Privacy policy

Data controller

Scope

This policy applies to varinomics.com and its subdomains. Customer systems running Varinomics software on their own infrastructure are governed by the applicable commercial agreement and, where personal data is processed on behalf of a customer, by a separate data processing agreement.

Data collected by this website

We collect server-side download statistics to understand which software packages are requested. Public download requests and authorised download-link grants for protected packages are counted separately. These counts do not establish completed transfers or installations.

The statistics record the date and time in UTC, product, edition, version, platform, package format, and whether the traffic is production or testing. Where available, we also record the request IP address and an approximate country derived from it. Country reflects the network connection, which may be a shared network, VPN or proxy; it does not establish your identity, nationality or residence.

To distinguish automated requests, we match recognised crawler names in request user-agent headers and use trusted Cloudflare bot classifications where available. We retain only the derived classification and a short reason, not the user-agent string. For authorised operators’ download reports, we use Cloudflare DNS to look up reverse-DNS hostnames for IP addresses still within their retention period, including earlier recorded addresses. We store an available hostname and use forward DNS to verify recognised crawler hostnames before classifying them as bots. Where available, we also record the network's autonomous system number and organisation supplied by Cloudflare. These signals do not verify that a request came from a person; using a cloud network, VPN or proxy alone does not cause a request to be excluded.

Download reports are available only to authorised operators. IP addresses and reverse-DNS hostnames stop appearing in reports 30 days after the observation and are deleted from active records at the next successful hourly cleanup. Database backups expire under their separate backup retention schedule. Package and country counts, derived bot classifications, and network autonomous system numbers and organisations are retained for long-term reports. Recognised automated requests are automatically excluded from aggregate statistics. Authorised operators can inspect individual request history, including bots. Report CSV exports contain aggregate counts, not IP addresses or hostnames.

Download-reporting records contain no user-agent strings, email addresses, account identifiers or device identifiers. Separate operational logs may allow a request to be correlated with other records. Hosting providers' operational logs are described below.

Download statistics do not use cookies or browser tracking identifiers and do not collect application activity or telemetry. Outside the purchase checkout, the website uses no advertising or browser analytics. Fonts are served from the site's own origin.

Email contact

Visitors reach us by email at [email protected] or, for invoice orders, [email protected]. When you email us, we process the content of your message together with any personal data it contains - typically your name, email address, any organisation you mention, and the content of your message.

Service provider

Email is received and stored through the email provider we use for our @varinomics.com mailboxes (see Service providers below).

Retention

Correspondence is retained for up to 24 months after the last substantive reply, unless a commercial relationship or a legal obligation requires a longer retention. You may request deletion at any time by replying to the email thread or by writing to [email protected].

Purchases and licensing

Our account service processes your email address, account and sign-in records, purchased entitlements, download permissions, and installation and activation records. Activation uses a machine public identity and a derived installation identifier to administer the licence's installation allowance. We also process delivery records for sign-in, licence and order emails. Account sessions use browser storage to keep you signed in.

For direct online purchases, Varinomics processes your name, email, billing address, consumer or business status, and relevant business tax identifiers. We use these details to prepare your order, establish the applicable tax treatment, take payment and deliver your purchase. We retain the order, accepted terms and delivery consents, payment status, invoice, and any withdrawal, refund or dispute records.

Tax checks can include verification of business tax identifiers against official registers, purchaser name and address, and location evidence from billing information, network location or the payment provider. We retain the verification result, its source and date and the evidence needed for tax records. This information is separate from download statistics.

Revolut processes direct card payments. Payment details are entered on the payment provider's page under the Revolut privacy notice. Varinomics receives payment references, status and relevant billing information; we do not receive your complete card number or security code.

For direct invoice orders, Varinomics receives your chosen edition, company name, billing address, VAT number, contact email address, and order correspondence. We process these details, invoice and payment records to confirm the order, administer payment, and provide your licence, downloads, updates, and support.

For an existing reseller purchase, the authorised reseller and merchant of record is identified on your receipt. That seller processes checkout information for payment, tax, fraud prevention, and transaction administration under its own privacy notice, provided before payment. Payment details are entered into the seller’s checkout rather than into a Varinomics payment form. For a Paddle purchase, read the Paddle privacy notice.

The seller shares with Varinomics the buyer and order information required to provide the purchased licence or access entitlement, updates, transaction administration, and product support. This may include the buyer's name, email address, billing address, purchased product, transaction identifier, purchase status, currency, amount, and applicable tax information.

Relationship

Varinomics acts as an independent controller for the buyer information it receives and processes for licensing and support. An authorised reseller processes checkout data under its own privacy notice rather than as a Varinomics sub-processor.

Buyer terms

For an online reseller purchase, the transaction is governed by the buyer terms of the seller identified before payment and on your receipt. For a Paddle purchase, read the Paddle Buyer Terms. The software licence and product support are provided by Varinomics.

Retention

Account, purchase, entitlement and installation records are retained for as long as they are needed to administer the account, licence, access term, updates and support. Payment, invoice, tax evidence and dispute records may be retained longer where required by tax, accounting or other legal obligations. Closing an account does not erase records we must retain for those purposes. Operational logs and email delivery records are retained according to their security, troubleshooting and delivery purposes and the applicable provider's service settings and terms. Records required for the EU VAT One Stop Shop are retained for ten years after the end of the transaction year.

Server logs and hosting

GitHub Pages hosts the main website's static files. Cloudflare provides network protection, the account portal, download delivery and IP-based country estimates. Supabase operates the account backend, including download-report storage and restricted report authentication, and Microsoft Azure supports licence activation and signing. These services may process IP addresses, browser or device information, requested URLs, timestamps and request or error records to deliver and secure the service. These operational records are separate from the download statistics described above.

Cloudflare Turnstile checks sign-in and purchase requests for automated abuse. It processes browser and network signals for that purpose, as described in the Cloudflare privacy policy.

International transfers

The providers listed below and their supporting suppliers may process personal data outside the European Economic Area, including in the United States. Supabase's contracting entity is in Singapore; Resend's primary processing operations are in the United States. Selecting an EU database region does not make all hosting, support, security or email processing EU-only.

Transfer safeguards depend on the provider and destination. They include the European Commission's adequacy decision for the EU-US Data Privacy Framework where the receiving organisation and transfer are covered, or Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Google's provider-specific privacy framework information is published at Google privacy frameworks; GitHub's provider policy is the GitHub Privacy Statement.

Further processing and transfer terms are published in the Cloudflare Data Processing Addendum, Supabase Data Processing Addendum, Resend Data Processing Addendum and Microsoft Data Protection Addendum. You may request information about the safeguards applicable to your data by contacting us.

The seller’s privacy notice describes the entities involved in a purchase and its international-transfer safeguards. For a Paddle purchase, see the Paddle privacy notice.

Service providers

• Hosting provider - GitHub, Inc. (GitHub Pages).Purpose: static website hosting.
• Email provider - Google LLC (Google Workspace).Purpose: mailbox hosting for @varinomics.com addresses.
• CloudflarePurpose: network protection, account portal and request handling, Turnstile abuse prevention, download storage and delivery, and IP-based country estimates.
• SupabasePurpose: account authentication, application database and backend processing for orders, licences, activation records, downloads, and restricted operator report storage and access.
• ResendPurpose: sending transactional sign-in, licence, order and withdrawal emails, including recipient addresses, message contents and delivery records.
• Microsoft AzurePurpose: licence activation and signing services, including the installation identity and operational records needed for those services.

These providers process service data under their applicable data protection terms. Some also act as controllers for their own security, legal or service-administration purposes. Payment providers and authorised resellers process transaction data under the notices described in Purchases and licensing above. Official tax registers receive the identifiers needed for the relevant verification.

Data residency

The main website uses GitHub Pages, while account pages, request handling and downloads use Cloudflare's infrastructure. Our production Supabase account database is configured in Ireland. This database holds account, order, entitlement and download-reporting records; direct purchases are not held only in a payment provider's systems. Supporting services, operational logs, email processing and provider access may involve other locations, subject to the international-transfer safeguards described above.

Your rights under the GDPR

You have the following rights under the official GDPR text:

• request access to the personal data we hold about you (Art. 15)
• request rectification of inaccurate data (Art. 16)
• request erasure (Art. 17)
• request restriction of processing (Art. 18)
• object to processing based on legitimate interest (Art. 21)
• data portability (Art. 20)
• where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal(Art. 7(3))

Exercise any of these rights by emailing [email protected].

You also have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for Varinomics is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus. EU data subjects may also complain to their local supervisory authority.

Automated decision-making

This website does not perform automated decision-making within the meaning of Art. 22 GDPR.