Privacy Policy

Who we are

Varden is a service operated by K2026012830 (SOUTH AFRICA) (Pty) Ltd (registration number 2026/012830/07), trading as Varden, based in Cape Town, South Africa.

Varden is a thinking partner for founders — an AI service called Ren that helps you work through decisions over time. This policy explains what data we collect, how we use it, and what control you have over it.

If you have any questions or want to exercise your rights regarding your data, contact us at privacy@vardenhq.com.

What we collect

When you use Varden, we collect and store:

• Account information: the email address you sign up with, and basic account metadata (when you created your account, when you last logged in).
• Conversation content: everything you say to Ren and everything Ren says back. This is the core of what Varden does — without it, the service can't work.
• Memory derived from conversations: summaries, themes, commitments you've made, and patterns Ren has noticed across your sessions. This is what gives Varden continuity over time.
• Scheduling information: when you book sessions, your scheduled times, and your timezone.
• Voice input (if you use it): brief audio recordings used only for speech-to-text transcription. We do not retain the audio after transcription completes.
• Optional — Google Calendar access: if you connect your Google Calendar, we receive permission to create and update calendar events for your scheduled Varden sessions. We do not read your existing calendar events.

We do not collect or store: payment information (Varden is not yet a paid product); analytics or behavioral tracking data; advertising identifiers; data from any other source about you.

How we use it

We use the data above to:

• Make Varden work — process conversations, generate Ren's responses, maintain memory across sessions.
• Remind you of upcoming scheduled sessions via email.
• Notify you with a single nudge email after seven days of silence (no more frequently than every 14 days).
• Improve the service over time, in ways that do not involve sharing your data outside the systems described below.

We do not use your data for advertising, do not sell your data, and do not share it with anyone outside the specific processors named below.

Who processes your data

To provide Varden's service, we share specific data with the following third parties:

• Anthropic (United States): Conversation content is sent to Anthropic's Claude API to generate Ren's responses. Per Anthropic's API terms, this data is not used to train Anthropic's models. See Anthropic's privacy policy at anthropic.com/legal/privacy.
• OpenAI (United States): If you use voice input, audio data is sent to OpenAI's transcription API. Audio is transcribed and then discarded — neither OpenAI nor Varden retains the audio file after transcription completes. Conversation content is not sent to OpenAI. See OpenAI's privacy policy at openai.com/policies/privacy-policy.
• Supabase (European Union, Ireland): All your data — account, conversations, memory, schedules — is stored in our Supabase database hosted in the Republic of Ireland. See Supabase's privacy policy at supabase.com/privacy.
• Resend (United States): Email reminders and nudges are sent via Resend, which receives your email address and the content of the email. See Resend's privacy policy at resend.com/legal/privacy-policy.
• Google (United States, optional): If you connect your Google Calendar, we send Google calendar event data via the Google Calendar API to create events on your behalf. We receive only an authentication token; we do not see your existing calendar contents. See Google's privacy policy at policies.google.com/privacy.

These third parties are required to handle your data in line with their published terms and applicable law. We do not authorize them to use your data for purposes beyond providing their services to us.

Where your data lives

Your account, conversation, and memory data is stored on Supabase servers in the European Union (Republic of Ireland). Data sent to Anthropic, OpenAI, Resend, and Google is processed on their respective servers, primarily in the United States.

How long we keep your data

We keep your data as long as your account is active. If you delete your account:

• We delete your account information, conversations, memory, and scheduled sessions within 30 days.
• During those 30 days, your data is recoverable if you ask us to restore your account.
• After 30 days, deletion is permanent and cannot be reversed.
• Some technical records (e.g., backup snapshots, error logs) may persist for up to 90 days as part of our normal infrastructure operations, after which they are also permanently deleted.

You can delete individual conversations, memory items, or commitments at any time through your settings, without deleting your account.

Your rights

You have the right to:

• Access the data we hold about you — most of it is visible to you in your settings. For anything else, email privacy@vardenhq.com.
• Correct information that is wrong. You can edit most of what Varden remembers about you directly in your Memory settings.
• Delete your data, in full (close your account) or in part (delete specific conversations or memories).
• Export your data — request a copy of everything Varden holds about you by emailing privacy@vardenhq.com. We'll provide it within 30 days.
• Object to processing or withdraw consent at any time. The simplest way to do this is to close your account.

If you're in the European Union, the United Kingdom, or another jurisdiction with similar laws, you also have the right to lodge a complaint with your local data protection authority.

Cookies and tracking

Varden uses minimal cookies, only what's needed for the service to work — keeping you logged in, remembering basic preferences. We do not use analytics cookies, advertising cookies, or third-party trackers.

Children

Varden is intended for adults — people building businesses. It is not intended for, marketed to, or appropriate for anyone under 18. If you are under 18, please do not use this service. If we become aware that we have inadvertently collected data from someone under 18, we will delete it.

Changes to this policy

Varden is an early-stage product, and we may update this policy as the service grows. If we make material changes — particularly any change that expands how your data is used or shared — we will email you at least 14 days before the change takes effect. Smaller changes (clarifications, typo fixes, updated processor names) may be made without notice; the effective date at the top of this page will always reflect the most recent revision.

Contact

For any questions, concerns, or requests related to your privacy, contact us at:

privacy@vardenhq.com

We aim to respond to all privacy-related requests within 7 days.