Privacy Policy

Who this covers

This policy applies to varconduit.com and the VAR Conduit application. For data you import about your channel (your resellers' people and accounts), you are the data controller and VAR Conduit is your processor — see our Data Processing Addendum.

What we collect

• Account identity — your name and email address are synchronized from our authentication provider (Clerk). Password credential verification is handled by Clerk; VAR Conduit's application database does not receive or store your password.
• Channel data you import — the reseller org trees, people (names, titles, work emails and phone numbers, regions and segments, and any LinkedIn URLs or notes you include), and the accounts and CRM opportunities (including opportunity owner names) you upload or sync, plus the partner deal registrations you sync from your CRM, push through the API, upload, or enter by hand (the partner's name, the partner rep's name and email, the end customer's name and domain, the amount, product and status dates, and any notes). This is your business data; we hold it to provide the service.
• Usage & audit logs — selected session, administrative, and data-change events tied to your workspace. Entries record the acting user and, where available, their IP address and user agent, and are kept according to your workspace's audit-retention setting. Records that prove a deletion or a retention change (a full-wipe record, each retention purge's own record, and each change to the retention window) are kept beyond that window as evidence, without an IP address or user agent once they are older than it.
• Technical data — IP address and basic request metadata, used for security, rate limiting, and reliability.
• Product analytics — page views and performance measurements (Core Web Vitals) on our website and inside the signed-in application, collected through Vercel Web Analytics and Speed Insights and used to understand product usage and keep the service fast.
• Marketing inquiries and subscriptions — the contact details, qualification answers, and message you submit when booking a demo, plus an email address submitted for newsletter updates.

How we use it

We use application and imported channel data to provide and secure the service: to run your workspace, enforce access controls and plan limits, keep an audit trail, measure product usage and performance, and support you. We do not sell your data, and VAR Conduit does not use your imported channel data to train its own models or build cross-customer datasets.

Website visitor analytics

Separately from the application, when you browse our public marketing website (varconduit.com) we record coarse technical data about the visit: your IP address, an approximate location (country, region, and city inferred from that IP), the pages you view, and the site that referred you. We use this for security, basic site analytics, and business development — understanding which organizations are interested in VAR Conduit — and we use a third-party IP-intelligence service (Apollo) to associate an IP with a likely company. That service runs a script on our public marketing pages only, never inside the signed-in application, and it stores a random identifier in your browser so repeat visits from the same browser can be grouped. It is used to identify the likely organization, not you personally: we have left its contact-level visitor identification switched off, and we block the third-party identity script it would otherwise load to resolve individual visitors. Our own copy of this visitor data is separate from the channel data our customers import, is accessible in the application only to VAR Conduit operators, and is scheduled for deletion after 90 days by a daily retention sweep; the copy held by Apollo is governed by Apollo’s own privacy policy. To opt out, turn on Global Privacy Control in your browser: when it is on, we do not add your visits to this visitor log and do not load Apollo’s script. To have our copy of your visit data deleted, email privacy@varconduit.com; for Apollo’s copy, use Apollo’s own privacy request process.

Subprocessors

We rely on these subprocessors to operate the service. This is the same list as Annex A of our countersigned DPA:

• Clerk — authentication & identity
• Supabase (US) — primary database
• Vercel — application hosting, CDN, scheduled jobs & first-party product analytics (page views, Web Vitals)
• Upstash — caching & rate limiting
• Sentry — error monitoring
• Resend — transactional email delivery
• Anthropic (US) — AI summaries & drafting, used only when an eligible AI-assisted feature runs, using feature-specific workspace facts selected by the application. Anthropic handles that data under the applicable commercial service terms and configured data-use settings

These vendors serve only our own website visitors and newsletter subscribers, and never receive the channel data you import:

• Apollo (US) — marketing-website visitor analytics: resolves visiting IP addresses to likely companies. Public marketing pages only; contact-level visitor identification is disabled
• Loops or ConvertKit (whichever is configured, if any) — newsletter subscriptions

Data retention

Your imported channel data is kept until you delete it (per-record, or a full-workspace wipe). Audit-log retention is configurable per workspace and defaults to 365 days. When a member is removed from a workspace, their name and email as they were at removal stay on a historical member record that cannot sign in, so the audit history keeps its attribution. That record is deleted when their account or the workspace is deleted or, if your audit retention is 90 days or 1 year, by the retention sweep once that window has passed since their removal; with indefinite retention it stays until one of those deletions. Deleting your workspace removes its data. Deleted data can remain in our database provider's daily backups for up to 7 days, until those backups expire. Marketing inquiries and newsletter signups are scheduled for deletion after 180 days in our intake store; a daily sweep enforces that policy. An ongoing customer relationship or legal obligation may require a different period.

Security

Browser and API traffic uses HTTPS, managed storage providers supply at-rest controls, and tenant-owned application data is scoped with organization-aware authorization and database constraints. Details are on our Security & Trust page.

Your rights

From Settings → Privacy in the app, an admin can export a single person's record (as structured JSON, including its historical representations) or your whole workspace's data (as streamed, newline-delimited JSON covering every stored data class, without row caps — credentials and signing secrets are structurally excluded) for an access or portability request, delete an individual (right to be forgotten), or wipe the operational customer dataset. A full wipe removes people, accounts, partner deal registrations from every source, CRM-synced records and credentials, delivery payloads, saved import mappings, the collateral library and saved watchlists, derived match data, and caches; it disables outbound webhook endpoints. Workspace users, reseller names, API keys (a wipe does not revoke them), webhook endpoint configuration, and a scrubbed audit trail remain so the deletion is provable and the workspace can be reused. On plans that include audit CSV export, admins can also download the filtered audit history in that format. You can email us for any request. Depending on your location, you may have additional rights under the GDPR or CCPA/CPRA; we honour verified requests.

California privacy rights (CCPA / CPRA)

This section concerns the personal information VAR Conduit itself controls about you — your account identity, the product-usage analytics described above, and the marketing-website visitor data described above. (For the channel data your organization imports, that organization is the controller and handles its own people's requests using the in-app tools above.) If you are a California resident, you have the right to know what personal information we collect and how we use it; to access, correct, or delete it; to data portability; and to limit the use of any sensitive personal information. VAR Conduit does not sell your personal information and does not share it for cross-context behavioural advertising. We do not discriminate against you for exercising any of these rights — we will not deny you service, charge a different price, or provide a different level of service because you exercised them. To make a request, email privacy@varconduit.com; we respond to verified requests within the timeframes the CCPA requires.

International transfers

Our primary application and database hosting is configured in the United States. Other subprocessors may process data in their configured service regions. Where personal data is transferred internationally, appropriate safeguards (such as Standard Contractual Clauses) are provided through our subprocessors or, for the channel data you import, agreed in the countersigned DPA (see section 8 of our Data Processing Addendum).

Contact

Questions or requests: privacy@varconduit.com, or our contact page.