Who operates Variation Vault
Variation Vault is operated by Variation-Vault, Dublin, Ireland. For privacy questions, contact support@variationvault.co.
What data we collect
Variation Vault stores the information needed to run job and variation approval workflows for residential trades. This can include:
- Account email and sign-in details.
- Organisation, workspace, and business profile details.
- Customer names, email addresses, optional WhatsApp numbers, and contact details entered by the trade.
- Job details, variation or extra details, pricing, VAT, and timing details.
- Uploaded photo evidence and related captions or notes.
- Approval events, rejection events, completion proof records, and proof PDFs generated on demand.
- Stripe subscription status plus Stripe customer and subscription identifiers.
- Technical and security logs, including Sentry error context after privacy scrubbing.
- Rate-limit records stored as opaque HMAC hashes, not raw IP addresses, emails, approval tokens, or approval URLs.
How we use data
We use this data to provide accounts and workspaces, run approval links, store customer/job/photo/proof records, send approval emails and open WhatsApp approval messages when configured, manage Stripe-hosted subscriptions, secure the service, diagnose errors, prevent abuse, and respond to support or data requests.
At a high level, the legal reasons for processing may include providing the service under a contract, legitimate interests such as security and support, legal obligations, and consent where a specific feature requires it.
Service providers
Variation Vault uses trusted third-party processors to operate the product:
- Supabase
- Stripe
- Resend
- Vercel
- Sentry
Retention and requests
We keep account, workspace, customer, job, approval, and proof data while the workspace needs the records or while we need them for service, security, billing, or legal reasons. Security logs and rate-limit counters are kept only as long as practical for abuse prevention and diagnostics.
Users and affected customers can ask for access, correction, export, or deletion by contacting support@variationvault.co or using the data requests page. Some records may need to be retained where required for billing, security, dispute handling, or legal obligations.
Security, transfers, and sale of data
Evidence photos stay in private storage and are shown through short-lived signed links after the relevant approval or app access check. Approval tokens are stored as hashes, proof PDFs are generated on demand, and Sentry diagnostics are scrubbed before events are sent.
Some service providers may process data outside Ireland or the EU. Where that happens, we rely on the provider terms and safeguards available for international transfers.
We do not sell personal data. Product analytics are limited to Vercel Analytics page metrics used to understand launch traffic and product reliability.