Privacy Policy

1. Who this policy is about, and who is responsible

This policy explains how Varo (“Varo”, “we”, “us”) collects, uses, stores and shares personal information when you use the Varo platform — the website, the web app at core.varotech.org, the Mercial chat and phone assistant, and WhatsApp.

Varo is the “responsible party” under the Protection of Personal Information Act 4 of 2013 (POPIA) for the personal information described in this policy. Varo's formal registered company details will be added to this section once finalised.

Contact for privacy matters: founder@varotech.org

If you believe we have not handled your information properly, you also have the right to complain to South Africa's Information Regulator — inforegulator.org.za, POPIAComplaints@inforegulator.org.za.

2. What we collect, and why

Account and business information: your name, work email, password (stored as a one-way hash, never in plain text), your business's name, and your industry (mining, accounting, real estate, or software/services). This is what it takes to create an account and a workspace.

Phone number and contact consent (optional): if you give us a phone number, we ask you to separately tick a box consenting to being contacted on it. We record the exact wording you agreed to and when, not just a yes/no, and you can withdraw this at any time in Settings — withdrawing keeps the number on file but stops any calls, WhatsApp messages or SMS to it.

What you give Mercial: chat messages, phone call audio and its transcript, WhatsApp messages and voice notes, and uploaded documents or photos are stored so the conversation and the record it produces — a filed report, a client note, a tracked deadline — actually works. This can include sensitive detail: for example, a mining report may describe a workplace injury. Where that happens, we process it because doing so is necessary to meet legal reporting obligations that already apply to your business (such as under the Mine Health and Safety Act), not for any other purpose, and it's visible only to people in your own organisation with a role that can see reports.

Business records you create: client and collections records, compliance deadlines, deals, FICA cases, and property listings — whichever your industry's version of the product tracks.

Usage and technical data: basic operational logs (who did what, when, from which organisation) for security and billing accuracy. We use your browser's local storage to keep you signed in — not third-party advertising or analytics trackers.

AI-training consent (separate, off by default): whether we may use your workspace's data to improve the underlying AI is a completely separate choice, never turned on automatically, and never required to use the product. Agreeing records the exact wording shown; withdrawing stops future use without erasing the record that you once agreed.

3. Who else sees your information

We use a small number of specialist providers to run the product, each only for its specific function: OpenRouter (routes conversations to the underlying language models that generate Mercial's replies), Groq (transcribes call audio and voice notes, and some faster replies), ElevenLabs (turns replies into the voice you hear on a call), Twilio (carries calls, SMS and WhatsApp), Postmark (delivers transactional email), and — only if you personally connect your own Google account — Composio, which lets Mercial save a report to your Drive or send it by Gmail on your explicit instruction.

Uploaded documents and photos are stored on Varo's own infrastructure, not a third-party cloud storage provider, unless you explicitly export a report to your own Google Drive.

We do not sell personal information, and we do not share it with anyone for their own marketing purposes.

4. Information leaving South Africa

Several of the providers above are based outside South Africa, mostly in the United States. Sending information to them is necessary to actually deliver the service you've signed up for — a phone assistant cannot work without a call provider and a voice provider, for example. We choose providers that publish their own security and privacy commitments, and keep what's sent to each one to the minimum needed for that function.

5. How long we keep information

We keep information for as long as your account is active, since the product works by recalling your organisation's own history — past reports, calls and chats are part of how Mercial knows what it already knows. We don't yet have a fixed automatic deletion schedule; if you close your account or ask us to delete your information, we act on that request rather than on a timer.

6. Your rights

Under POPIA, you can ask us to tell you what personal information we hold about you, correct it, delete it or stop processing it (subject to anything we're legally required to keep), object to certain processing, and withdraw any consent you've given at any time without it affecting anything before the withdrawal.

For access specifically, you don't need to ask us at all: Settings → Account → Your data downloads everything we hold about you personally, straight away.

For anything else — correction, deletion, objection — email founder@varotech.org and we'll action it directly.

7. Security

Passwords are hashed, never stored in a form we could read back. Each organisation's data is isolated at the database level so one customer's data cannot be seen by another, even from an application bug. Sessions can be immediately revoked — on sign-out or a password change — rather than staying valid until they naturally expire. No system is perfectly secure; we will tell you and the Information Regulator if we ever have reason to believe your information has been compromised, as required by law.

8. Children

Varo is a business tool, not intended for use by individuals under 18, and we do not knowingly collect information from children.

9. Changes to this policy

We may update this policy as the product changes. We'll update the date below when we do, and tell active users directly about any change that meaningfully affects how we use their information.

10. Contact us

founder@varotech.org