Privacy Policy

1. Who this policy is about, and who is responsible

This policy explains how Varo (“Varo”, “we”, “us”) collects, uses, stores and shares personal information when you use the Varo platform — the website, the web app at core.varotech.org, the Mercial chat and phone assistant, and WhatsApp.

Varo is the “responsible party” under the Protection of Personal Information Act 4 of 2013 (POPIA) for the personal information described in this policy. Varo is a business operated by its sole proprietor, who is also our Information Officer for POPIA. You can reach the Information Officer at support@varotech.org.

Contact for privacy matters: founder@varotech.org

If you believe we have not handled your information properly, you also have the right to complain to South Africa's Information Regulator — inforegulator.org.za, POPIAComplaints@inforegulator.org.za.

2. What we collect, and why

Account and business information: your name, work email, password (stored as a one-way hash, never in plain text), your business's name, and your industry (mining, accounting, real estate, or software/services). This is what it takes to create an account and a workspace.

Phone number and contact consent (optional): if you give us a phone number, we ask you to separately tick a box consenting to being contacted on it. We record the exact wording you agreed to and when, not just a yes/no, and you can withdraw this at any time in Settings — withdrawing keeps the number on file but stops any calls, WhatsApp messages or SMS to it.

What you give Mercial: chat messages, phone call audio and its transcript, WhatsApp messages and voice notes, and uploaded documents or photos are stored so the conversation and the record it produces — a filed report, a client note, a tracked deadline — actually works. This can include sensitive detail: for example, a mining report may describe a workplace injury. Where that happens, we process it because doing so is necessary to meet legal reporting obligations that already apply to your business (such as under the Mine Health and Safety Act), not for any other purpose, and it's visible only to people in your own organisation with a role that can see reports.

Referral programme (varotech.org/referral): if you join, we collect your name, your email address and, optionally, a phone number. We use them only to email you your referral link, to get in touch if a reward is earned, and to pay you. When someone signs up to Varo using your link or code, we record on their account that you referred them, so we know a reward is owed to you. We do not give the referred business your details, or give you theirs, beyond telling you a reward is due. If a reward is earned we will ask you by email for your bank details, which we use only to pay you and keep as long as tax and accounting rules require. You do not need a Varo account to join the programme.

Business records you create: client and collections records, compliance deadlines, deals, FICA cases, and property listings — whichever your industry's version of the product tracks.

Usage and technical data: basic operational logs (who did what, when, from which organisation) for security and billing accuracy. We use your browser's local storage to keep you signed in. The only advertising measurement is the Meta one described next, and it runs on the sign-up and plan pages only.

Visit counts on our public pages: on the sign-up and sign-in pages and varotech.org we count visits and sign-up steps with Umami, a cookie-free analytics tool we host ourselves. It records page views and the campaign tags in a link (such as utm_source), and never anything you type, your name, your email address or your phone number.

Measuring our ads (Meta): if you arrive from a Facebook or Instagram ad, Meta's Pixel on the sign-up and plan pages and a message from our server to Meta (the Conversions API) tell Meta that an ad led to a sign-up, a free trial or a first payment, so we can see which ads work. This shares a scrambled (hashed) version of your email address and of your Varo account number, your IP address, your browser details and Meta's own cookie identifiers, plus the plan and amount for a trial or payment. It never includes what you type into Mercial or anything in your workspace. Meta's cookie is set only on those two pages.

AI-training consent (separate, off by default): whether we may use your workspace's data to improve the underlying AI is a completely separate choice, never turned on automatically, and never required to use the product. Agreeing records the exact wording shown; withdrawing stops future use without erasing the record that you once agreed.

3. Who else sees your information

We use a small number of specialist providers to run the product, each only for its specific function: OpenRouter (routes conversations to the underlying language models that generate Mercial's replies), Groq (transcribes call audio and voice notes, and some faster replies), ElevenLabs (turns replies into the voice you hear on a call), Twilio (carries calls, SMS and WhatsApp), Postmark (delivers transactional email), and — only if you personally connect your own Google account — Composio, which lets Mercial save a report to your Drive or send it by Gmail on your explicit instruction.

Uploaded documents and photos are stored on Varo's own infrastructure, not a third-party cloud storage provider, unless you explicitly export a report to your own Google Drive.

We do not sell personal information, and we do not share it with anyone for their own marketing purposes.

4. Information leaving South Africa

Several of the providers above are based outside South Africa, mostly in the United States. Sending information to them is necessary to actually deliver the service you've signed up for — a phone assistant cannot work without a call provider and a voice provider, for example. We choose providers that publish their own security and privacy commitments, and keep what's sent to each one to the minimum needed for that function.

5. How long we keep information

We keep information for as long as your account is active, since the product works by recalling your organisation's own history — past reports, calls and chats are part of how Mercial knows what it already knows. We don't have a fixed automatic deletion schedule; we act when you ask rather than on a timer.

If you joined the referral programme, we keep your name, email and phone number until you ask us to delete them, except for payment records we are required to keep for tax and accounting purposes.

When you close your account, your personal information is deleted immediately — your name, email address, phone number, password, your messages to your team, and anything you said to Mercial that didn't end up in a filed report. Two things deliberately survive it: reports you filed, and the conversations behind them, because those are the business's compliance records and South African tax and company law expects them to be kept. Your name is removed from them. The record of what was done in your workspace is kept the same way, with your name removed. If you were the only person in a workspace, there is nobody left to keep records for, so the workspace and everything in it is deleted too — Settings tells you which case applies to you before you confirm.

6. Your rights

Under POPIA, you can ask us to tell you what personal information we hold about you, correct it, delete it or stop processing it (subject to anything we're legally required to keep), object to certain processing, and withdraw any consent you've given at any time without it affecting anything before the withdrawal.

For access specifically, you don't need to ask us at all: Settings → Account → Your data downloads everything we hold about you personally, straight away.

Deletion is self-service too: Settings → Account → Close your account shows you exactly what would be deleted and what would be kept, and then does it immediately.

If you only joined the referral programme and have no Varo account, there is no Settings page for you — email founder@varotech.org and we'll send you what we hold, correct it, or delete it.

For anything else — correction, objection — email founder@varotech.org and we'll action it directly.

7. Security

Passwords are hashed, never stored in a form we could read back. Each organisation's data is isolated at the database level so one customer's data cannot be seen by another, even from an application bug. Sessions can be immediately revoked — on sign-out or a password change — rather than staying valid until they naturally expire. No system is perfectly secure; we will tell you and the Information Regulator if we ever have reason to believe your information has been compromised, as required by law.

8. Children

Varo is a business tool, not intended for use by individuals under 18, and we do not knowingly collect information from children.

9. Changes to this policy

We may update this policy as the product changes. We'll update the date below when we do, and tell active users directly about any change that meaningfully affects how we use their information.

10. Contact us

founder@varotech.org