What we do with data, specifically

This explains what Varynt does with personal data in two different situations: when you browse this website, and when your organisation uses Varynt Knowledge.

They are genuinely different, and the distinction matters more than it might look — see the next section.

For this website and for your own account with us — your name, your work email, the fact that your organisation is a customer — we decide what happens to that data. We are the controller, and this page is our commitment to you.

For everything inside your workspace — your spaces, pages, comments, templates and the files attached to pages — you decide. We only hold and process it so the product works for you. We are the processor and you are the controller. We do not decide what goes in, we do not mine it, and we do not use it for anything except running the service for you.

When you contact us. Your name, email, company, phone if you give it, team size, what you are looking to use Varynt Knowledge for, and what you wrote. We keep it so we can reply and so we remember the conversation.

When you have an account. Your name, email address, the organisations you belong to and your role in each. Your Varynt sign-in is shared across the Varynt products, and passwords are stored only as a one-way hash — we cannot read yours.

What your organisation puts in. Spaces, pages and their version history, comments, templates, files attached to pages, and — when someone is asked to confirm they have read a page — that confirmation. Whatever your team writes is what is there; we do not add to it.

Who read what. When somebody opens a page, the service records that they viewed it and on which day. It powers “recently viewed” and, on plans that include page analytics, lets the people who can edit a space see who has read its pages. The day-by-day record is deleted after 400 days.

Operational records. Service logs, and an activity record of changes inside your workspace.

We do not collect location data, we do not build advertising profiles, and we do not buy data about you from anyone.

This marketing site sets no cookies, runs no analytics, and loads nothing from a third-party domain. There is no consent banner because there is nothing to consent to. If you switch the site to dark mode, that preference is stored in your own browser and never sent to us.

Even the fonts are served from this site rather than from a font network, so loading this page does not tell anyone else that you visited.

The product itself is different, and only as far as it has to be: signing in stores your session in your browser so you stay signed in, and your browser remembers the workspace you last had open. Both are necessary for the product to work. Neither tracks you anywhere else.

• To provide Varynt Knowledge — the whole of your workspace content falls here.
• To send the notifications the product owes you — a mention, a reply to your comment, a page you are asked to acknowledge, or a page your team chose to send to everyone — by email and in the app.
• To answer you when you get in touch, and to support you when something is wrong.
• To invoice, and to keep the accounting records the law requires us to keep.
• To keep the service secure, and to investigate abuse.

We do not send marketing email to people who were added to a workspace. Being added to your colleague’s workspace is not consent to hear from us.

Your workspace content is held in a managed PostgreSQL database. Files attached to pages are kept in Varynt Knowledge’s own object storage — separate from the other Varynt products’ storage — and every download passes through the service, which checks you can still open that page before it hands over a single byte. There are no shareable file links that keep working after somebody loses access. A page an admin has chosen to share by public link can be read, with its images, by anybody holding that link until it is revoked.

We use a small number of service providers, and only these:

• An object storage provider — keeps the files attached to pages.
• Our hosting provider — runs the service and its database.
• Our email provider — delivering notification and invitation email.

Each is bound to use the data only to provide that service to us. We will keep this list current, and we will tell you before adding a provider that handles workspace content. If your data is processed outside your country, we put the appropriate safeguards in place for that transfer.

Some of this is automatic, and these are the windows the system enforces:

• Deleted pages — kept in the space’s trash for 30 days so they can be restored, then removed for good with their history, comments and attachments. A space admin can empty the trash sooner.
• Page views, by day — 400 days.
• Version history — the newest 50 versions of each page are kept; older ones are removed as new ones are published. While a space is under legal hold, every version is kept.
• Audit log — admin and security actions, kept for two years by default; on Enterprise a workspace admin can choose 90 days to seven years. Entries covered by a legal hold are kept until it is released.
• Unanswered searches — the words searched and the day, never who searched.
• Your workspace content — kept until you delete it or your workspace closes. While a legal hold covers it, nothing in it is destroyed.

When a workspace closes we keep it briefly so you can export or change your mind, then delete it. Backups age out on their own cycle afterwards. Records we must keep for tax or accounting reasons are kept for the period the law requires and nothing longer.

The measures worth naming, because they are the ones that decide whether a mistake becomes a breach:

• Every organisation’s data is isolated. A request naming an organisation you do not belong to is refused.
• Permissions are enforced by the API on every request, not by hiding controls in the browser. Search only returns pages you can open, and never returns drafts.
• A restricted space is limited to the people and groups named on it — workspace admins who are not named cannot read it either.
• Varynt Knowledge is for your staff: if you also use Varynt Work, its client-portal contacts cannot open Varynt Knowledge. A page leaves the company only through a public link, which is off until a workspace admin switches it on.
• Passwords are stored as one-way hashes. Traffic is encrypted in transit.

No system is perfect. If a breach affects your personal data we will tell you and the relevant authority without undue delay, and we will tell you what we know rather than waiting until we know everything.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to contact-knowledge@varynt.in and we will respond within 30 days.

If your request is about content inside a workspace — a page that mentions you, say — the organisation that runs that workspace decides, not us. We will point you to them and help them act on it. It is their data and we should not be editing it behind their back.

If you are unhappy with how we have handled a request, you can complain to your data protection authority. We would rather you told us first.

Varynt Knowledge is a tool for businesses and is not directed at children. We do not knowingly collect data about anyone under 18. If you believe a child’s data has ended up in a workspace, tell us and we will work with that organisation to remove it.

If we change how we handle personal data in a way that affects you, we will email the workspace owner before it takes effect and update the date at the top of this page. We will not quietly broaden what we do with data you have already given us.

Privacy questions: contact-knowledge@varynt.in. Anything else: the contact page. We are based in India.