Privacy policy
Last updated: 17 October 2026
1. Who we are
Ojehs, Inc., a Delaware corporation, operates Varis ("Varis", "we", "us"). We are the controller of the personal data this policy describes.
This policy covers personal data we collect when you visit our website, use the dashboard, sign in to the CLI, connect an agent, top up, or publish a service. It doesn't cover what a provider does with data its service receives. Section 4 explains that boundary.
We don't sell your personal data, and we don't use it for advertising.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, password (stored as a hash), owner name | You |
| Signed-in computers | Device name, sign-in time, last use, IP address | The CLI |
| Agents | Agent names, spend limits, the AI assistant you connected, credential prefixes (never the full secret) | You, the AI assistant |
| Services you publish | Name, description, instructions, schemas, endpoint, price, and the user who published it | You, the CLI |
| Invocations | Request ID, agent, service, timings, outcome, failure reason, credits charged | Our gateway |
| Payments | Top-up amounts, card brand and last four digits, payment status | Stripe |
| Payouts | Payout status, country, connected account ID | Stripe |
| Support | Messages you send us | You |
| Technical | IP address, browser, error reports, request logs | Your browser, the CLI, our servers |
Stripe collects full card details and the identity and bank details needed for payouts. We never receive or store full card numbers or bank account numbers.
We don't store the inputs or outputs of invocations, apart from what we need to validate them during the call.
3. How we use it
We use personal data only to run Varis, keep it secure, and meet our legal duties. If you are in the UK or the European Economic Area, the table shows the legal basis for each use.
| Purpose | Legal basis |
|---|---|
| Create and run your account, agents, and services | Contract |
| Route invocations, enforce spend limits, and settle payments | Contract |
| Take top-ups and pay provider earnings | Contract |
| Send service emails, such as receipts, security alerts, and credit expiry notices | Contract |
| Rank services in discovery by objective metrics | Legitimate interests: useful discovery for buyers |
| Detect and prevent fraud, abuse, and security incidents | Legitimate interests: protecting users and Varis |
| Fix errors and improve the Platform | Legitimate interests: a working product |
| Keep financial records and respond to lawful requests | Legal obligation |
| Send product news | Consent, which you can withdraw at any time |
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Data in invocations
When your agent invokes a service, we pass the agent's inputs to the provider that runs it. Providers are independent businesses, not our service providers. Each provider is responsible for the data its service receives under its own privacy terms.
- If you buy: don't send personal data to a service unless you have a lawful
basis to share it. Inputs to a service that uses
GETappear in the provider's server logs. - If you provide: requests from Varis contain the agent's inputs but no information identifying the buyer. You are the controller of any personal data your service receives.
5. Who we share it with
We share personal data only with the service providers below, which process it on our instructions, and in the cases listed after the table.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Hosting the website, dashboard, and API | United States |
| Supabase | Database and dashboard sign-in | Ireland, EU |
| Stripe | Top-ups, payout onboarding, transfers, and payouts | United States |
| Sentry | Error monitoring | United States |
| Resend | Sending account and receipt emails | United States |
| Our support and business email | United States |
We also share personal data:
- With other users of your owner, who can see its agents, services, transactions, and who published each service.
- With providers, limited to the inputs your agents send them.
- With buyers, limited to your service's public listing. We don't show buyers the name of the user who published it.
- When the law requires it, or to protect the rights, safety, or property of Varis, our users, or others.
- In a business transfer, such as a merger, acquisition, or a move of Varis to a new company. This policy keeps applying to your data.
Stripe also processes your data as an independent controller under its own privacy policy.
6. Transfers, retention, and security
6.1 International transfers. We are based in the United States, and our providers store data in the locations listed in Section 5. When we transfer personal data out of the UK or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, the UK addendum to them, or an adequacy decision such as the EU-US Data Privacy Framework where the recipient participates in it.
6.2 Retention. We keep personal data only as long as we need it. The ledger is append-only. When you close your account, we delete or anonymise your personal details, but the financial records the law requires us to keep stay for their full retention period.
6.3 Security. We encrypt data in transit and at rest. We store passwords, device tokens, and agent credentials only as hashes, and show you a credential's full value only once. Database access is restricted by row-level security, and access to production systems requires multi-factor authentication. If a breach affects your personal data, we tell you without undue delay.
7. Your rights
Wherever you live, you can ask us to:
- Tell you what personal data we hold about you and give you a copy.
- Correct data that is wrong or incomplete.
- Delete your data, subject to the records we must keep under Section 6.2.
- Send your data to you or another company in a machine-readable format.
- Stop or restrict using your data, or object to uses based on legitimate interests.
- Stop sending you product news.
Email security@usevaris.com from your account's email address. We reply within 30 days, and may ask you to confirm your identity first. We don't charge for requests, and we won't treat you differently for making one.
If you are in the UK or the European Economic Area, you can also complain to your local data protection authority. If you are in a US state with a privacy law, such as California, you have the rights that law gives you, and you can use an authorised agent to make a request.
8. Cookies, children, changes, and contact
8.1 Cookies. We use only the cookies needed to keep you signed in to the dashboard and to protect it from abuse. We don't use advertising or third-party tracking cookies.
8.2 Children. Varis is for people aged 18 and over. We don't knowingly collect data from children. If you believe a child has given us personal data, email security@usevaris.com and we will delete it.
8.3 Changes. If we make a material change to this policy, we notify you by email or in the dashboard before it takes effect. The date at the top shows when it last changed.
8.4 Contact. Send privacy questions and requests to security@usevaris.com. Our postal address is Ojehs, Inc., 651 N Broad St, Middletown 19709 DE, USA.