Privacy Policy

Who this covers

This policy applies to varconduit.comand the VAR Conduit application. For data you import about your channel (your resellers' people and accounts), you are the data controller and VAR Conduit is your processor — see our Data Processing Addendum.

What we collect

• Account identity— your name and email address are synchronized from our authentication provider (Clerk). Password credential verification is handled by Clerk; VAR Conduit's application database does not receive or store your password.
• Channel data you import — the reseller org trees, people (names, titles, work emails, regions), and accounts you upload. This is your business data; we hold it to provide the service.
• Usage & audit logs — selected session, administrative, and data-change events tied to your workspace.
• Technical data — IP address and basic request metadata, used for security, rate limiting, and reliability.
• Marketing inquiries and subscriptions — the contact details, qualification answers, and message you submit when booking a demo, plus an email address submitted for newsletter updates.

How we use it

We use application and imported channel data to provide and secure the service: to run your workspace, enforce access controls and plan limits, keep an audit trail, and support you. We do not sell your data, and VAR Conduit does not use your imported channel data to train its own models or build cross-customer datasets.

Website visitor analytics

Separately from the application, when you browse our public marketing website (varconduit.com) we record coarse technical data about the visit: your IP address, an approximate location (country, region, and city inferred from that IP), the pages you view, and the site that referred you. We use this for security, basic site analytics, and business development — understanding which organizations are interested in VAR Conduit — and we may use third-party IP-intelligence services to associate an IP with a likely company. This visitor data is separate from the channel data our customers import, is accessible in the application only to VAR Conduit operators, and is scheduled for deletion after 90 days by a daily retention sweep. To opt out or request deletion, email privacy@varconduit.com.

Subprocessors

We rely on these vendors to operate the service:

• Clerk — authentication & identity
• Supabase (US) — primary database
• Vercel — application hosting & CDN
• Upstash — caching & rate limiting
• Sentry — error monitoring
• Resend — transactional email delivery
• Loops (when configured) — newsletter subscriptions
• Anthropic(US) — AI summaries & drafting, used only when an eligible AI-assisted feature runs, using feature-specific workspace facts selected by the application. Anthropic handles that data under the applicable commercial service terms and configured data-use settings

Data retention

Your imported channel data is kept until you delete it (per-record, or a full-workspace wipe). Audit-log retention is configurable per workspace and defaults to 365 days. Deleting your workspace removes its data. Marketing inquiries and newsletter signups are scheduled for deletion after 180 days in our intake store; a daily sweep enforces that policy. An ongoing customer relationship or legal obligation may require a different period.

Security

Browser and API traffic uses HTTPS, managed storage providers supply at-rest controls, and tenant-owned application data is scoped with organization-aware authorization and database constraints. Details are on our Security & Trust page.

Your rights

From Settings → Privacyin the app, an admin can export a single person's record (as structured JSON, including its historical representations) or your whole workspace's data (as streamed, newline-delimited JSON covering every stored data class, without row caps — credentials and signing secrets are structurally excluded) for an access or portability request, delete an individual (right to be forgotten), or wipe the operational customer dataset. A full wipe removes people, accounts, CRM-synced records and credentials, delivery payloads, saved import mappings, derived match data, and caches; it disables outbound webhook endpoints. Workspace users, reseller names, endpoint configuration, and a scrubbed audit trail remain so the deletion is provable and the workspace can be reused. On plans that include audit CSV export, admins can also download the filtered audit history in that format. You can email us for any request. Depending on your location, you may have additional rights under the GDPR or CCPA/CPRA; we honour verified requests.

California privacy rights (CCPA / CPRA)

This section concerns the personal information VAR Conduit itself controls about you — your account identity and the marketing-website visitor data described above. (For the channel data your organization imports, that organization is the controller and handles its own people's requests using the in-app tools above.) If you are a California resident, you have the right to know what personal information we collect and how we use it; to access, correct, or delete it; to data portability; and to limit the use of any sensitive personal information. VAR Conduit does not sell your personal information and does not share it for cross-context behavioural advertising. We do not discriminate against you for exercising any of these rights — we will not deny you service, charge a different price, or provide a different level of service because you exercised them. To make a request, email privacy@varconduit.com; we respond to verified requests within the timeframes the CCPA requires.

International transfers

Our primary application and database hosting is configured in the United States. Other subprocessors may process data in their configured service regions. Where personal data is transferred internationally, we rely on the applicable contractual safeguards, such as Standard Contractual Clauses, provided directly or through our subprocessors.

Contact

Questions or requests: privacy@varconduit.com, or our contact page.