VARA Cloud is a hosted workspace: you get an isolated sandbox (a container) on the operator's infrastructure, an AI agent ("VARA") works on the tasks you describe, and you read a job receipt of what it did, what it refused, and what it cost. The service is in beta.
1. Who is responsible, and how to reach us
The service is operated by {{COMPANY_LEGAL_NAME}}, based in {{COMPANY_COUNTRY}}. The operator is currently an individual rather than a registered company; this notice will be updated if that changes.
- Legal and privacy contact: {{SUPPORT_EMAIL}}
- Day-to-day support: the in-platform support channel. No email ticket queue, no marketing email.
- Language: English and Arabic, with the same content. If they ever differ, the English version governs.
2. What we collect, and why
| What | Why we hold it | Lawful basis | How long we keep it |
|---|---|---|---|
| Account - email, hashed password, role and plan, second-factor secrets, passkey public keys, hashes of the recovery codes | To sign you in and prove who you are | Contract | Life of the account, then deleted with it |
| Session - a token, the IP address, and the time | To keep you signed in and to spot a stolen session | Contract, and legitimate interests for security | Until sign-out or expiry; the trace is kept 30 days |
| Workspace content - your prompts, your files, the agent's outputs, and the job receipts | To run the agent and show you what it did | Contract | Life of the account + 30 days after the last activity |
| Your own API keys - the model or provider keys you add to the vault | To let the agent call the model provider you chose | Contract | Encrypted at rest; deleted with the workspace, 30 days after the last activity |
| Usage ledger - per day: active minutes, tokens, and cost | To apply plan limits, cap a job's cost, and calculate refunds | Contract, and legitimate interests in running the service | Life of the account + 12 months |
| Audit log - the account, the action, the time, and the address | To record sensitive actions and to investigate misuse | Legitimate interests: security and accountability | 12 months |
| Waitlist entry - the email address and the plan you asked for | To give you the plan you asked for | Consent, with legitimate interests until then | Until you ask us to remove it, or 24 months |
| Technical logs - the address, the user agent, the request path, the status, and the time | To keep the service running and to see where it breaks | Legitimate interests: security and reliability | 30 days |
| Support conversations - what you write in the support channel and the answers you get | To answer you and record what was agreed | Contract for account holders, and legitimate interests | Life of the account + 30 days after the last activity |
3. The lawful bases we rely on
- Performance of the contract. Most of what we hold: you cannot use VARA Cloud without an account, a session, a workspace, a job receipt, and a usage record.
- Legitimate interests. Security (sessions, second factors, the audit log), keeping the service running and affordable (technical logs, the usage ledger), and finding where the service breaks so it can be fixed. You can object to this (section 9).
- Consent. Only where something is genuinely optional: joining the waitlist, optional phone alerts, and the preference cookies for language and appearance. You can withdraw consent at any time and we stop that processing.
The Saudi PDPL and its implementing regulations, and the GDPR for people in the EU, are the regimes behind these bases.
4. How long we keep your data
- Workspace content and files - while the account is alive and for 30 days after the last activity, then deleted.
- Audit log - 12 months.
- Technical logs - 30 days.
- Daily usage ledger - for the length of the account plus 12 months. It is what a refund is calculated from, so it cannot be deleted earlier.
- Backups - 35 days. A backup may hold a copy of your workspace for up to 35 days after you delete it, and is restored only to bring the service back.
- Waitlist entry - until you ask us to remove it, or 24 months pass.
5. Cookies
| Cookie | What it does | Type |
|---|---|---|
vc_sid | The session. It is HTTP-only, so scripts on a page cannot read it. | Essential |
vc_lang | Remembers the language you chose. | Preference, set only because you chose it |
vc_ui | Remembers the appearance you chose. | Preference, set only because you chose it |
Those three are all of them: no advertising, no tracking pixel, no third-party analytics. vc_lang and vc_ui only remember a preference you asked for, so they do not track you and need no consent; you can clear them in your browser at any time.
6. Who we share your data with
- Contabo GmbH (Germany) - hosting. The servers holding the accounts, the audit log, and the workspace data are rented from Contabo and run in Germany, and Contabo acts as our processor for that hosting.
- The model providers you direct - with your own API keys the agent calls that provider; with our models we call the provider for you; with your own provider we call it. They receive whatever your own task sends them, and their privacy terms apply.
- ntfy - only if you turn on phone alerts. The public ntfy push service delivers them, under a private topic name that you choose.
- {{PAYMENT_PROCESSOR}} - once charging starts, the payment processor named here takes your payment details. It will be named in this notice before the first charge. We never see your card number.
- Nobody else. We do not sell your personal data, use it for advertising, or broker it.
7. International transfers
- The platform's data is hosted in the European Union, in Germany.
- The operator is in the Kingdom of Saudi Arabia, so personal data is transferred outside the Kingdom to the infrastructure provider in Germany. That transfer relies on the European Commission's standard contractual clauses and a transfer impact assessment.
- Model providers and the ntfy service are reached from the infrastructure in Germany, so your task content travels out of Germany to reach them.
- If you are in the EU, the GDPR applies to you as set out in this notice.
8. How we protect your data
In plain words:
- Sessions are HTTP-only cookies, so page scripts cannot read them.
- An account can be protected with an authenticator app (TOTP) and with passkeys (WebAuthn). One-time recovery codes exist if you lose your device.
- Secrets are encrypted at rest.
- The sandbox is isolated: no extra capabilities, a read-only root filesystem, and limits on memory and processes.
- The container's port is never exposed.
- Every sensitive action is written to an audit log with the account, the action, the time, and the address.
No system is perfectly safe. If you find a problem, report it through the support channel.
9. Your rights
Under the Saudi PDPL and its implementing regulations, and under the GDPR if you are in the EU, you have the right to:
- see the personal data we hold about you, and get a copy of it
- correct it when it is wrong
- delete it
- receive it in a portable format
- withdraw consent where consent is the basis (section 3)
- object to processing based on legitimate interests
- ask us to restrict processing while a dispute is settled
- complain to the competent authority, in the Kingdom of Saudi Arabia or to your own authority in the EU
To exercise any of these, write through the in-platform support channel. We answer within 30 days. If a request is complex we may take up to 60 days more, and we say so within the first 30 days. There is no charge.
10. Automated decisions
VARA Cloud makes no decisions with legal effect about you. The agent acts on your instructions. Where a job receipt records that the agent refused something, that is the agent following your instructions and the platform's rules, not a decision made about a person.
11. Children
VARA Cloud is for people aged 18 and over. We do not knowingly serve anyone under 16. If we find an account belonging to someone under 16, we delete it on notice.
12. If this notice changes
We give 30 days' notice before a change takes effect. Where a change materially reduces your rights, you may close your account and receive a pro-rata refund of unused paid time, as described in the Refund Policy.
13. What we do not do
- We do not run advertising, share your data for advertising, or profile you for advertising.
- We do not sell or broker your personal data.
- We do not hide third-party trackers. The only cookies are the three listed above: no tracking pixel, no third-party analytics.
- We do not use your personal data for anything outside the purposes described in this notice.
Version history
| Version | Effective date | Change |
|---|---|---|
| 2026-10-19 | 2026-10-19 | First version. |