Privacy Policy

Varyn Technologies, Inc. ("Varyn", "we", "our", "us") provides Varyn CFO, software for fractional CFO and bookkeeping firms. Firms use it to work with their own clients: to bring in each client's financial data, build reports, forecasts and KPIs, and share approved work with the client through a secure client portal.

This policy applies to:

• Firm members: the people at a firm who use the Varyn CFO app (owners, partners, CFOs and staff, with the roles and permissions their firm gives them).
• Clients: the firm's clients and their staff, who use the client portal, open secure report links, or authorize an accounting connection.
• Visitors and prospects: people who visit varyn.io, book a demo or contact us.

Varyn CFO has no self-serve sign-up and no free trial. A firm gets access after a demo with our team, and every other account is created by invitation from a firm.

When a firm loads a client's financial data into Varyn CFO, whether by uploading files or by connecting QuickBooks Online or Xero, the firm is the controller of that data and Varyn processes it on the firm's behalf. We use it only to provide the service to that firm, following the firm's instructions and our agreement with the firm. The same applies to the other content a firm and its clients put into the service (messages, files, documents, meetings and tasks). In this policy we call all of this Customer Data.

If you are a client of a firm, the firm decides what information about you and your business is collected and how it is used, and the firm's own privacy notice applies. Please send requests about that data to your firm. If you contact us instead, we will pass your request to the firm and help it respond.

Varyn is the controller of a smaller set of information that we use to run our own business: firm account and billing details, website and demo-booking information, support conversations, and security and service logs.

Account information

Name, email address, optional phone number, role, firm name and the settings you choose (such as your time zone). Passwords are handled by our authentication provider and stored only in hashed form; we never see them.

Financial data that firms import

Files a firm uploads for a client, in CSV or Excel format: trial balances, profit and loss statements, balance sheets, chart of accounts, accounts receivable and accounts payable aging, budgets and customer revenue. For cash forecasting, firms also enter or import bank account balances, expected receipts and payments, and recurring items. From this data the service produces the firm's work product: financial statements, KPIs, forecasts, covenant tests, rolling reforecasts, findings and reports.

Accounting data from QuickBooks Online and Xero

If a firm connects a client's QuickBooks Online company or Xero organization, we read accounting data from it. Section 4 explains exactly what, why, and what happens when it is disconnected.

Content you create or share

Messages between a firm and its clients (including replies sent by email), internal team chat, files, notes, tasks and projects, forms and their answers, documents sent for e-signature, and video meetings, including recordings and transcripts when a meeting is recorded or transcribed.

Data from other integrations a firm connects

A firm may also connect other services. Depending on what it connects, we receive and store contacts, companies and deals from its CRM (such as HubSpot); the destination details for alerts it sends to Slack or Microsoft Teams; and, for Google Calendar and Google Meet, the connection tokens and the IDs of the events Varyn creates (see section 10).

Payment information

Stripe processes card and bank details for firm subscriptions and for invoices a firm sends its clients. We do not receive or store full card numbers. We store the Stripe identifiers, amounts and status of subscriptions, invoices and payments.

Signing, security and activity records

• When someone opens, views, consents to, signs or declines a document sent for e-signature, we record the date and time, their IP address, and a description of the browser and device used. This is the evidence of the signature.
• When a form is submitted we record the submitter's IP address and browser details with the answers.
• When a secure report link is viewed or downloaded we record the time and a one-way hash of the IP address, never the address itself.
• We keep an audit log of important actions in a firm's workspace (for example connecting or disconnecting an accounting system, rolling back an import, approving or delivering a report), and we use hashed IP addresses to limit the rate of requests to public pages.

Website, usage and diagnostic information

• Page views and performance measurements (Vercel Web Analytics and Speed Insights). These set no cookies and use no cross-site identifier.
• Error reports and a sample of performance traces (Sentry). We configure Sentry not to attach IP addresses, request bodies or screen recordings, and to strip secrets from links before sending. Browser error reports are sent through our own domain and passed on to Sentry, so blocking Sentry in a browser extension does not stop them.
• Campaign tags from the link you arrived on (such as utm_source), kept only for the browser session and saved with a demo booking or new account so we know which campaign it came from.
• Demo bookings (through Calendly) and messages sent through our contact form.

A firm can connect a client's QuickBooks Online company or Xero organization so that the client's figures come straight from their books instead of from uploaded files. These connections are being prepared for launch; until a connection is available and a firm chooses to use it, no data is read from either service.

Who connects, and how

A connection is authorized on the QuickBooks or Xero consent screen by someone with access to that company's books: either a firm member who holds the “Connect accounting systems” permission, or the client, through a secure single-use link the firm sends (valid for 72 hours). A firm member then confirms the connection before any of its data is used.

What we access

Access is read-only. Varyn CFOreads accounting data and never creates, changes or deletes anything in QuickBooks or Xero. We read only what the firm's reporting needs:

• company details: name, legal name, base currency and accounting basis, and the company or organization ID;
• the chart of accounts;
• financial reports: trial balance, profit and loss, balance sheet and, from QuickBooks, the cash flow statement;
• accounts receivable and accounts payable aging;
• customers, vendors (suppliers), invoices and bills, where needed for aging and revenue analysis.

For QuickBooks Online we request Intuit's accounting scope (com.intuit.quickbooks.accounting). Intuit does not offer a narrower read-only version of it, so read-only access is enforced in our software, which only reads. For Xero we request read-only scopes for reports, transactions, settings and contacts, plus offline access so the connection keeps working without asking the client to sign in each time.

Why we use it

Only to provide Varyn CFOto the firm that connected it: to build the client's financial statements, KPIs, forecasts, covenant tests, reforecasts and reports, to draft commentary for the firm to review (section 6), and to show the client the reports the firm approves.

How connection tokens are protected

QuickBooks and Xero give us OAuth tokens, not passwords; we never see the password for either account. The tokens are encrypted (AES-256-GCM) before they are stored, each one tied to its own connection so it cannot be used for any other. They are used only on our servers, are never sent to a browser, and are never written to logs.

How to disconnect

• In Varyn CFO:a firm member with the “Connect accounting systems” permission opens Integrations, then Accounting, and chooses Disconnect on the connection, or Disconnect and delete imported data to also delete what that connection imported (see below).
• In QuickBooks Online or Xero:anyone who manages the company's connected apps can remove Varyn there (in QuickBooks, from the connected apps in your Intuit account; in Xero, under Settings, Connected apps).
• If you are the firm's client, you can ask your firm to disconnect, or remove Varyn from QuickBooks or Xero yourself at any time.

What happens when you disconnect

• Disconnecting in Varyn CFOasks QuickBooks or Xero to revoke our access, deletes the stored tokens straight away, and stops all further reads. The client's data source goes back to file uploads.
• Disconnecting from QuickBooks or Xero makes our tokens stop working, so no further data can be read. The connection then shows as needing to be reconnected, and a firm member can remove it, which deletes the stored tokens.
• Data already imported is kept when the firm chooses Disconnect. Figures read before the disconnection stay in the firm's workspace as part of that client's financial history, so reports the firm has already delivered stay accurate. A record of the connection (the company name, who connected and disconnected it, and when) is kept in the firm's audit log.
• Disconnect and delete imported datadisconnects in the same way and then deletes, straight away, what that connection imported for the client: its imports, the balances and aging figures they added, and accounts nothing else uses. Anything the firm uploaded or entered itself stays, and figures the firm uploaded before the connection come back into use. Reports the firm has already generated or delivered are not changed; they are kept as they were issued. If the firm has locked a month the connection imported, it must unlock that month first. The deletion is recorded in the firm's audit log, and it can also be used later on a connection that was only disconnected.
• The firm can also ask us to delete imported data at support@varyn.io. Imported data is also deleted when the firm's account is closed and deleted (section 13).

• To provide Varyn CFO: run the firm's workspace and the client portal, import and analyse data, and produce the firm's reports and other work.
• To deliver what the firm approves: send reports and messages by email, provide secure links, and show the client the work in the portal.
• To send service messages: invitations, sign-in and security emails, notifications and reminders.
• To bill firms for their subscriptions and to process the invoice payments a firm collects.
• To provide support when you ask for it.
• To keep the service secure and reliable: detect and fix errors, prevent abuse, and keep audit records.
• To understand how the website and app are used, using page-view and performance data, and to improve them.
• To follow up with people who book a demo or contact us, and to comply with the law.

We do not sell personal information or Customer Data, and we do not use Customer Data for advertising.

Varyn CFOuses AI to help firm members do their work: it drafts report commentary, explains insights and suggests actions from the firm's data, answers firm members' questions in the assistant, summarises meetings, and scores incoming leads.

• A person approves before anything reaches a client. AI output is a draft for the firm to review. Reports must be approved by a firm member who holds the approval permission before they can be delivered, and the AI cannot approve, deliver or share a report. A message to a client that the assistant drafts is sent only after a firm member confirms it.
• Which providers.The assistant, insight explanations and report commentary use Anthropic's Claude models through the Vercel AI Gateway. Meeting notes, transcript questions and search, and lead scoring use OpenAI. We may change which of these providers handles a feature; we will keep section 9 up to date when we do.
• What is sent. Only the data needed for the request, such as the figures and context for the report or question at hand.
• No training.We do not use Customer Data, including QuickBooks and Xero data, to train or fine-tune AI models, ours or anyone else's. We use our AI providers through their commercial APIs, under terms that do not permit them to use the data we send to train their models.
• Google Calendar data is never sent to an AI provider (section 10).

A firm decides what its clients see. When a firm member delivers an approved report, the client can view it in the client portal, and the firm can also send it by email with a secure link. A secure link opens one delivered version of one report without signing in. It expires (after 30 days unless the firm chooses otherwise), the firm can revoke it at any time, and only a hash of the link is stored on our side.

When a firm emails a client through Varyn CFO, the client's email replies can be routed back into the same conversation in the portal.

• With the firm and its clients. Firm members see what their role allows. Clients see only what their firm shares with them.
• With our sub-processors (section 9), who process data for us to run the service and are not permitted to use it for their own purposes.
• With services a firm connects.When a firm connects a service such as HubSpot, Slack or Microsoft Teams, we send that service the data the firm directs, for example syncing contacts to its CRM or posting an alert to its channel. The firm's agreement with that service governs what happens there.
• For legal reasons, when we believe in good faith that the law requires it, or to protect the rights, property or safety of our users, the public or Varyn.
• In a business transfer, such as a merger or acquisition, where the information would remain subject to this policy.

We never sell personal information or Customer Data, and we never share it for advertising.

These companies process data for Varynto provide the service. QuickBooks (Intuit), Xero, HubSpot, Slack, Microsoft and Google are not on this list: a firm or user chooses to connect them, and data moves to or from them only at that person's direction.

We will update this list before we add a new sub-processor that receives Customer Data.

Varyn's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• When you connect Google Calendar, Varyn uses it to create, update and delete the events you schedule in Varyn (including Google Meet links for those meetings). We do not import, read or store your other Google Calendar content.
• We keep only the connection tokens (encrypted), the permissions you granted, and the IDs of the events Varyn creates.
• We do not use Google data for advertising, do not sell it, and do not share it except as needed to provide the feature. Google data is never sent to an AI provider or used to train AI models.
• You can revoke access at any time from your Google Account's third-party connections page.

We use only the cookies the service needs to work: keeping you signed in, protecting connection flows (such as connecting QuickBooks, Xero or Google) against forgery, and remembering a few display choices. The website and web app use no advertising cookies and no third-party advertising trackers. Our page-view analytics set no cookies.

• Data is encrypted in transit (HTTPS) and at rest by our hosting and database providers.
• Connection tokens for QuickBooks, Xero and other integrations are additionally encrypted by us before storage (AES-256), and are never sent to a browser.
• Every firm's data is kept separate by access rules enforced in the database itself (row-level security), and within a firm, access follows the roles and permissions the firm assigns.
• Sensitive actions are recorded in an audit log.
• Secure report links, accounting connection links and team invitations are random, are stored only as hashes, and expire or can be revoked.
• Incoming webhooks from our providers are verified by signature before they are processed.

No system is perfectly secure. If you believe your account or data has been compromised, contact us straight away at the address in section 18.

• While a firm's account is active, we keep its Customer Data so the firm can use it.
• If a subscription lapses or is cancelled, the firm's workspace is locked: firm members and clients cannot use it, scheduled work stops, and nothing is deleted, so paying again restores it exactly as it was.
• Closing an account. A firm can ask us to close its account and delete its data by emailing support@varyn.io. Before deleting, we can provide an export of the firm's data on request. Deletion is carried out by our team, not automatically. We will verify the request, delete the firm's Customer Data (including imported QuickBooks and Xero data) within 30 days, and confirm by email when it is done.
• Individual accounts. You can ask us to delete your own account on our account deletion page or at the same address. We record the request and email an acknowledgement to the address on it. Our team then verifies that the request came from the account holder (we may reply to that address to check) and deletes the account within 30 days. The response to a request is the same whether or not an account exists for the address. If you are a firm's client, records the firm keeps about you and your business stay under the firm's control; we will pass your request to the firm.
• What we keep after deletion. E-signature evidence (the signed document, its certificate and audit trail) is kept for as long as it may be needed to prove the signature. Billing and payment records are kept as long as tax and accounting law requires. Copies in backups are removed as those backups expire.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict some uses of it. To make a request, email support@varyn.io. We will verify your request before acting on it. If your information is held for a firm (section 2), we will pass your request to the firm and help it respond.

You can also disconnect QuickBooks Online or Xero (section 4) and revoke Google access (section 10) at any time.

Varyn is based in the United States. Our sub-processors may process data in the United States and in other countries where they operate.

Varyn CFO is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.

We will post any change on this page and update the dates at the top. If a change is significant, we will also tell firm account holders by email or in the app before it takes effect.