What we do with data, specifically

This explains what Varynt does with personal data in two different situations: when you browse this website, and when your organisation uses Varynt Work.

They are genuinely different, and the distinction matters more than it might look — see the next section.

For this website and for your own account with us — your name, your work email, the fact that your organisation is a customer — we decide what happens to that data. We are the controller, and this page is our commitment to you.

For everything inside your workspace — your employees, your clients, their contacts, your projects, tasks, comments and files — you decide. We only hold and process it so the product works for you. We are the processor and you are the controller. We do not decide what goes in, we do not mine it, and we do not use it for anything except running the service for you.

That is why, if one of your clients asks what data you hold about them, the answer is yours to give. We will help you find and export it.

When you contact us. Your name, email, company, phone if you give it, and what you wrote. We keep it so we can reply and so we remember the conversation.

When you have an account. Your name, email address, the organisations you belong to and your role in each. Passwords are stored only as a one-way hash — we cannot read yours, and neither can anyone who obtains the database.

What your organisation puts in. Employee records, client organisations and their contacts, projects, tasks, comments, approvals, leave requests and uploaded files. Whatever your team types is what is there; we do not add to it.

Operational records. Service logs, and an audit log of significant actions in your workspace — who changed what, and when. The audit log is part of the product, visible to your owners and admins.

We do not collect location data, we do not build advertising profiles, and we do not buy data about you from anyone.

This marketing site sets no cookies, runs no analytics, and loads nothing from a third-party domain. There is no consent banner because there is nothing to consent to. If you switch the site to dark mode, that preference is stored in your own browser and never sent to us.

Even the fonts are served from this site rather than from a font network, so loading this page does not tell anyone else that you visited.

The product itself is different, and only as far as it has to be: signing in sets a secure, http-only cookie so your session survives a page reload, and your browser stores the workspace you last had open. Both are necessary to keep you signed in. Neither tracks you anywhere else.

• To provide Varynt Work — the whole of your workspace content falls here.
• To send the notifications the product owes you: a task assigned to you, an approval waiting, an invitation. You control these per kind in your own notification preferences.
• To answer you when you get in touch, and to support you when something is wrong.
• To invoice, and to keep the accounting records the law requires us to keep.
• To keep the service secure, and to investigate abuse.

We do not send marketing email to people who were invited into a workspace. Being added to your colleague’s workspace is not consent to hear from us.

Your workspace data is held in a managed PostgreSQL database. Uploaded files are stored as objects in object storage, reached through short-lived signed links so a file URL cannot be passed around and keep working.

We use a small number of service providers, and only these:

• An object storage provider — keeps the files you upload.
• Our hosting provider — runs the service and its database.
• Our email provider — delivering notification and invitation email.

Each is bound to use the data only to provide that service to us. We will keep this list current, and we will tell you before adding a provider that handles workspace content. If your data is processed outside your country, we put the appropriate safeguards in place for that transfer.

Some of this is automatic, and these are the real windows the system enforces rather than intentions:

• Notifications — deleted 7 days after you read one, or 30 days after it arrived if you never did. Marking one unread takes it back out of that window.
• The activity feed — 90 days.
• The audit log — kept for the life of the workspace, and deliberately not swept. It is the record of who did what, and a compliance record you can delete is not one.
• Your workspace content — kept until you delete it or your workspace closes.

When a workspace closes we keep it briefly so you can export or change your mind, then delete it. Backups age out on their own cycle afterwards. Records we must keep for tax or accounting reasons are kept for the period the law requires and nothing longer.

The measures worth naming, because they are the ones that decide whether a mistake becomes a breach:

• Every organisation’s data is isolated. A request naming an organisation you do not belong to is refused, and an identifier belonging to another organisation simply does not resolve.
• Permissions are enforced by the API on every request, not by hiding controls in the browser. Hiding a button is a courtesy; the API is the boundary.
• Client portal contacts are served only what your team has marked client-visible, for their own client, by the same rule.
• Passwords are stored as one-way hashes. Sessions expire and can be revoked.
• Traffic is encrypted in transit, and file links are signed and short-lived.

No system is perfect. If a breach affects your personal data we will tell you and the relevant authority without undue delay, and we will tell you what we know rather than waiting until we know everything.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to work@varynt.in and we will respond within 30 days.

If your request is about data inside a workspace — your employee record, or your details as a client contact — the organisation that runs that workspace decides, not us. We will point you to them and help them act on it. That is not us avoiding the question; it is their data and we should not be editing it behind their back.

If you are unhappy with how we have handled a request, you can complain to your data protection authority. We would rather you told us first.

Varynt Work is a tool for businesses and is not directed at children. We do not knowingly collect data about anyone under 18. If you believe a child’s data has ended up in a workspace, tell us and we will work with that organisation to remove it.

If we change how we handle personal data in a way that affects you, we will email the workspace owner before it takes effect and update the date at the top of this page. We will not quietly broaden what we do with data you have already given us.

Privacy questions: work@varynt.in. Anything else: the contact page. We are based in India.