This policy explains how vargai Inc.("varg.ai," "we," or "us"), a Delaware corporation at 300 Delaware Ave, Suite 210-700, Wilmington, DE 19801, United States, handles personal data across varg.ai, app.varg.ai, our API and SDK (the "Services").
1. What we collect
| Category | Details |
|---|---|
| Account | Email address; optionally display name and avatar. If you sign in with Google, the name and avatar Google returns. |
| Onboarding | Company name and website, role, team size, creative volume, monthly advertising spend. |
| Marketing attribution | UTM campaign parameters captured when you first arrive. |
| Waitlist | Name, email, company, job title, estimated video needs. |
| Your Content | Prompts, chat messages, uploaded images, video, audio and documents, generated media, projects and workspace structure. |
| Billing | Stripe customer ID, billing address and country, transaction and subscription history, credit balance. Card numbers go directly to Stripe; we never receive them. |
| Technical | IP address, approximate country, browser and device information, request logs, error reports, usage and performance analytics. |
| Communications | What you send us when you get in touch. |
2. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account; generate, store and deliver content | Performance of a contract, Art. 6(1)(b) |
| Process payments, manage subscriptions and credits | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Secure the Services, prevent fraud and abuse, enforce our Terms | Legitimate interests, Art. 6(1)(f) |
| Diagnose faults, measure usage, improve the product | Legitimate interests, Art. 6(1)(f) |
| Automatically caption and safety-classify uploads | Legitimate interests, Art. 6(1)(f) |
| Send transactional email | Contract, Art. 6(1)(b) |
| Send marketing email, set non-essential cookies | Consent, Art. 6(1)(a) — withdrawable at any time |
| Comply with law, respond to lawful requests, establish or defend claims | Legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f) |
3. AI processing — what leaves our systems
When you generate media, your prompt and any files you supply are sent to the third-party model provider serving the model you chose. We send what is needed to fulfil the request; we do not send your account, billing or payment details.
Reference material you upload frequently contains personal data — a photograph of a face, a voice recording, a person's name in a prompt — and that data is transmitted to the relevant provider. Providers are listed, with their locations, on our Subprocessors page. Some models are developed in China and one routing provider is in Hong Kong. Please read Section 7 before uploading anything identifying.
Separately, every file you upload is analysed by an automated vision model to produce a title, description and a safety classification. Chat and planning run on Anthropic. We require providers by contract to process data only to fulfil our requests, but we do not control what a provider does with data once it is received, and their own terms apply to you.
Do not upload sensitive personal data — health, biometric, financial or government identifiers — or reference material depicting someone who has not consented. See the Acceptable Use Policy.
4. Caching
To control cost we cache generation results for up to 30 days. The cache key is derived from the request — model, prompt, files and options — and is not scoped to your account. An identical request from another user may therefore return the media generated from your request, and vice versa. Do not put anything confidential into a prompt, and do not treat generated media as private to you.
5. Training
We do not use your prompts or generated media to train, fine-tune or improve AI models. We use aggregated, anonymised usage data to improve the Services. If we ever change this we will give notice in advance, update this policy and provide an opt-out; any change would apply only going forward. We cannot make this commitment on behalf of third-party model providers, whose own policies govern what they do with data they receive.
6. Sharing
We do not sell personal data and do not share it for cross-context behavioural advertising.
- Service providers. Listed on the Subprocessors page.
- Collaboration. People you share a workspace or project with see that content and your display name and avatar.
- Public content. Content you mark public, and templates you publish to the community, are readable by anyone — including people without a varg.ai account — together with your display name and avatar. Uploaded and generated files are additionally stored at public, unlisted URLs that anyone holding the link can open, whether or not the content is marked public. Treat publication as permanent; see Section 4.3 of the Terms.
- Legal. Where required by law or legal process, or where we reasonably believe disclosure is necessary to investigate fraud or abuse, to comply with mandatory reporting obligations, or to protect the rights or safety of anyone.
- Corporate transactions. In a merger, acquisition, financing, insolvency or asset sale, subject to notice.
7. International transfers
We are based in the United States and our infrastructure is hosted there. If you use the Services from elsewhere, your data is transferred to and processed in the United States and in any other country where a provider operates.
For transfers out of the EEA, the United Kingdom or Switzerland we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, or an adequacy decision, together with supplementary measures where appropriate. Request a copy from hello@varg.ai.
Where you select a model developed in China, or one routed through our Hong Kong aggregator, your prompt and reference media are processed in or by an entity subject to the laws of that jurisdiction. Those laws provide for government access on terms that differ materially from EEA, UK or US law, and we cannot guarantee an equivalent level of protection or that data subject rights will be enforceable there. Choosing such a model is your decision; if that is unacceptable, select a model served from another jurisdiction and do not upload personal data as reference material.
8. Retention and deletion
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account, then as described below |
| Prompts, chat history, job records | While your account is open; retained after deletion for security and audit |
| Uploaded and generated files | Retained in object storage; not automatically erased on account deletion |
| Generation cache | Up to 30 days from the request |
| Billing and tax records | As required by tax and accounting law, typically 7 years |
| Published community templates | Until withdrawn; copies taken by others are not recalled |
| Analytics | Aggregated and anonymised, retained indefinitely |
What deleting your account does today. Your authentication record is permanently deleted and you can no longer sign in. Your workspaces and the projects inside them are deleted, and your API keys are revoked. Your profile row is marked deleted and retained. Files you uploaded or generated remain in our object storage, and prompts and job records held by our generation API are retained. Templates you published to the community remain published unless you withdraw them first.
If you want everything erased, email hello@varg.ai and we will carry out a full erasure, including stored files and prompts, within 30 days, except where we must keep records to comply with law, resolve disputes or enforce agreements. We are working to make full erasure automatic; until then this manual route is how we honour it.
9. Cookies and local storage
- Essential. Authentication session cookies, and bot-protection signals from Cloudflare Turnstile at sign-in. Required for the Services to work; these are set without consent.
- Preferences. A cookie storing your sidebar state.
- Analytics and diagnostics. Vercel Analytics and Sentry error monitoring. Where consent is required, these load only after you accept; you can change your choice at any time from the cookie settings link.
- On-device only. Local storage for onboarding state and layout preferences, and IndexedDB for cached thumbnails. Not transmitted to us.
10. Your rights
Subject to your jurisdiction, you may request access, correction, deletion, a portable copy, restriction of or objection to processing, and may withdraw consent at any time without affecting prior processing. Write to hello@varg.ai; we respond within 30 days, or sooner where law requires. We verify identity before acting and never discriminate against you for exercising a right.
EEA, UK and Switzerland. You may complain to your local supervisory authority. Send GDPR enquiries to the address above.
California. Under the CCPA/CPRA you have the rights to know, delete, correct, opt out of sale or sharing — we do neither — and to non-discrimination. Categories collected in the last 12 months: identifiers; commercial information; internet and network activity; geolocation inferred from IP; and user-generated content. An authorised agent may act for you.
11. Children
The Services are for adults. They are not directed to anyone under 18 and we do not knowingly collect their personal data. If we learn that we have, we delete it and close the account. Report a concern to hello@varg.ai.
12. Security
We use encryption in transit, row-level access controls, rate limiting, bot protection and audit logging, and we review our security posture regularly. Public API keys are stored as hashes. No system is perfectly secure and we cannot guarantee absolute security. If a breach affects your personal data we notify you and the relevant authorities as law requires.
13. Changes
We may update this policy. We revise the date above and, for material changes, take reasonable steps to notify you in the Services or by email before they take effect. Continued use afterwards means you accept the updated policy.
14. Contact
vargai Inc.
300 Delaware Ave, Suite 210-700
Wilmington, DE 19801
United States
Email: hello@varg.ai