← Back to Home

Privacy Policy

Varro LLC·Effective Date: June 16, 2026·Last Updated: June 16, 2026

1. Introduction

Varro LLC ("Varro," "Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Varro platform (the "Service").

The Service is offered solely to residents of the United States. This Policy is written for United States users. If you are a resident of California or another U.S. state with a comprehensive consumer privacy law, additional rights and disclosures apply to you, as described in Section 11.

2. Information We Collect

2a. Information You Provide

  • Email address (during account creation)
  • Password (stored securely using industry-standard hashing, never in plain text)
  • Payment information (processed directly by our third-party payment processor; we do not store, access, or retain full card numbers)
  • Property addresses you search or analyze
  • Financial inputs you enter into analysis tools (such as purchase price, down payment, income, and expenses)
  • Information you provide when you contact support

2b. Information Collected Automatically

  • IP address and approximate geolocation derived from it
  • Browser type, operating system, and device information
  • Pages visited, features used, and actions taken within the Service
  • Date, time, and duration of visits
  • Error logs and performance data
  • Referral URLs and search terms used to reach the Service

2c. Property and Market Data

When you search an address, the Service retrieves property and market data from third-party data providers. This data is used solely to populate your analysis. It is not sold, shared with advertisers, or used for purposes unrelated to the Service.

2d. Sensitive Personal Information

Your account login credentials (your email and password) are treated as sensitive personal information under the CCPA. We use these credentials only to authenticate you and secure your account. We do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit its use. Financial figures you enter are used only to generate your analysis and are not used for any incompatible purpose.

3. Sources of Personal Information

We obtain personal information from the following sources: (a) directly from you, when you create an account, enter analysis inputs, subscribe, or contact us; (b) automatically from your device and browser as you use the Service; and (c) from third-party property and market data providers, when you search an address. We do not purchase personal information about you from data brokers for marketing purposes.

4. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide, operate, maintain, and improve the Service
  • To process payments and manage subscriptions through our payment processor
  • To send transactional communications, such as account confirmations, subscription receipts, renewal reminders, and service notices
  • To generate AI powered real estate analysis through the Anthropic API (see Section 6)
  • To monitor for security issues, prevent fraud, and enforce our Terms of Service
  • To respond to your support requests and communications
  • To analyze aggregated, de-identified usage patterns in order to improve features and the user experience
  • To comply with legal obligations

We do not sell your personal information. We do not share your personal information with advertisers, data brokers, or marketing platforms. We do not use your personal data to train artificial intelligence or machine learning models, and our AI provider does not use your inputs or outputs to train its models.

5. How We Share Your Information

We share your information only in the following limited circumstances:

  • Payment processor: for payment processing. Our payment processor acts as an independent controller of payment card data, and its own privacy policy governs that data. We do not receive or store your full card number.
  • Base44: our hosting and infrastructure provider, which acts as a service provider (data processor) on our behalf.
  • Anthropic: AI analysis requests are processed through the Anthropic API. Prompts sent to Anthropic may include property details and financial inputs you provide. Under Anthropic's Commercial Terms and applicable Data Processing Addendum, your inputs and outputs are not used to train Anthropic's models, and Anthropic acts as our service provider for this purpose.
  • Legal compliance: we may disclose information if required by law, court order, subpoena, or government authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Business transfers: in the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and of any resulting change to this Policy.

We do not share your data with advertisers, data brokers, or marketing platforms.

6. AI and Automated Processing

The Service uses artificial intelligence, specifically Anthropic's Claude models accessed through the Anthropic API, to generate portions of its real estate analysis. This Section explains how your data interacts with AI systems.

6a. Data Transmitted to the AI Provider

When you request an AI powered analysis, the following categories of data may be included in the prompt sent to Anthropic's API:

  • Property address and characteristics
  • Financial inputs you provide, such as purchase price, down payment, income estimates, and expense figures
  • Market data retrieved from third-party providers

Your email address, password, and payment information are never included in AI prompts.

6b. AI Provider Data Practices

Under Anthropic's Commercial Terms of Service and applicable Data Processing Addendum, your API inputs and outputs are not used to train or improve Anthropic's AI models. Anthropic processes the data solely to generate the requested analysis output and in accordance with its own data retention and security practices.

6c. Limitations of AI Generated Content

AI generated analysis may contain errors, inaccuracies, hallucinations, or omissions. Outputs are based on algorithms and data that may be incomplete or outdated, and should not be relied upon as the sole basis for any investment decision. Please review our Investment Disclaimer for additional information.

6d. Right to Opt Out

You may opt out of AI generated analysis. To exercise this right, contact us at colin@getvarro.com.

7. Data Retention

We retain your account information for as long as your account is active and as reasonably necessary to provide the Service. If you delete your account, we will delete or anonymize your personal data within thirty (30) days, except where retention is required by applicable law or is necessary to resolve disputes or enforce our agreements.

Analysis history and saved results are retained as part of your account. You may delete individual analyses at any time through the Service. Aggregated, de-identified data that cannot reasonably be used to identify you may be retained indefinitely for analytical and improvement purposes.

8. Security

We implement industry-standard security measures to protect your information, including:

  • HTTPS and TLS encryption for all data in transit
  • Hashed password storage using secure hashing algorithms
  • Rate limiting on authentication and other sensitive endpoints
  • User-scoped database access controls
  • Regular security reviews of backend functions and API endpoints

No method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your information using commercially reasonable measures, we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users without unreasonable delay, in accordance with applicable state and federal breach notification laws. Because Varro is organized in West Virginia, this includes the West Virginia breach notification requirements (W. Va. Code sections 46A-2A-101 to 46A-2A-105), in addition to the breach notification law of your state of residence. Notification will describe the nature of the breach, the categories of data affected, and steps you can take to protect yourself.

10. Cookies and Tracking

The Service uses session cookies that are strictly necessary for authentication and basic functionality. These cookies are essential for the Service to operate and cannot be disabled.

We do not use third-party advertising cookies, tracking pixels, or behavioral advertising technologies, and we do not engage in cross-site tracking. If we introduce analytics cookies or similar technologies in the future, we will update this Privacy Policy and obtain consent where required by law.

11. Your Rights Under U.S. State Privacy Laws

If you are a resident of California or of another U.S. state with a comprehensive consumer privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or others), you may have the rights described below. We honor these rights to the extent applicable law requires.

11a. Your Rights

Depending on your state of residence, you may have the right to:

  • Know what personal information we collect about you and how it is used
  • Access a copy of your personal information
  • Request correction of inaccurate personal information
  • Request deletion of your personal information
  • Opt out of the sale or sharing of your personal information (we do not sell or share your personal information)
  • Limit the use of sensitive personal information (we do not use sensitive personal information for purposes that trigger this right)
  • Opt out of automated decision-making technology used for significant decisions (see Section 11c)
  • Be free from discrimination for exercising your privacy rights

11b. Categories of Personal Information

In the preceding twelve (12) months, we have collected the following categories of personal information, as defined under the CCPA:

  • Identifiers (email address, IP address, account ID)
  • Commercial information (subscription history and transaction records)
  • Internet or other electronic network activity (interactions with features within the Service)
  • Geolocation data (approximate location derived from IP address)
  • Sensitive personal information (account login credentials, used only to authenticate you)
  • Professional or employment-related information (only if you voluntarily provide it)
  • Inferences drawn from the above categories

We collect these categories for the business purposes described in Section 4, from the sources described in Section 3. We do not sell or share these categories, and we disclose them only to the service providers and in the circumstances described in Section 5.

11c. Automated Decision-Making

The Service uses automated processing, including AI generated analysis, to produce real estate evaluations. California's CCPA regulations on automated decision-making technology took effect on January 1, 2026, with full compliance for covered uses involving significant decisions required by January 1, 2027. Because the Service's outputs are informational and educational tools that you act on at your own discretion, and are not binding or significant decisions about you (such as decisions concerning credit, housing, employment, insurance, or similar matters), we do not believe they constitute automated decision-making subject to a mandatory opt-out under these frameworks. As a proactive measure, we nonetheless offer you the ability to opt out of AI generated analysis, as described in Section 6d.

11d. Do Not Sell or Share

We do not sell or share your personal information as those terms are defined under the CCPA, the CPRA, or any other applicable state privacy law. We do not use advertising cookies or tracking technologies that would constitute a sale or sharing of personal information.

11e. Global Privacy Control

We honor Global Privacy Control (GPC) signals sent by your browser as a valid opt-out request under applicable law.

11f. California Shine the Light

California's Shine the Light law (California Civil Code section 1798.83) permits California residents to request information about a business's disclosure of personal information to third parties for those third parties' own direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes, so no such disclosures occur.

11g. How to Exercise Your Rights

To exercise any of these rights, contact us at colin@getvarro.com. We will verify your identity before processing your request, and you may use an authorized agent where the law allows. We will respond to verifiable requests within the timeframe required by applicable law (generally within forty-five (45) days). You will not be discriminated against for exercising your rights. If we decline a request, you may appeal where applicable law provides for an appeal.

12. Children's Privacy

The Service is not directed to children under eighteen (18) years of age, and you must be at least eighteen (18) to use it. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us at colin@getvarro.com and we will promptly delete it.

13. United States Users Only

The Service is intended for users located in the United States, and your information is processed and stored in the United States. We do not direct the Service to, or knowingly offer it to, individuals located in the European Economic Area, the United Kingdom, or Switzerland. If you access the Service from outside the United States, you do so on your own initiative and consent to the processing of your information in the United States under this Policy.

14. Changes to This Policy

We may update this Privacy Policy periodically. For material changes, we will provide at least thirty (30) days' advance notice by email and/or by posting a prominent notice within the Service. The "Last Updated" date at the top of this page will be revised accordingly. Your continued use of the Service after the effective date of any change constitutes acceptance of the updated Policy. We will maintain a publicly accessible archive of prior versions of this Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

Varro LLC Email: colin@getvarro.com