Privacy Notice

This Notice explains how Varosync, Inc. collects, uses and protects personal information when you visit our website, use Fern™ and its variants, or interact with us.

1. Scope

This Notice covers information we handle to operate our sites and services, manage accounts, respond to enquiries, conduct business and maintain security. It also covers materials we share through a separate link and access code.

When an organization uses Fern, we process the documents, prompts, research and other content it provides on its behalf, under its customer agreement and any applicable data processing terms. The organization determines the purposes for that processing and the information its users may provide. Requests about personal information in that content should normally go to the organization; we assist it as required by our agreement and applicable law.

2. Personal information we collect

Accounts and business relationships

We collect the details you or your organization give us, such as your name, work email, role, organization, contact information, correspondence and preferences. For customers, we also keep agreement, procurement, billing, invoice and payment records.

For Fern accounts, we process invitations, roles, access permissions, sign-in methods and session records. We record sign-in attempts and session information, including IP address and browser. Passwords used for Fern sign-in are stored in hashed form. If your organization uses single sign-on, its identity provider supplies the information needed to authenticate you.

Work in Fern

We process the content users enter or upload, the files available through connected folders, and the analyses and other work created in the workspace. This may include personal information in documents or prompts. We also keep records of the actions needed to operate and secure the service, such as creating a case, sharing access, uploading or deleting a document, and running an analysis.

Customer documents belong in the authenticated workspace or another channel agreed with your organization. Public enquiry forms and payment pages are not intended for confidential files or sensitive personal information.

Website enquiries and booking

When you submit a contact or brochure form, we collect the fields you complete, including your name, work email, organization, industry, role and any description you provide. We store the submission and send it to our team using Resend.

We also record how you reached the site: the referring site without its query string, the page you first opened, and campaign tags such as utm_source or ref. If you allow Analytics, this can include the first and most recent visits that brought you here. Otherwise, it covers only the current visit. We do not keep advertising click identifiers.

Cloudflare Turnstile processes browser and connection information to check that forms are submitted by people. After submitting the contact form, you can book a call through Cal.com. We pass your name and email to the calendar so you do not have to enter them again. We do not pass along the description of your work.

Website use and cookie choices

Our systems receive technical information such as IP address, browser and device type, requested pages, referrer, time of access and security events. If you allow Analytics on varosync.com, Google Analytics measures site activity and Microsoft Clarity records interactions and session replays. Form content is masked for replay. These tools are not used to record work inside the signed-in Fern workspace.

When you make a cookie choice, we record a random consent identifier, your choice, the time and the versions of the wording and Cookie Notice shown. This consent record does not include your IP address. The identifier stored on your device links the record to your choice. The Cookie Notice gives the storage details and explains how to change your settings.

Shared materials

For materials opened through an access screen, we record the share, the time and version of the terms accepted, your IP address and browser. PostHog records viewing activity, including pages opened, clicks, scrolling, cursor movement, keyboard navigation and time spent, along with device information and approximate location derived from the IP address. Session replays let us review how the shared pages were used; text entered into form fields is masked.

This recording applies to the shared pages described on the access screen. The Shared Materials Terms explain the conditions for access. PostHog receives the events through our domain and processes them for us.

Other sources

We may receive contact and account information from your organization, a colleague, an event organizer or a referral. Public professional profiles and service providers may also supply information relevant to business communications, payment administration or account security.

3. How we use personal information

We use personal information to provide Fern and our other services, administer accounts and permissions, respond to enquiries, manage agreements and billing, provide support, and communicate with you. We also use it to understand website and shared-material use, maintain security, prevent misuse, meet legal obligations and handle disputes.

Where we send marketing communications, we do so as permitted by law and according to your preferences. Customer content is processed to deliver and support the service under the customer’s instructions. We do not use customer documents, prompts or work product to train or fine-tune AI models, publish research or perform another customer’s work.

Where a legal basis is required, we rely on performance of a contract, compliance with legal obligations, legitimate interests such as operating and protecting our business, or consent, as appropriate to the processing. Where we rely on consent, you may withdraw it.

4. How we disclose personal information

Information is available to personnel and advisers who need it for the purposes described here, and to service providers supporting those purposes. Your organization’s authorized administrators may receive account, membership and service-administration information. Workspace content is subject to the organization’s permissions and sharing settings.

Our providers include:

• Amazon Web Services for hosted Fern environments, storage, databases and infrastructure;
• Cloudflare for website and share hosting, traffic protection, Fern routing, the account-routing directory, and website enquiry and consent records;
• AI providers, including Anthropic, OpenAI and Google, for the processing enabled in Fern; which providers may receive customer content depends on the workspace’s policy and processing arrangements;
• Resend for website enquiry notifications and Cal.com for appointment booking;
• Google Analytics and Microsoft Clarity for website analytics when you allow that category; and
• PostHog for shared-material viewing records and session replays.

If your organization connects a document-storage or messaging service, that service also processes information needed for the connection. Folder connections access the locations authorized by your organization. Notifications sent to a connected messaging service are subject to that service’s terms and your organization’s settings.

Providers act under the applicable service and data-processing agreements. Relevant customer content may be sent to an authorized model provider to produce a response; that processing is distinct from model training. Your organization can request the current provider list and the processing and retention terms that apply to its deployment.

We may also disclose information where required by law, to protect rights or safety, to investigate misuse, or in connection with a financing, merger or sale under appropriate confidentiality restrictions.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use advertising pixels or session-replay tools in the signed-in Fern workspace.

5. Retention

We keep personal information for the purposes described in this Notice, subject to the following retention periods:

• Enquiries that do not lead to a customer relationship: 24 months after the last substantive interaction.
• Customer agreements and related procurement and administration records: the relationship plus seven years.
• Invoices, payments, tax and accounting records: seven years after the transaction, or longer if required by law.
• Authentication, access and security-event records: 12 months after creation, unless needed longer for an incident or legal claim.
• Shared-material session recordings: 30 days. Other shared-material usage and acceptance records: up to 12 months.
• Website cookie-choice records: 24 months after the choice expires or is replaced.
• Website submissions identified as automated: 90 days.
• Support and ordinary business communications: three years after the matter closes, unless part of a contract, dispute or legally required record.
• Marketing contacts: until you opt out or the information is no longer current. We retain the information needed to honor an opt-out.

Customer workspace content follows the customer agreement and configured retention policy. Copies in backups may remain until the backup period ends. Information may be kept longer where necessary for a legal obligation, legal hold, security investigation or legal claim. Cookie and browser-storage lifetimes are listed in the Cookie Notice.

6. Security

Fern uses separate organizational environments, encryption, individual accounts, access permissions, audit records and backups to protect customer information. The Security and Trust page describes these controls and the process for security review. No system can guarantee absolute security.

7. International processing

Varosync is based in the United States. Standard hosted Fern environments store customer content in the United States. Our providers may process information in the United States and other countries, depending on the service and the arrangements for your organization. Where applicable law requires safeguards for an international transfer, we use the required contractual or other lawful transfer mechanism.

8. Your choices and rights

You can unsubscribe from marketing emails using the link in the message and change website analytics choices through Cookie settings. Service, account, billing and security messages may still be necessary.

Depending on applicable law, you may ask to access or obtain a copy of your personal information, correct it, delete it, restrict or object to processing, or receive it in a portable form. You may withdraw consent where processing relies on it, without affecting processing already carried out.

Send requests to [email protected]. We may need to verify your identity or an agent’s authority. We respond within the period required by law, subject to applicable exceptions, and do not discriminate against you for exercising a privacy right. For information your organization holds in Fern, contact that organization so it can direct the request.

If local law allows an appeal, email us with “Privacy appeal” in the subject line. You may also complain to the data-protection authority or regulator with jurisdiction over you.

9. Children

Our sites and services are intended for business and professional use by adults. We do not knowingly collect personal information from children through them. Contact us if you believe a child has provided personal information.

10. Other sites

Third-party sites and services have their own privacy notices. A link from our site does not change how those parties handle information.

11. Changes to this Notice

We may update this Notice as our services and practices change. We will post the revised Notice, update its date and provide any additional notice required by law.

12. Contact

[email protected]
Varosync, Inc.
712 5th Avenue, New York, NY 10019