VARNEVO Legal
Privacy Policy
This policy meets our information obligations under KVKK, the GDPR (for EU/EEA and UK users) and the CCPA/CPRA. Data subjects in Türkiye should also read the KVKK Notice.
Last updated: 19 October 2026 · Version: 2026-10-19
1. Controller and Contact
The controller is Planicas LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. Privacy requests: contact@varnevo.com.
In business use where you enter other people's data into a workspace, you are the controller and we are the processor (see the Data Processing Addendum).
2. Data We Process, Purposes and Legal Bases
| Data | Purpose | Legal basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|---|
| Name, email, password (hashed), language and currency preference | Account creation, authentication, providing the service | Performance of a contract |
| Asset, maintenance, service, expense, subscription, invoice and document/media content; notification preferences | Service functions, reminders, reports | Performance of a contract |
| Payment: Stripe customer/subscription/invoice data (card numbers are not held by us) | Charging, invoicing, accounting | Performance of a contract; legal obligation |
| IP address, device/browser data, device fingerprint, Turnstile result, authentication and security logs | Security, fraud and abuse prevention, rate limiting | Legitimate interests |
| Error and performance records (Sentry) | Error detection, service quality | Legitimate interests |
| Product analytics (PostHog): page views, usage events, plan, internal user ID | Improving the product | Consent (cookie/analytics choice); not collected without consent |
| Transactional emails and push notifications (browser subscription data for push) | Verification, security, payment and reminder notices | Performance of a contract; browser permission for push |
| Email and preferences for marketing messages | Announcements and campaigns | Consent (withdrawable at any time) |
| Consent and acceptance records (document type, version, time, hashed IP/browser) | Proof of legal obligations and consent | Legal obligation; legitimate interests (establishing/defending claims) |
We do not request special-category data; please do not upload such data (health, biometrics, etc.) in documents or notes. The service is not directed at people under 18; we delete accounts we learn belong to younger users.
3. Analytics and Cookies
Product analytics (PostHog) and related browser storage are activated only if you choose "Also accept analytics". Otherwise PostHog is not started and no cookie or local-storage record is created for that purpose. We do not use session replay, and we send PostHog neither your email nor your name, only an internal user ID and plan. You can change your choice at any time on the Cookie Policy page.
This data is pseudonymous (your identity is not shown directly) but not fully anonymous.
4. Recipients and Sub-processors
We do not sell your data or share it for advertising. To provide the service we work, under contractual protection, with the infrastructure providers listed with purpose and region in the Sub-processors List (Supabase, Vercel, Stripe, PostHog, Resend, Sentry, Upstash, Cloudflare, browser push services). Lawful requests from competent public authorities may be answered within the legal framework.
5. International Transfers
Your data is processed outside Türkiye, the EU/EEA and the UK, notably in India (database/authentication) and the USA/EU (file storage, application, email, analytics). Providing the service technically requires this.
For data subjects in Türkiye the transfer is based, under KVKK Art. 9, on the explicit consent we obtain at sign-up (and in the app for existing users) and on the data processing agreements offered by the sub-processors. If you withdraw consent, the service may be impossible to continue because it requires processing abroad. For EU/EEA and UK data subjects, transfers rely on appropriate safeguards such as the sub-processors' data processing agreements and the European Commission's Standard Contractual Clauses included in them; you can request a copy at contact@varnevo.com.
6. Retention
| Data | Period |
|---|---|
| Account, asset, maintenance, document and other operational data | While your account is open; deleted within 30 days after you delete it |
| Invoice and payment records | 10 years under legal obligation even after deletion (restricted access, identifiers reduced) |
| Consent and acceptance evidence | 10 years (with hashed identifiers) |
| Security and fraud logs | 365 days |
| Product analytics (if consented) | Up to 365 days |
| Backups | Deleted data expires from backups within 35 days |
7. Your Rights
Under KVKK Art. 11, GDPR Arts. 15-22 and the CCPA/CPRA you have the right to access, rectify, erase, restrict, object, data portability and withdraw consent for consent-based processing. California residents may also opt out of the sale/sharing of personal data; we do not sell personal data or share it for cross-context behavioural advertising. You will not be discriminated against for exercising your rights.
Send requests to contact@varnevo.com or use Settings > Security. We may need to verify your identity. We answer within 30 days. You can export your data and delete your account yourself in account settings.
If you are unhappy with our answer you may complain to the Personal Data Protection Board (Türkiye), the supervisory authority in your EU/EEA country, or the ICO (UK).
8. Security
We apply technical and organisational measures such as access control, row-level data isolation, encryption in transit and monitoring (see the Security Policy). In case of a personal data breach we notify the competent authority and, where required, affected persons as the law requires.
9. Changes
We announce material changes in the app or by email before they take effect. Earlier versions are available on request.