Privacy policy

Last updated 18 October 2026.

1. Who is responsible

Variantly, the operator of variantly.app, is the controller of the personal data described in this policy. Write to privacy@variantly.app for any request under it.

2. What we collect, and why

Your account: your work email address, the name you choose to set, and a session cookie (vt_session) that keeps you signed in. Basis: performing our contract with you, or our legitimate interest in running the free tools.

Captures of your product: screenshots, accessibility trees, virtual screen-reader transcripts (read from the accessibility tree), focus traces, rule output and, for recorded journeys, short videos of the pages we test. These are captures of your product, not of your users. The scanner signs in only with the test account you give us, which should hold no production customer data. Variantly does not need access to your customers' accounts. Basis: performing our contract with you.

Task drafts: the words and settings you enter while describing a task, and any suggestion it started from. We store them encrypted on our servers and tie them to the browser that started the draft.

The test account: its username, and its password sealed with AES-256-GCM under a key held only by our worker process. We never display it, and you can revoke it at any time. Basis: performing our contract with you.

Billing: company name, billing email, VAT or tax ID, plan and invoices. Card details are handled by Stripe and never reach us. Basis: performing our contract with you and our legal obligations on invoices.

Optional product analytics: with your permission, PostHog records page views and selected product actions. Events use an opaque identifier and are linked to your account ID when you sign in; we do not send your name, email, task text or decision rationale. We do not record sessions or use advertising cookies. You can reject optional cookies or withdraw your choice in Cookie settings. Basis: your consent.

Service activity: records needed to operate the product, such as review decisions, billing and the counts on your Overview, have their existing service purposes. Rejecting optional cookies does not stop these records. If you ask on checkout to be emailed when it opens for your company, we keep that request with your account so we know whom to write to.

Emails: receipts, drift alerts, nightly summaries, expiry and renewal notices, and one directory notification to a company whose published report we index. If you asked for it on checkout, one email when it opens for your company. One short survey about our price, once, after you claim a page or finish a free scan. Your answers are stored with your account and used only by us. Every alert email says how to change who receives it or stop it.

Downloading a white paper from its page asks nothing of you; we count the download without knowing who you are. If you ask us to email you a copy, we keep your email address, the paper, the role you choose, the source and campaign named in the link you arrived by, when we sent the email and when you first opened a link in it. If you have or later make an account with that address, we link the request to it. We use this to send the paper and to see which papers people want. You can unsubscribe from any email we send, and we delete the record on request.

Support chat, where available: opening Contact us connects your browser to Crisp. Crisp receives a random chat identifier, browser and connection information, including your IP address, and the address of our support chat document. Messages, files and contact details you submit go to Crisp so we can answer you. We do not automatically send your account name, email, product details or captured evidence. You can use email instead. Basis: our legitimate interest in answering your request.

Improving the checks: when someone marks an issue Working as intended, they can choose why from three fixed reasons. Each week we count the current decisions on issues across all customers by the check, the WCAG criterion and the kind of element it flagged, or by the kind of usability finding. We do not count or share your screens, page text, notes, task titles, your own rules, your company or product, or who decided. A count is kept only once people at three or more companies have decided that kind of issue, so it cannot describe one customer. Our team uses those counts to choose examples the checks and the AI tier are measured against. Basis: our legitimate interest in making the checks accurate for everyone who uses them.

3. The reviewer check

A file you upload to the reviewer check (DOCX, PDF, YAML or JSON) is read in memory, checked, and discarded. We do not store the file or its contents. Only the verdict counts, without the file, are recorded as an event.

4. Who else processes it

We use a hosting provider for the web app and worker, a managed Postgres provider, an object-storage provider for captures, a sign-in provider, Stripe for payments, a transactional email provider, a product analytics provider in the United States, an error-reporting provider, and Anthropic and OpenAI for the AI tier. Anthropic receives captured page evidence (accessibility trees, virtual transcripts and rule output) for the rows it proposes and returns a proposal. OpenAI receives the screenshots and page text of a task review's attempts. To plan a scan, choosing which pages to capture and which controls to try, the AI tier sends page titles, paths, link and control labels and roles, and cropped screenshots of captured pages to either Anthropic or OpenAI. OpenAI handles all of it under its standard API terms: it does not train on it, keeps it for abuse monitoring for up to about thirty days, and stores nothing beyond that, since every request asks it not to. An image uploaded to the free alt text generator goes to OpenAI, or to Anthropic if OpenAI fails, to write the alt text; we keep neither the image nor the result. Neither receives your test account. Each provider is bound by a data processing agreement, and the current list with regions is on the security page. We do not sell personal data.

Crisp IM SAS processes support chat for us. Its core infrastructure is in Amsterdam, Netherlands; its privacy policy describes its subprocessors and transfers.

When our existing Crisp integration forwards a support conversation to our Slack support channel, Slack also processes the forwarded content for our team.

5. How long we keep it

Captures that a published report rests on are kept for the life of that version, and for twelve months after a plan ends so that a frozen page still shows its evidence. Nightly captures that no report rests on are deleted after ninety days. Account, billing and invoice records are kept for as long as invoicing law requires. The sealed test-account credential is deleted when you remove it or when the plan ends.

An unsaved task draft expires seven days after it starts; editing it does not extend that period. Saving the task or choosing Start over clears the draft if another tab has not changed it. Clearing leaves an empty record for seven days, so late saves cannot restore its contents. Our cleanup job deletes expired drafts and empty records in batches; deletion can be delayed while the job is unavailable or has a backlog. Database backups may retain earlier copies until their retention period ends.

We do not apply automatic time-based deletion to optional analytics events. PostHog’s query window is not a deletion schedule. Turning optional cookies off stops future collection but does not delete events already sent. Contact privacy@variantly.app to request deletion of analytics associated with your account or browser identifier.

Closing chat or letting its browser cookie expire does not delete messages already sent to Crisp or copies forwarded to Slack. Cookie expiry is not a conversation deletion schedule. Contact privacy@variantly.app to request deletion of support conversations. Crisp’s privacy policy describes a one-year limit for account system logs. Its cookie policy says IP addresses associated with chat conversations can be kept indefinitely.

6. Your rights

You can see, correct, export or delete your account data, withdraw a published version, and remove your company's directory page after verifying its domain. Where the GDPR or the UK GDPR applies, you also have the rights to restrict or object to processing, to data portability, and to complain to your supervisory authority. We answer every request within thirty days.

7. Cookies and local storage

Necessary cookies keep the service working. The session cookie (vt_session) signs you in. The owner cookie (vt_owner) keeps an anonymous draft with the browser that started it until the company claims it. It also ties an unsaved task draft to that browser. When you continue with Google, a sign-in cookie (vt_oauth) ties Google's answer to your browser; it lasts ten minutes at most and is deleted when you come back from Google. The cookie-choice cookie (vt_consent_v1) remembers your choices and their policy version for 180 days. These choices are separate on variantly.app and dashboard.variantly.app.

Only after you accept optional cookies, ph_vt_analytics_v1 stores an opaque analytics ID and whether it is linked to your account, for up to 30 days. PostHog may also use vt_analytics_sdk_v1 to remember its collection preference. These cookies are local to the host that set them; we do not share an anonymous identity between the marketing site and dashboard. Analytics properties stay in memory, without URLs, referrers or task content in analytics cookies or local storage.

Cookie settings lets you reject optional cookies or change your choice. Turning optional analytics off removes its cookies and stops future collection; it does not delete events already delivered. Public company and report pages do not start optional analytics or create these cookies. Existing cookies can accompany a request on the same host. There are no advertising cookies.

Your browser's local storage holds your theme (light or dark), and only after you choose it; if you never choose, your device's setting is used. On the Issues page it also holds a count of the issues you have saved with the mouse, which shows you the keyboard shortcut once. Both stay on your device and are never sent to us. Clearing your browser's site data removes them.

Where chat is available, opening Contact us starts Crisp and its chat cookies (crisp-client/). We configure their expiry to one hour after activity, extended while chat is in use. They are scoped to dashboard.variantly.app and its descendants, rather than the marketing site or public company hosts. Crisp can also keep chat state in the dashboard host's local and session storage. Closing chat asks the support document to clear that browser state; reopening starts a fresh anonymous chat. Blocked storage or an unresponsive document can prevent cleanup. Opening chat does not accept optional analytics cookies, and rejecting analytics does not disable chat you choose to open.

8. Changes to this policy

We post changes here with their date and email account holders about material ones.