Privacy Policy

Varosity Inc. (“Varosity,” “we,” “our”) operates the Varosity service at varosity.ai and related surfaces. This Policy explains what personal information we collect, how we use it, who we share it with, and your rights over it.

Updated October 26, 2026: named Axiom for logs. October 10, 2026: added voice samples, connected apps, product analytics, error monitoring, rate limiting and onboarding email, and named the vendors involved. These describe how the Service already works; nothing new is collected.

1. Information we collect

Information you provide directly

• Account data: your email address, display name, and any avatar image you upload when you create an account.
• Provider credentials (BYOK): the third-party API keys you choose to store with us (Google, Replicate, Runway, ElevenLabs, etc.). These are encrypted at rest with AES-256-GCM and only decrypted in-memory when making a request to the corresponding provider on your behalf.
• Content you submit: prompts, reference images, audio uploads, project titles, and any other material you add to your storyboard.
• Generated outputs: videos, audio tracks, and thumbnails produced by third-party providers at your request.
• Voice samples and voice models: audio you upload or link to create a cloned or designed voice, and the resulting voice model. Voice samples are sent to the voice provider you use (for example ElevenLabs) to create the voice. Only upload a voice you have the right to use.
• API keys and connected apps: Varosity API keys you create, and a record of each app you connect through sign-in (the app's name and return address, the permissions you approved, its daily spend cap, and when it was connected). We store a hash of each key and token, plus a short identifying prefix of each API key so you can tell your keys apart.
• Payment information: when you purchase credits, Stripe collects your card details directly. We receive a Stripe customer ID, billing email, amount, and transaction outcome from Stripe, but we do not receive or store your full card number, CVC, or bank account details.

Information collected automatically

• Usage and logs: IP address, user agent, requested routes, referrer, and timestamps for operating the Service, diagnosing errors, and preventing abuse.
• Cookies and local storage: a session cookie from our authentication provider (Supabase) that keeps you signed in. If you arrive through one of our tracked links (for example from a social profile), we also set two first-party cookies for 90 days: one recording which link you came from and one random visitor ID, so a later sign-up can be attributed to that link. We do not use advertising cookies.
• Product analytics: events such as “account created”, “first generation” and “credits purchased”, with your account ID (or, before you have an account, the random visitor ID described above), the model used and the cost, so we can see which parts of the Service work. These are processed by PostHog. Aggregate page-view counts are collected with Vercel Web Analytics, which uses no cookies. We do not track you across other sites.
• Error monitoring: when something fails, a diagnostic report (error message, route and, where available, account ID and API key ID) is sent to Sentry.
• Abuse prevention: IP addresses, account IDs and API-key identifiers are used for rate limiting (processed by Upstash).

2. How we use information

• To provide, operate, secure, and improve the Service;
• To authenticate your account and route requests to the third-party provider you select;
• To process payments, apply credits, send receipts, handle refunds, and prevent fraud;
• To respond to support requests and send transactional email;
• To send a small number of onboarding emails after you sign up (for example, a reminder if you have not created anything yet). Each one has an unsubscribe link;
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use your prompts or generated outputs to train our own models.

3. Who we share information with

We share personal information only with:

• Third-party AI providers you select to generate media (Google, Replicate, Runway, ElevenLabs, fal.ai and others). Your prompts and any uploaded reference materials are transmitted to the selected provider. Anthropic and OpenRouter also receive request and conversation text when you use prompt help, model suggestions, storyboard or brand-agent planning, or chat. Each provider's privacy policy governs their processing.
• Infrastructure providers that host the Service: Vercel (application hosting and page-view analytics), Supabase (database, auth, file storage), Stripe (payments), Fly.io (the content-credentials service behind /verify), Resend (transactional and onboarding email), PostHog (product analytics), Sentry (error monitoring), Axiom (log aggregation) and Upstash (rate limiting). These vendors are contractually bound to process data on our instructions only. The full list is on our subprocessors page.
• Apps and agents you connect. You can let a third-party app or AI agent use your Varosity account, either by giving it an API key or by approving it on a Varosity sign-in screen. An app you approve can generate media, spend credits up to the daily cap shown when you approve it, and read and change your projects, within the permissions listed on that screen. It cannot see your password, payment details or stored provider keys. You can change an app's cap or disconnect it at any time under API Keys; access ends immediately. What the app itself does with the results is governed by that app's own terms and privacy policy.
• Law enforcement or other parties when required by law, subpoena, or valid legal process, or to protect the rights, property, or safety of Varosity, our users, or the public.
• A successor entity in the event of a merger, acquisition, or sale of assets, subject to customary confidentiality protections.

4. Data retention

• Account data is retained for the life of your account plus up to 30 days after deletion (for backup and audit purposes).
• Project content (prompts, uploads, generated media) is retained until you delete the project or your account. Stored media files (images, audio, stitched videos) stay in storage after a project is deleted until you ask us to remove them; individual video clips are hosted by the provider that made them.
• Billing records are retained for at least seven (7) years to meet tax and accounting obligations.
• Log data is retained for up to 90 days unless required longer for security investigation.

5. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete your personal information (subject to retention obligations above);
• Export your project content in a machine-readable format;
• Withdraw consent or object to certain processing (where processing is based on consent);
• Lodge a complaint with a supervisory authority (in the EU/UK, your national data-protection authority; in California, the California Attorney General).

To exercise any of these rights, email jon.kludt@varosity.com. We will verify your identity before acting on the request and respond within the timeframes required by applicable law.

6. California residents (CCPA/CPRA)

In the past 12 months, we have collected the categories of personal information described in Section 1, for the purposes described in Section 2, and shared them with the service providers described in Section 3. We do not sell personal information and do not share it for cross-context behavioral advertising. California residents have the rights listed in Section 5 and the right not to be discriminated against for exercising them.

7. International transfers

Varosity is operated from the United States and our infrastructure providers may process data in the U.S. and other jurisdictions. If you are located outside the U.S., you understand that your information will be transferred to and processed in the U.S.

8. Security

We use industry-standard safeguards including TLS 1.2+ in transit, AES-256-GCM encryption of BYOK credentials at rest, role-based access control, and the principle of least privilege. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

9. Children

The Service is not directed to children under 18 and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy. Material changes will be announced on the Service or by email at least 14 days before they take effect.

11. Contact

Questions or requests regarding this Policy:
Varosity Inc.
4747 Viewridge Ave, San Diego, CA 92123
jon.kludt@varosity.com