 days after you disconnect the account.

Who receives it: you and the people you invite to your console; the vendor of your AI assistant, which receives the answers to the requests you make in the conversation; and Resend, for the emails you turn on. Nobody else. We use LinkedIn data only to provide the features described above. We do not sell it and do not use or share it for anyone else's advertising.

To disconnect, remove the LinkedIn connection in the console: Variafy deletes the access it holds, and from then on it can read nothing. LinkedIn does not let an app withdraw your consent itself, so to remove Variafy on LinkedIn's side too, open LinkedIn Settings → Data privacy → Permitted services.

How we protect your data

The most sensitive data we hold is the access that Meta, Google, TikTok, Microsoft and LinkedIn issue for your accounts, because whoever holds it can read those accounts. We protect it, and the rest of your data, as follows:

Encryption of access tokens. Every access and refresh token is encrypted before it is written to the database, with AES-256-GCM and a separate random nonce for each record. Each encrypted record is bound to its customer and platform, so a record copied into another customer's row cannot be decrypted. The encryption key is kept in the server's environment, never in the database, so a copy of the database alone gives no access to any ad account.
Hashing instead of storing. The keys your AI assistant uses to connect, console sessions and one-time connect links are stored only as one-way hashes; we cannot read them back.
Encryption in transit. Our pages and the assistant connection work only over HTTPS (TLS), and browsers are told to refuse unencrypted connections (HSTS). Calls to Meta, Google, TikTok, Microsoft and LinkedIn are made over HTTPS.
Access control. Each customer sees only their own accounts and data. Inside a customer, the console has roles, and changes to ad accounts go through an approval step you control. Console sessions expire after 24 hours of inactivity and after 7 days in any case. Access to the production server and database is limited to the people who operate Variafy.
Least data. We ask platforms only for the permissions the features need, read reports when they are needed instead of keeping copies, and delete data on the schedule in “How long we keep it”. Access tokens are never shown in the console or written to the request journal.
Revocation. When you disconnect an account, the access we hold for it is deleted, and where the platform allows it we also withdraw it on the platform's side.
Incidents. If we learn of a breach that affects your data, we will tell you without undue delay and notify the data protection authority where the law requires it.

Legal bases

Performance of a contract — everything the service cannot work without: connecting an ad account, executing changes, billing.
Legitimate interest — the audit log and service usage records. The interest is specific: the service is used to authorize ad spend, and it must remain possible to establish who did so. Also the website statistics: knowing which pages people read and where they come from, without cookies and without identifying anyone.
Steps at your request before a contract — the waitlist: you ask to be invited, and we keep what is needed to do that.
Legal obligation — accounting and tax records.

How long we keep it

1 month: revoked app connections (ChatGPT, Claude): kept while questions about recent access are resolved; the fact of connecting and revoking stays in the console audit log — live connections are kept until revoked or until they lapse after 60 idle days
3 years: sign-ins and approvals: evidence of who authorized spending on an ad account, should the question come up later — the period follows the limitation period for claims between businesses
2 years: payments and leads that a customer sends in to measure their advertising: kept while comparing this year with the last one still makes sense — no contacts of their customers are stored: a one-way hash at most, and anything that looks personal is dropped at the door
3 years: service usage records: the basis for billing and for resolving disputes about it
1 month: proposed changes: the preview and its arguments, while they can still be disputed — the fact of the approval outlives this cleanup: it is kept in the audit log as a self-contained entry, not as a pointer to this table
6 months: Stripe payment events: protection against processing the same event twice
1 month: sign-up requests: the email address, name and IP address are kept while they back the anti-abuse counter and while a disputed sign-up can be examined — an unaccepted request creates neither an account nor obligations: it expires in twenty minutes and is deleted outright
1 year: waitlist: the email address and the answers about what you advertise and which assistant you use, kept to invite you when access opens — deleted earlier on request; the IP address of the request is erased after one day
6 months: website statistics without cookies: a per-day anonymous visitor mark, the page or step, the referring site, the device type, clicks on links and buttons and how long a page stayed open — the daily key that makes the mark is deleted the next day, so marks cannot be tied to a person or across days
3 years: data deletion requests: proof that the request was carried out — no personal identifier is kept here, only a hash
1 day: Counts of calls to Meta, needed only to stay under Meta's 5-minute and hourly limits.
1 month: The last known Meta limit state of an ad account.
6 months: Which ad account a Meta object id belongs to, kept to avoid repeating the ownership check.
1 month: Counts of calls to the Google Ads API, needed to stay under the Google Cloud project's daily quota and to measure Google's limits. — no queries and no results: only counts, status, error code and the Google request id
1 day: Google Ads accounts found while a person chooses which of them to connect.
1 month: Lists of image identifiers checked before an upload, kept while a proposal that uses them can still be approved — only identifiers of images inside the ad account library, no files and no personal data
1 month: When the queue email was last sent to an account, kept only to space out those emails — one row per account: a timestamp, no addresses and no message contents
1 day: Counts of competitor research calls, needed only to keep the shared Ad Library access under its hourly limit. — only the account and the time of the call: no domains, no results
3 months: Problems the watchdog and monitors found in an ad account, kept after they stop so that a problem that comes back is recognised as returning — a problem that is still present is kept for as long as it lasts
6 months: Monitors that were deleted, kept so that the question of why their emails stopped has an answer — monitors that are not deleted, including paused ones, are kept until they are deleted
6 months: Scheduled briefs that were deleted, with their schedule and the address they went to, kept so that the question of why they stopped has an answer — briefs that are not deleted, including paused ones, are kept until they are deleted
3 months: Records of failures in the background work of the service and of server errors, kept to find and fix problems that come back — they hold the error text and a short reference such as an ad account connection or a page address, not the content of requests
1 month: unfinished campaigns: the answers a person gave while building one — the texts of the ad, the link, the audience and the budget — kept so that a build interrupted today can be continued tomorrow — a draft creates nothing in the ad account; it is deleted outright once a campaign is built from it and confirmed
3 months: Records of alerts about such failures sent to the service operator, kept to space alerts out
6 months: Daily advice about an ad account — what was suggested, the numbers behind it and the mark your team gave it — kept to check afterwards whether the advice was right
6 months: Records of the morning advice emails — who got one, for which day and which advice it held — kept so that the same advice is not emailed every day
6 months: Records of the daily advice sent to Telegram — to whom, for which day and which advice — kept so that the same advice is not sent every day
6 months: Records of the daily advice sent to Slack — to whom, for which day and which advice — kept so that the same advice is not sent every day
6 months: Weekly read-only checks of an ad account — what was found and what was fine — kept to show the latest check and how the ad account changed from one check to the next
1 day: One-time codes for connecting a Telegram chat, which expire after 15 minutes

These periods are not a verbal promise: automated cleanup runs against exactly this list, and they cannot be changed without changing it.

Requests from public authorities

If a public authority asks us for personal data, we:

check that the request is lawful and that the authority is entitled to make it;
challenge a request we consider unlawful;
disclose only the minimum data needed to answer a lawful request;
keep a record of each request and of our response.

Transfers outside the European Economic Area

Variafy is published by an individual entrepreneur registered in Ukraine, and its server and database are in the United States, so your data is processed outside the European Economic Area. We do not conceal where it goes:

Poland — the developer of the Variafy app on Meta's platform is established there, inside the European Economic Area.
Ukraine — the publisher is established there. There is no European Commission adequacy decision for Ukraine (verified against the Commission's list).
United States — the server and the database (Railway), email delivery (Resend), Meta, Stripe and, if you connect it, Google. Meta, Stripe and Google participate in a framework recognized by the European Commission as providing an adequate level of protection.
Slack — only if you connect it: your daily advice goes to Slack's servers, which may be outside the European Economic Area. Slack's own policy describes where it stores messages.
Telegram — only if you connect it: your daily advice goes to Telegram's servers, which may be outside the European Economic Area. Telegram's own policy describes where it stores messages.

If your company needs a data processing agreement with the European Commission's standard contractual clauses for these transfers, write to support@variafy.com.

Your rights

You may ask what we hold about you, correct inaccuracies, request erasure, restrict processing, receive your data in a portable form, and object to processing based on legitimate interest. Write to support@variafy.com and we will respond.

If you are a member of a customer's staff rather than the customer: for most of this data we act on their instructions, so contacting them will be faster. We will still accept your request and pass it on to them.

You have the right to lodge a complaint with a data protection authority.

Deletion

How to delete data obtained through Facebook is described separately: https://www.variafy.com/data-deletion.

Access to Google ends when you disconnect the Google account in the console or remove Variafy at myaccount.google.com/permissions. To have the rest of your data deleted, write to support@variafy.com.

Changes

If this policy changes materially, we will tell customers before the change takes effect.