Skip to content

Legal

Privacy Policy

Last updated: October 2026

1. Introduction

varsafe is operated by G NETWORKS, registered in France under SIREN 753 647 585, located at 100 rue Vulfran Warme, 80000 Amiens, France ("we", "our", or "us").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our secrets management platform and related services, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the French Data Protection Act (Loi Informatique et Libertés).

2. Data Controller

The data controller for your personal data is G NETWORKS, 100 rue Vulfran Warme, 80000 Amiens, France. For any data protection inquiry, use our contact form and select "Privacy"

3. Information We Collect

Account Information

  • Email address
  • Name (optional)
  • Authentication credentials (securely hashed)
  • OAuth provider information (if using social login)

Usage Information

  • Access logs and audit trails
  • IP addresses
  • Browser and device information
  • A device identifier, computed in your browser when you sign in to the dashboard, used to recognise devices you have trusted and to detect unusual sign-ins. It is not shared with third parties. It is strictly necessary to secure sign-in, so it does not require consent; our legal basis is our legitimate interest in keeping accounts secure.
  • Feature usage patterns

Secrets and Configuration

We store the secrets that you provide. Your secret values are encrypted in transit and encrypted at rest using industry-standard encryption. To inject, read, or export a secret on your behalf, our service decrypts it and processes the plaintext value in memory. Access to that process is restricted and secret access is recorded in your audit log. We do not use your secret values for any purpose other than providing the service.

4. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

  • Contract performance (Art. 6(1)(b)) — To provide and operate the Service, manage your account, and deliver the features you use
  • Legitimate interests (Art. 6(1)(f)) — To improve the Service, detect and prevent security threats, and maintain audit logs
  • Legal obligation (Art. 6(1)(c)) — To comply with applicable laws and legal requests

5. How We Use Your Information

  • To provide and maintain our services
  • To authenticate your identity
  • To generate audit logs for compliance
  • To improve our platform and user experience
  • To communicate important service updates
  • To detect and prevent security threats

6. Data Security

We implement robust security measures to protect your data:

  • Encryption in transit and at rest for secrets
  • Secure, encrypted connections (TLS 1.3)
  • Regular security audits and code review
  • Access controls and authentication
  • Append-only audit logging

7. Data Hosting and Transfers

Our core systems store your data in the European Union, in Germany, France and the Netherlands. Some processing can happen outside the European Economic Area. Stripe may transfer billing data to the United States, relying on the EU-US Data Privacy Framework where it applies and on Standard Contractual Clauses otherwise. Our content delivery network may serve a page from an edge location outside the EEA, near the visitor. If you sign in with GitHub, Google, GitLab or Bitbucket, that provider processes your sign-in under its own policy. The providers that process data on our behalf, with their locations, are listed on our sub-processors page.

8. Data Retention

We keep each kind of data only as long as its purpose requires:

  • Account and team data: while your account is active. When you delete your account, we remove your personal data within 30 days, except where the law requires us to keep it.
  • Secrets: until you delete them. Each environment's last 10 saved versions are kept so you can roll back, so an earlier or deleted value stays until newer saves replace it.
  • Audit logs: for the period your plan provides (7 days on Developer, 90 days on Team), then deleted.
  • Trusted devices: until the trust expires, you remove the device, or you delete your account.
  • Service logs: for the limited period needed for security and troubleshooting, then deleted automatically.
  • Encrypted backups: on a fixed rotation. Data deleted from the service disappears from backups as they expire.
  • Billing records: kept by our payment provider for as long as tax and accounting law requires.
  • Website statistics: kept to measure how the site is used. They hold no cookie or account identifier.

9. Data Sharing

We do not sell your personal information. We share it with:

  • The providers that run varsafe for us (infrastructure hosting, encrypted storage, email delivery, billing and content delivery), each listed with its purpose and location on our sub-processors page
  • The sign-in provider you choose (GitHub, Google, GitLab or Bitbucket), if you sign in with one
  • Competent authorities, regulators or courts where applicable law requires it
  • Other parties with your explicit consent

10. Your Rights (GDPR Art. 15-22)

Under the GDPR and French data protection law, you have the right to:

  • Access (Art. 15) — Obtain a copy of your personal data
  • Rectification (Art. 16) — Correct inaccurate or incomplete data
  • Erasure (Art. 17) — Request deletion of your account and data
  • Data portability (Art. 20) — Export your data in a structured, machine-readable format
  • Restriction (Art. 18) — Restrict processing in certain circumstances
  • Objection (Art. 21) — Object to processing based on legitimate interests

To exercise any of these rights, use our contact form and select "Privacy". We will respond within 30 days. If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL) at www.cnil.fr

11. Cookies

We use essential cookies for authentication and session management. We do not use tracking cookies for advertising purposes.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

13. Contact Us

If you have questions about this Privacy Policy, please use our contact form and select "Privacy"