Varduno Privacy Policy
Effective date: September 13, 2026
1. Who is responsible
Varduno is operated by Carl Gunnar Daniel Thunberg, a sole proprietor carrying on business as Varduno in Ontario, Canada. “Varduno”, “we”, “us”, and “our” refer to that operator.
This policy covers varduno.com, app.varduno.com, and the equipment-planning services offered through them.
Privacy contact: Carl Gunnar Daniel Thunberg 446 Cloverdale Road, Ottawa, Ontario K1M 0Y6, Canada Email: privacy@varduno.com
2. Information we collect and why
We collect information you provide, information generated when you use the service, and information supplied through connections you authorize.
| Information | Purpose |
|---|---|
| Contact details, organization details, and enquiry or demo-request messages | Respond to enquiries and manage our relationship with prospective customers |
| Account identifiers, email address, profile details, authentication and permission information | Create accounts, authenticate users, and manage access |
| Project details, site information, equipment requirements, schedules, workforce contacts, uploaded documents, rate cards, and other content you enter | Provide planning, collaboration, document processing, and related service features |
| Supplier contacts, requests for quotation, quotations, and communications | Facilitate the supplier workflows you initiate |
| Billing details, subscription identifiers, invoice summaries, amounts, and payment status | Administer paid plans where available, reconcile payments, and maintain business records |
| Prompts, relevant documents or records, AI responses, and connector requests | Provide requested AI assistance and authorized external AI access |
| IP addresses, device and browser information, request logs, activity records, and cookie or similar identifiers | Operate and secure the service, diagnose problems, and, where enabled with the appropriate choices, measure website use |
Please provide only information needed for your use of Varduno. Do not include unnecessary sensitive personal information in project documents, prompts, or requests sent to suppliers.
3. Accounts and organization workspaces
Authentication takes place through app.varduno.com using Base44. Where offered, you may use email and password or a supported sign-in provider such as Google, Microsoft, Facebook, or Apple. The chosen provider may supply identity and profile information according to the permissions displayed during sign-in. Using a sign-in provider does not itself grant Varduno access to all information in that provider account.
If you use an organization workspace, authorized administrators and collaborators may access information according to their roles. For personal information an organization uploads about employees, contractors, or other people, that organization determines its business purposes and must have authority to provide it. We process that information to deliver the service and assist with applicable privacy requests.
4. Service providers and sharing
We disclose information needed to deliver the relevant function to these providers and recipients:
- OpenAI Sites: marketing-site hosting and its associated delivery and visitor technologies.
- Cloudflare: DNS, delivery and security services, and Zaraz tag and consent management.
- Base44: application hosting, authentication, database and file services, backend processing, and built-in AI functions.
- HubSpot: information submitted through marketing-site lead forms and related lead management. Any optional visitor tracking must be reflected in the cookie settings.
- Stripe: payment processing and subscription administration when paid checkout is available. Payment details submitted to Stripe are processed by Stripe; Varduno receives the billing and subscription information needed to administer the service.
- Google Analytics: website usage information when analytics is enabled in accordance with your consent choices. We do not intentionally send names, email addresses, or private project content as analytics events.
- Sign-in providers: identity-related information required for your selected sign-in method.
- AI providers and clients: as explained below.
- People and organizations you share with: collaborators, suppliers, and other recipients of requests, documents, or information you choose to send through Varduno.
Some providers also process information for their own purposes, such as payment fraud prevention or management of an account you hold directly with them. Their privacy notices apply to those activities.
We may disclose information where legally required, to protect rights and security, or in connection with a lawful business transfer. Any transfer remains subject to applicable privacy obligations, including notice or consent where required.
5. AI processing and external AI connections
Built-in AI features send relevant inputs to Base44's AI infrastructure. For example, equipment searches may include your requirements and relevant catalogue information, while document extraction may process the document you select. Base44 identifies OpenAI, Anthropic, and Google among its possible AI providers; the provider used for a particular request can depend on the service configuration.
Varduno uses Base44's Elite plan. Base44's published documentation states that data from non-Enterprise workspaces can be used for AI training; its automatic exclusion applies to Enterprise workspaces. We therefore do not promise that information supplied through Varduno is excluded from training. Consider this before uploading confidential documents or personal information to the service or using built-in AI. Provider processing is subject to the applicable Base44 agreements and settings.
You may separately authorize a supported external AI client, such as ChatGPT, Claude, or Cursor, to connect to Varduno. This connection uses an authorization flow. The client can request information or perform available actions within the access you grant and your Varduno permissions. Information returned to that client is processed under the provider's terms and your account settings, including its retention and training rules.
Review the requested access before connecting. To withdraw access, use the available connection controls or contact us for assistance. Revoking access does not automatically delete information already received by the external provider; use that provider's controls or contact it separately.
6. International processing
Information may be stored or processed outside Ontario and Canada, including in the United States, by our service providers. Foreign courts, law-enforcement bodies, or other authorities may be able to access information under their laws. We remain responsible for information under our control and use appropriate contractual and organizational measures when arranging processing.
Varduno's Base44 application data is stored in the United States. This does not mean all processing by every connected provider is limited to that country.
7. Cookies, analytics, and communications
Our Cookie Notice explains cookies and similar technologies and the available choices. On the marketing site, Cookie Settings controls Google Analytics through Cloudflare Zaraz. The HubSpot enquiry form is loaded separately when you choose to load it. The Base44 application also uses platform activity logs and Mixpanel-related browser storage which are not controlled by the marketing-site banner. Session recording has been disabled. See the Cookie Notice for the scope and limitations of the available controls.
Submitting an enquiry allows us to respond to that enquiry. Promotional email choices are separate from acceptance of the Terms of Service. You can unsubscribe from promotional messages using their unsubscribe mechanism or by contacting us. Necessary account, security, and billing messages may still be sent.
8. Retention and security
We retain personal information only as long as reasonably necessary for the purposes described here, including providing the service, resolving disputes, meeting legal and accounting obligations, and maintaining security. Different records may require different retention periods. Our policy is to delete or anonymize information no longer needed, subject to applicable obligations and provider backup cycles.
Our retention decisions use the following criteria:
- Enquiries: whether the enquiry remains open, a related customer relationship continues, or the correspondence is needed to resolve a complaint or document a transaction.
- Account and project information: whether the workspace is active, its authorized administrator still needs the information, or a closure, export, deletion request, or dispute remains unresolved.
- Billing records: applicable tax, accounting, transaction-dispute, and other legal recordkeeping requirements.
- Security and activity records: the time needed to investigate incidents, prevent abuse, and resolve service problems, subject to provider retention controls.
- AI information: whether it is saved as part of a project or conversation and the applicable processing and retention rules of Base44 and any connected provider. Deleting a local copy does not necessarily delete a provider's copy or reverse prior training.
Account cancellation does not automatically erase project data. Contact privacy@varduno.com to request account or project deletion. We review the records involved, any legal reasons for retention, and the deletion controls available from our providers. We cannot promise immediate removal from provider backups or a fixed provider-wide deletion interval; we will explain relevant limitations when responding to your request.
We use safeguards appropriate to the information and risks, including access controls and provider security measures. No system can guarantee absolute security. Contact us promptly if you suspect unauthorized access to your account.
9. Your choices and rights
You may contact us to request access to or correction of your personal information, withdraw consent where applicable, or request deletion. We may need to verify your identity and clarify the request. Legal requirements, the rights of others, and legitimate recordkeeping needs may limit what can be deleted. Withdrawing information necessary to deliver a feature may prevent us from providing that feature.
If your information is held in another organization's workspace, we may coordinate with its authorized administrator. We respond within the time required by applicable law and explain any permitted refusal or extension.
Contact the privacy contact above with concerns. You may also contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/ or another privacy regulator with jurisdiction.
10. Intended users and updates
Varduno is intended for business equipment planning, not for children. If you believe a child has supplied personal information, contact us.
We will update this policy as our practices change and revise the effective date. We will provide additional notice and obtain consent for new purposes where required. Incorporating Varduno later will require an appropriate update to the operator information and any necessary transfer arrangements.