Legal
Privacy Policy
Last updated: June 22, 2026
This Privacy Policy explains how Variafy ("Variafy", "we", "us") collects, uses, shares and protects personal data, and the rights you have. It applies to our website at www.variafy.com and the hosted trial cabinet at app.variafy.com (together, the "Service").
The self-hosted version you run on your own machine and API keys is covered separately — see Self-hosted use below.
1. Who we are (data controller)
The controller responsible for your personal data is Denys Volynskyi, operating Variafy as a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland.
- Address: Stanisława Klimeckiego 8/43, 30-705 Kraków, Poland
- NIP (tax ID): 6793334413
- Privacy contact: privacy@variafy.com
2. The data we collect
Information you give us
- Account & sign-in. When you sign in to the cabinet (via Google or an email magic link) we receive your email address and, with Google, your name and profile identifier.
- Content you submit. The source ad image, your offer/brand text and prompts you provide for a generation. We use these to produce your creatives; we do not use them to train AI models.
- Purchases. If you buy a license, our payment processor (Stripe) handles your card details; we receive your email, a customer/charge identifier and payment status. We do not see or store full card numbers.
- Optional integration tokens. If you connect Meta or Google Drive to push finished creatives, those access tokens are stored only in your own browser (local storage) — not on our servers.
- Messages. Anything you email to us.
Information collected automatically
- Usage / metering. The number of trial renders you have used, to enforce the free-trial limit.
- Technical data. Standard server logs (IP address, browser user-agent, timestamps) needed to operate and secure the Service.
- Marketing attribution. If you arrive via a campaign link, the referral source and UTM tags, where present.
We do not run advertising pixels, Google Analytics, or any third-party behavioural tracking on the Service. See the Cookie Policy for the few essential cookies we use.
3. How we use your data, and our legal bases
Under the GDPR we rely on the following legal bases:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the trial, generate creatives, meter usage | Performance of a contract (Art. 6(1)(b)) |
| Process your license purchase and issue your key | Contract (Art. 6(1)(b)) and legal obligation for billing records (Art. 6(1)(c)) |
| Keep the Service secure, prevent abuse, debug | Legitimate interests (Art. 6(1)(f)) |
| Send transactional email (e.g. your license key, magic link) | Contract (Art. 6(1)(b)) |
| Send occasional product-update emails, if you opt in | Consent (Art. 6(1)(a)) — withdraw any time |
4. Cookies
We use only strictly-necessary cookies (your sign-in session and a security token). We do not set advertising or analytics cookies. Full detail and your choices are in the Cookie Policy.
5. Who we share data with
We do not sell your personal data. We share it only with the service providers ("subprocessors") that help us run the Service — for example hosting, database/auth, payments, email and the AI providers that generate your creatives. Each is bound by a data-processing agreement. The current list is on the Subprocessors page; in summary:
- Supabase — Authentication and database (accounts, trial metering, purchase records).
- Stripe — Payment processing for the one-time license purchase.
- Resend — Transactional email delivery (license key, account email).
- Railway — Application hosting and infrastructure for the site and cabinet.
- Anthropic — AI text model (Claude) used to read ad structure and draft variations.
- OpenAI — AI image model (gpt-image) used to render creatives.
- Google — Optional: "Sign in with Google" and pushing finished creatives to your own Google Drive.
- Meta — Optional, only when you push creatives to your own Meta ad account's image library.
We may also disclose data where required by law, or to establish, exercise or defend legal claims.
6. International transfers
Some of our providers are located in the United States. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards — primarily the European Commission's Standard Contractual Clauses — to protect it. You can request a copy of the relevant safeguards by emailing privacy@variafy.com.
7. How long we keep it
- Account & trial data — for as long as your account exists; deleted promptly when you delete your account.
- Generated creatives & uploaded source images — processed transiently to produce your output and not retained long-term on the hosted Service.
- Purchase & billing records — retained for the period required by Polish tax and accounting law (generally up to 5 years), then deleted.
- Marketing leads — until you unsubscribe or ask us to delete them.
8. Your rights (GDPR / EEA / UK)
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time (without affecting prior processing).
Self-service: when signed in to the cabinet you can export your data or delete your account and data from the "Your data" link in the footer. You can also exercise any right by emailing privacy@variafy.com; we respond within one month.
If you believe we have mishandled your data, you may lodge a complaint with your local supervisory authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO).
9. US privacy rights (California & other states)
If you are a US resident, you may have the right to know what personal information we collect, to access and delete it, to correct it, and to not be discriminated against for exercising these rights. We collect the categories of information described in Section 2 (identifiers, commercial information, internet activity, and content you submit) for the business purposes in Section 3.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising (as those terms are defined under the CCPA/CPRA). To exercise your rights, use the self-service tools in the cabinet or email privacy@variafy.com. You may use an authorised agent; we will verify the request via your account email.
10. Security
Data is encrypted in transit (HTTPS). Access to production data is limited. Optional integration tokens (Meta, Google Drive) stay in your browser and are never transmitted to or stored on our servers. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.
11. Children
The Service is a business tool not directed to children and is not intended for anyone under 16. We do not knowingly collect data from children.
12. Self-hosted use
When you run the paid, self-hosted version on your own machine and API keys, your ad images, prompts and outputs stay on your infrastructure and go directly to the AI providers under your keys — we do not receive them. The self-hosted app sends only anonymous, aggregate usage telemetry (install and render counts — no content, no keys, no email), which you can turn off. Details: PRIVACY.md.
13. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice in the Service.
14. Contact
Questions or requests: privacy@variafy.com.