This Privacy Policy explains how OGP LABS PTE. LTD. ("Variotype," "we," "us," or "our") collects, uses, stores, and shares personal data when you use Variotype and related websites, applications, and services (the "Service"). By using the Service, you acknowledge that your information will be handled as described in this Privacy Policy.

1. Who We Are

Variotype is operated by OGP LABS PTE. LTD., a company based in Singapore. If you have questions about this Privacy Policy or our data practices, you can contact us at [email protected], [email protected], or [email protected].

2. Scope of This Policy

This Privacy Policy applies to personal data we collect from users, visitors, customers, and workspace members in connection with the Service. It covers information collected directly from you, automatically through your use of the Service, and from certain third parties such as payment providers or authentication providers.

3. Information We Collect

We may collect the following categories of information:

Account information, such as your name, email address, hashed login credentials, account settings, and authentication details.
Profile information, such as avatar or organization details if you choose to provide them.
Workspace and collaboration data, including workspace membership, roles, project access, and content shared with other workspace members.
Prompt and project data, including prompts, instructions, project descriptions, chat messages, generated prototypes, code, outputs, and related edits or iterations.
Files and attachments you upload, such as images, documents, PDFs, and other materials submitted through the Service.
Usage data, such as model selections, generation settings, timestamps, AI credit usage, actions taken in the Service, and feature interactions.
Billing and transaction data, such as subscription status, plan type, invoice history, payment status, top-ups, and AI credit balance and usage. Payment card details are processed by Stripe (PCI-DSS compliant) and are not stored by us.
Technical and device data, such as IP address, browser type, device information, operating system, session information, and diagnostic or log data.

What We Do Not Collect or Do

We want to be transparent about what we do not do:

We do not sell your personal data to anyone.
We do not use advertising cookies or tracking pixels.
We do not train our own AI models on your data.
We do not share your prompts, files, or content with third parties for advertising or marketing purposes.
We do not engage in cross-context behavioral advertising.

4. How We Collect Information

Directly from you when you sign up, use the Service, create projects, chat with models, upload files, purchase subscriptions or credits, contact us, or otherwise submit information.
Automatically when you use the Service, through logs, authentication systems, and essential cookies or similar technologies required for functionality.
From third parties, such as payment processors, authentication providers, and infrastructure providers that support operation of the Service.

5. How We Use Information

We use personal data for the following purposes:

To provide, operate, maintain, and improve the Service.
To create and manage accounts, workspaces, and user access.
To process prompts, files, and instructions and transmit them to AI model providers in order to generate prototypes, chats, outputs, and related results.
To provide billing, subscriptions, AI credit allocations, pay-as-you-go usage, credit top-ups, invoices, and account support.
To enforce usage limits, plan rules, security controls, and fraud or abuse prevention measures.
To communicate with you about your account, transactions, updates, security matters, and support requests.
To comply with legal obligations, enforce our terms, and protect our rights, users, and the Service.

6. AI Model Providers and External Processing

A core part of the Service requires us to send your prompts, instructions, messages, uploaded files, and related request data to third-party AI model providers through OpenRouter and, depending on the model selected or made available, potentially to underlying model providers. This may include providers such as OpenAI, Anthropic, Google, Meta, Mistral, xAI, DeepSeek, Cohere, Microsoft, Alibaba, AI21, 01.AI, and others made available through OpenRouter or the Service.

We do not train our own models on your data. We also configure OpenRouter to route requests only to model providers that do not use your content to train or improve their AI models (see our Subprocessors list). However, third-party providers may have their own terms, privacy practices, retention policies, and operational controls. We are not responsible for the privacy, security, retention, or processing practices of third-party AI providers, OpenRouter, or other external services. You should review their terms and privacy policies before using the Service. Because your content is sent to external providers to fulfill your request, you should not submit sensitive personal data, confidential information, trade secrets, or other highly sensitive material unless you are comfortable doing so.

If you add your own AI provider API key, we store it encrypted and use it only on your behalf, to send your own requests to the provider you chose (including OpenRouter); we never use it for anyone else, and you can remove it at any time.

7. Workspaces, Sharing, and Visibility

If you use the Service as part of a workspace, other workspace members may be able to view projects, prompts, prototypes, files, chats, and related content within that workspace depending on their role and permissions. Workspace owners and administrators may manage membership and access.

If you create or enable a public sharing link, the content associated with that link may be accessible to anyone who has the link. You are responsible for deciding what you share publicly and for revoking share links when no longer needed.

8. Payments, Subscriptions, and AI Credits

When you purchase a subscription, pay-as-you-go usage, or AI credit top-up, we and our payment providers may process billing and transaction information necessary to complete and administer the transaction. Subscription plans may include a monthly allocation of AI Credits that resets each billing cycle and does not roll over. Top-up or purchased AI Credits do not expire unless otherwise stated. We may maintain records of subscriptions, invoices, payment status, and credit usage for accounting, support, fraud prevention, and legal compliance purposes.

9. Cookies and Similar Technologies

We use essential cookies and similar technologies necessary to operate the Service, such as maintaining sessions, authentication, security, and core product functionality. We may also use local storage or similar technologies for user preferences and product functionality. With your consent, we also use analytics cookies and similar technologies to understand how the Service is used and to improve it. Where required by law, we will ask for your consent before setting non-essential analytics cookies, and you can withdraw your consent at any time through our cookie settings. We do not use advertising cookies or tracking pixels, and we do not sell personal data for cross-context behavioral advertising.

10. How We Share Information

We may share personal data in the following circumstances: For a current list of our sub-processors, please see our Subprocessors page.

With AI model providers via OpenRouter, as described in Section 6.
With infrastructure and operational sub-processors, including Supabase (database and authentication), our hosting providers, Stripe (payments), Google (OAuth authentication), and our transactional email provider.
With other users in your workspace or with anyone who has a public share link, depending on how you use the Service.
With professional advisors, auditors, insurers, or legal judge where reasonably necessary.
When required by law, regulation, legal process, or governmental request.
To protect rights, safety, security, property, users, the public, or the Service.
In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction.

We publish anonymous, aggregate statistics about how AI models perform, based on votes cast in Variotype. These never identify you or your projects.

11. Data Retention

We retain personal data for as long as reasonably necessary to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days of the deletion request, except where we are required or permitted to retain it for longer. Billing, tax, and accounting records are retained for at least 5 years to comply with Singapore Companies Act and IRAS requirements. Fraud-prevention, security, and legal compliance records may be retained for longer where required or permitted by law. We may also retain limited backup or archival copies for a reasonable period before they are overwritten.

12. Data Security

We use reasonable technical and organizational measures designed to protect personal data, including: encryption in transit using HTTPS/TLS; encryption at rest for stored data; hashed and salted password storage; access controls and authentication on internal systems; and reliance on PCI-DSS compliant payment processing through Stripe. While we take these measures seriously, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authorities without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with the EU General Data Protection Regulation (GDPR). We will also notify the Personal Data Protection Commission of Singapore (PDPC) and affected individuals as required under Singapore's Personal Data Protection Act (PDPA). Where the breach is likely to result in a high risk to affected individuals, we will notify them directly without undue delay.

13. International Data Transfers

Your information may be processed and stored in countries other than your own, including the United States and other jurisdictions where our service providers and AI model providers operate. These countries may have data protection laws that differ from those in your jurisdiction. For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms where required.

14. Your Rights and Choices

Depending on where you live, you may have rights regarding your personal data, such as the right to access, correct, delete, restrict, object to certain processing, or request portability of your information. You may also have the right to withdraw consent where processing is based on consent.

If you are located in the European Economic Area, United Kingdom, or Switzerland, our lawful bases for processing your personal data under the GDPR include: (a) performance of a contract with you to provide the Service; (b) our legitimate interests in operating, securing, and improving the Service; (c) compliance with legal obligations; and (d) your consent where applicable. You also have the right to lodge a complaint with your local data protection supervisory authority.

If you are located in Singapore, you have rights under the Personal Data Protection Act (PDPA), including rights of access and correction, and you may lodge a complaint with the Personal Data Protection Commission (PDPC).

You can contact us at [email protected] to make a request. We may need to verify your identity before fulfilling your request, and some rights may be limited by applicable law.

15. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal data from anyone under the age of 18. You must be at least 18 years old to create an account and use the Service. If you believe a person under 18 has provided personal data to us, please contact us at [email protected] so we can review and take appropriate action, including deleting the account and associated data.

16. Third-Party Services and Links

The Service may integrate with or link to third-party services. Their privacy practices are governed by their own policies, not this Privacy Policy. We are not responsible for the content, security, or privacy practices of third-party services.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we may notify you by email, through the Service, or by updating the effective date above. Your continued use of the Service after the updated Privacy Policy becomes effective means the updated version will apply to your use of the Service.

18. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our privacy practices, contact OGP LABS PTE. LTD. at [email protected], [email protected], or [email protected].