Privacy Policy
Last updated: July 7, 2026
1. What we collect
- Account data: email address and hashed password (via Supabase Auth) when you sign up. No further profile data is stored.
- Experiment data: HTML/CSS snapshots of elements you pick, variant code, page URL, and conversion events — stored per test. You choose the URL and element. The original page content is not analyzed or read beyond the element you selected.
- AI generation (OpenAI): When you generate a variant, the extracted HTML/CSS context of the original element and the Figma export data are sent to OpenAI's API. The data is used only for generation and is not stored by OpenAI. Do not submit personal data in prompts or designs.
- Payment data: Credit card details are processed directly by Stripe. We never have access to full card numbers. Stripe shares only: status, payment method type, and last 4 digits.
- Waitlist: email address if you submit the coming-soon form.
- Usage data: the ab.js snippet sends only the domain name (host) to our servers to check for active tests — never the full page path. Variant assignment and conversion events are collected as anonymized counters only. No personal visitor data or browsing history is stored.
- Analytics data (Vercel): anonymous page view counts, referrer, browser/device type, and country-level geo. No cookies, no IP storage, no fingerprinting. Vercel Web Analytics and Speed Insights are cookieless and GDPR-compliant by default. Data is aggregated and never contains personal identifiers.
2. How we use it
- To provide and operate the A/B testing service.
- To display experiment results in your dashboard.
- To communicate product updates (only if you opt in).
- To improve the product based on aggregated usage patterns.
3. Data storage & processing
Data is stored on Supabase (Postgres, hosted in Frankfurt, Germany) and on Vercel (us-east, USA).
Retention periods
- Account data: until account deletion.
- Experiment data: 12 months after the last conversion event, then automatically deleted.
- Event log: deleted automatically when the associated test is deleted (cascade).
- Waitlist entries: 12 months after submission, then automatically deleted.
- Logs (Vercel): 7 days.
- Analytics data (Vercel): aggregated page view statistics, retained 12 months. Raw data: 1 month. No personal reference.
- Anonymized statistics: retained indefinitely (no personal reference).
Account deletion removes all associated personal data within 30 days.
4. Third-party services & international transfers
We use the following sub-processors. Data processing agreements (Art. 28 GDPR) are in place with all of them.
| Service | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase Inc. | Database, Auth & Google OAuth | Frankfurt, DE | DPA + SCCs |
| Vercel Inc. | Hosting + Web Analytics & Speed Insights | us-east, USA | DPA + SCCs (EU-US DPF) |
| Stripe Inc. | Payments | Global | DPF certified |
| OpenAI | AI generation | US | API only, no storage |
| Resend Inc. | Email notifications | US (us-east) | DPA + SCCs |
| Upstash Inc. | Rate limiting (IP addresses) | Global | DPA + SCCs |
5. Cookies & local storage
We do not use tracking or advertising cookies. The following storage mechanisms are used strictly for functionality:
| Name | Type | Purpose | Duration |
|---|---|---|---|
sb-*-auth-token | Cookie | Session auth | 1 year |
_vercel_insights | — | Vercel Analytics & Speed Insights are cookieless. No cookies or local storage are used for analytics. | — |
ab_<test_id> | localStorage | Variant assignment (sticky). Only set with consent (window.varianteConsent); cookieless / in-memory otherwise. | Per experiment |
ab_conv_<test_id> | sessionStorage | Conversion deduplication. Only set with consent; in-memory otherwise. | Session |
6. Your rights (GDPR)
If you are in the EU/EEA, you have the following rights under Articles 15–22 GDPR:
- Access (Art. 15): request a copy of your data.
- Rectification (Art. 16): correct inaccurate data.
- Erasure (Art. 17): delete your account and all associated data.
- Restriction (Art. 18): limit processing.
- Data portability (Art. 20): export your data in a machine-readable format.
- Objection (Art. 21): object to processing.
To exercise any of these rights, email hello@getvariante.com and we'll respond within 30 days.
If you believe our processing infringes GDPR, you have the right to lodge a complaint with the supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.
7. Contact
Valentin Wilhelm
Judenbühlweg 23
97082 Würzburg
Germany
Email: hello@getvariante.com