Privacy Policy
Effective 12 September 2026 · VARAi Trade Studio
VARAi Trade Studio is a business-to-business wholesale platform for eyewear brands and the optical retailers who buy from them. This policy describes what personal information we collect, why we collect it, who we share it with, and what you can ask us to do with it.
It covers trade.varai.ai and the services reached through it. VARAi is the data controller for that information. Write to privacy@varai.ai with any question about this policy or to exercise any right described below.
1. Who uses this platform
Trade Studio has two kinds of user, and the distinction matters for what we hold:
- Brand users — employees and sales representatives of an eyewear brand, who publish catalogues, take orders and book appointments.
- Retailer users — buyers and marketing staff at an optical practice or retail group, who browse a brand's catalogue and place wholesale orders.
Trade Studio is not a consumer service. We do not knowingly collect information from anyone under 16, and we do not sell personal information to anyone, for any purpose.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, work email, username, hashed password, role, and the brand or retailer you belong to | To authenticate you and to decide what you are allowed to see |
| Business records | Wholesale applications, orders, order line items, invoices, appointments and the notes attached to them | To operate the trading relationship between a brand and a retailer |
| Accounting connection | See section 3 | To create invoices in your own accounting system |
| Technical | IP address, browser user agent, timestamps, request paths, error traces | Security, abuse prevention, rate limiting and debugging |
| Communications | Email and SMS we send you, and whether delivery succeeded | To send invitations, verification links, order confirmations and appointment reminders |
We do not collect payment card numbers. We do not run advertising networks, third-party analytics trackers or cross-site profiling on this platform.
3. QuickBooks Online
A brand may connect its own QuickBooks Online company so that orders placed in Trade Studio become invoices in its own books. The connection is always initiated by the brand, and it can be severed at any time from the QuickBooks page in Trade Studio or from within QuickBooks itself.
What we request
We request a single OAuth 2.0 scope,
com.intuit.quickbooks.accounting. We request no payments scope,
no payroll scope, and no OpenID profile scope.
What we read and write
- Customers — we read and create customer records corresponding to the retail accounts that buy from the connected brand.
- Items — we read and create product items corresponding to the frames on the brand's wholesale catalogue.
- Invoices — we create invoices for orders and shipments recorded in Trade Studio, and read them back to confirm the write succeeded and to avoid creating a duplicate.
We do not read a connected company's bank feeds, payroll, chart of accounts, or any transaction that Trade Studio did not itself create, beyond what is needed to match the records listed above.
What we store on our side
- The QuickBooks company identifier (realm ID).
- OAuth access and refresh tokens, encrypted at rest, used only to make API calls on behalf of the brand that authorised them.
- The QuickBooks record identifiers of the customers, items and invoices we create, so that a later sync updates the same record rather than duplicating it.
When you disconnect
Disconnecting deletes the stored OAuth tokens immediately, and Trade Studio stops making any call to Intuit on that company's behalf. Invoices already created in your QuickBooks company are yours and remain there; we do not delete them. The stored QuickBooks record identifiers are removed with the connection.
Your use of QuickBooks Online is governed by your agreement with Intuit. This policy describes only what VARAi does with data reached through that connection.
4. Why we are allowed to process it
Where the UK GDPR or EU GDPR applies, we rely on: contract (operating the account and the trading relationship you asked for); legitimate interests (securing the platform, preventing abuse, and contacting business users about the service they use), balanced against your rights; and legal obligation (keeping records of transactions for the period tax law requires).
5. Who we share it with
We share personal information only with processors who help us run the service, each under contract and only for that purpose:
- Google Cloud Platform — hosting, database and file storage (United States).
- Intuit — only for brands that have connected QuickBooks Online, and only the records described in section 3.
- Email and SMS delivery providers — to deliver the messages described in section 2.
We also share information between the two sides of a trade where that is the whole point of the platform: a retailer who applies to a brand, places an order, or books an appointment is visible to that brand. A brand never sees another brand's retailers, catalogue or orders, and a retailer never sees another retailer's orders.
We do not sell personal information and we do not share it for cross-context behavioural advertising.
6. International transfers
Our infrastructure runs in Google Cloud's us-central1 region
in the United States. Where we transfer personal information out of the UK,
EEA or Switzerland, we rely on the European Commission's Standard Contractual
Clauses and the UK Addendum.
7. How long we keep it
- Account records — for as long as the account is active, then up to 12 months.
- Orders and invoices — seven years, to meet tax and accounting record-keeping obligations.
- Security and request logs — up to 90 days.
- QuickBooks OAuth tokens — deleted on disconnect, as described in section 3.
8. How we protect it
- TLS in transit; encryption at rest for the database and file storage.
- Application-level encryption for third-party credentials, including QuickBooks tokens.
- Passwords stored only as salted hashes, never in a recoverable form.
- Tenant isolation enforced in the application's authorisation layer, so one brand's data is not reachable from another brand's session.
- Rate limiting, multi-factor authentication for privileged accounts, and least-privilege service credentials.
No system is perfectly secure. If a breach affects your personal information we will notify you, and the relevant supervisory authority, as the law requires.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict our processing of your personal information, to object to processing based on legitimate interests, and to withdraw consent. California residents additionally have the rights to know, delete, correct and opt out of sale or sharing — we do not sell or share, so there is nothing to opt out of.
Email privacy@varai.ai. We respond within 30 days, and we will never treat you worse for exercising a right. If you are unhappy with our answer you may complain to your local data protection authority.
10. Cookies
We set a small number of strictly necessary cookies: an
httpOnly session cookie that keeps you signed in, and a CSRF
token. We set no advertising or analytics cookies. Blocking the session cookie
will prevent you from signing in.
11. Changes
If we change this policy materially we will update the effective date above and notify account holders by email before the change takes effect.
12. Contact
VARAi · privacy@varai.ai
Postal address available on request.