Privacy Policy
Varavil ยท Last updated 7 November 2026
This policy explains what Varavil does with information. It is written to be read. If anything here is unclear, write to us (section 14) and we will explain.
1. Who we are
Varavil is operated by Bharanikumar Ganesan (registered business name GANESAN BHARANIKUMAR, trading as Varavil), No. 13, Plot No. 288, Devi Seemathaman Nagar, Pallavan Nagar Extension, Maduravoyal, Chennai 600095, Tamil Nadu, India ("we", "us"). For your account information we are the party that decides why and how it is used. For the personal data inside your books (your own customers, suppliers and staff) you decide why and how it is used, and we store it for you.
2. The short version
- Your books (your customers, invoices, bills, entries, notes, settings and the record of every change) are stored on Varavil's servers: Google Cloud's Firestore database in Mumbai, India. That is how you can open the same books from any device you sign in on.
- Your data is encrypted in transit and at rest by Google. Google holds the keys, and we add no encryption layer of our own. This means that Varavil's administrators are technically able to open your books. We do not look at them, except to fix a problem you ask us to look into or where the law requires it.
- Each company's books are kept apart from every other customer's by rules the database enforces, and only people with access to the company can open it. We test this with automated attempts to get into one company from another.
- We also hold your account (your email address and sign-in details), the date your trial began and, once you have one, your plan.
- Varavil never sends a message to your customers. It drafts; you send, from your own WhatsApp, phone or email. It never files a return for anyone.
- Varavil sends you two kinds of email: account emails (verifying your address, resetting a password) and, unless you turn it off in Settings, one morning email saying who needs a follow-up. To write that email, our server reads your company's follow-up lists (quotations and enquiries) and their settings once a day, together with your plan and your sign-in address. The email carries only customer names, quotation numbers, amounts, the follow-up step and dates, and a link to Varavil: no phone numbers and no message text. Only the owner can turn it off (Settings, Follow-ups), and nothing is sent on a quiet day.
- There are no analytics, advertising, tracking pixels, external fonts or chat widgets in the app, and no cookies for tracking. (Varavil uses Google's reCAPTCHA Enterprise through Firebase App Check to check that a request comes from a real browser. It is for security only, and is listed in section 6.)
3. Where your books are, and how they are protected
| What | Where | Protected by |
|---|---|---|
| Your books and the record of every change | Google Cloud Firestore, Mumbai (asia-south1), in Varavil's own Firebase project | Encryption in transit (HTTPS) and at rest by Google; database rules that allow only the people with access to that company, with a verified email; sign-in with a password or Google |
| Backups | The same project | Daily backups kept for 14 weeks, and recovery to any minute of the last 7 days. They exist so we can recover the service from our own fault or a disaster |
| A file you drop in to import | Read in your browser; the books made from it are saved to the server | The file itself is not kept |
| The working copy while you use the app | Your browser's memory only | It is gone when you close the page. Varavil does not save your books in your browser's storage |
| A download you make ("Download all my books", the Workbook) | Wherever you save it | Not encrypted. It is a readable copy of your books: keep it somewhere safe |
You choose a password for your account, not a passphrase for your books. If you forget your password you reset it by email, so you cannot lose your books by forgetting something. The other side of that is that anyone who gets into your account can open your books: use a long password that you use nowhere else, or sign in with Google.
4. What we hold, and why
Your account
When you create an account we hold:
- your email address, and whether you have verified it;
- your sign-in details. If you sign in with a password, Firebase stores it in a scrambled (hashed) form and we never see it. If you sign in with Google, Google tells us your email address and that it is verified; we do not receive your Google password;
- the date your free trial began, so that starting again with the same account does not restart the trial (a single date, created once and never changed);
- your plan and licence dates, once you have a licence.
We use this to let you sign in, to make sure the email is yours, to operate the trial and licences, and to contact you about your account. We do not use it for advertising and we do not sell it.
Your books
Whatever you and your users enter or import: customer and supplier names and contact details, GSTINs, invoices, bills, income and expenses, vouchers, accounts, schedules, notes, outcomes and settings, and the audit trail of changes with who made them and when. We hold this to give you the service you asked for, and for no other purpose. We do not use it for advertising and we do not sell it.
Licences
A licence is a short piece of text sent to you after payment. It contains your email address, your plan and its dates. It is checked in your browser; the check sends nothing anywhere.
Payments
You pay online through Razorpay, our payment provider. The payment window is Razorpay's: your card, UPI or bank details are typed there and go to Razorpay, not to us. We send Razorpay the order (the amount and the plan, and a reference that identifies your company) and your account email, so that the window is filled in and the payment can be matched. Razorpay tells us the payment id and whether the payment succeeded. Razorpay handles what you give it under its own terms and privacy policy.
We keep a record of each payment (which company, the plan, the amount, the date, and the Razorpay order and payment ids) for accounts and tax. We do not see or store your card or bank details.
API keys (if the owner makes one)
The owner of a company can make an API key so the company's own website or tool can read its follow-up lists and send in new enquiries, quotations and customers. We keep the key's name, a one-way hash of the key (never the key itself), what it may do, any expiry or address limit, and when it was made and last used. We keep a log of each call to the API (the time, which key, the address called and the result, never what was sent) for 30 days, so the owner can see what has happened. To stop people guessing keys, we keep a one-way hash of the address of a caller that sends wrong keys, for a short time. What a key sends in waits in an inbox until a person who can write the company's books takes it in or throws it away.
Information sent when you use the app
Like any website, when your browser downloads Varavil the hosting provider (Google Firebase Hosting) sees ordinary web-request information such as your IP address and browser type. Google's sign-in and database services see the same when you sign in and when your books are saved or opened. We do not add tracking to this.
5. Who can see your books
- You. Today each company is opened by the person who created it. Adding other people (your staff, your accountant or CA) is being built. When it is available, only the people you add can open the company, with the role you give them, and you can remove them.
- Varavil's administrators are technically able to open the database, as section 2 says. We do not look at your books, except to fix a problem you ask us to look into or where the law requires it. Access to our cloud project is limited to the owner and protected by two-step sign-in.
- Google, as the company that runs the database for us, as section 6 says.
- Anyone the law requires us to tell, if an order or the law requires it.
6. Who else is involved
| Who | What for | What they see |
|---|---|---|
| Google (Firebase Authentication, Firebase Hosting, Firestore) | Sign-in, serving the app, storing your account and your books | Your email, sign-in events, ordinary web-request data, and your books (encrypted at rest by Google). Our database is in Mumbai (asia-south1) |
| Google reCAPTCHA Enterprise (Firebase App Check) | Checking that a request to our database comes from the real Varavil app in a real browser, not from a script. Used for security only | Your browser and device signals that reCAPTCHA uses to score the request (for example, browser details and how the page is used), but not your books |
| Google (sign-in with Google, if you choose it) | Letting you sign in with your Google account | That you signed in to Varavil |
| Resend (email delivery), only for the morning email, unless you turn it off | Delivering that one email to you | Your sign-in email address, and the email itself: your company name, and the names, quotation numbers, amounts, follow-up steps and dates of the people due that day. Resend is an email service outside India and keeps delivery records under its own terms and privacy policy |
| Razorpay (our payment provider), only when you choose to pay online | Taking payment | Your card, UPI or bank details (typed in Razorpay's window), your account email, the amount and plan, and a reference to your company |
| WhatsApp or your email program, only when you click "Open in WhatsApp" or "Open in email" | Opening your own app with the draft ready | The message text, in your own account. If the record has a mobile number or email address, your app opens a chat with that person; otherwise you choose who it goes to. Either way you press send, and Varavil never sends it |
We do not share your information with anyone else, except where the law requires it.
7. The optional AI tier
There is no AI feature today. If one is ever added it will be off by default, will need your explicit consent, will replace customer names with stand-ins before anything is sent, and will keep nothing afterwards. This policy will be updated before it exists.
8. How long we keep things
- Your account details: while your account exists, and for the period the law requires for accounts and tax records after that.
- Your books and the audit trail: while your account exists. You can download a readable copy at any time. If you ask us to delete your account, we delete your books from the live database, and the copies in our backups are gone when those backups expire, within 14 weeks. You are responsible for keeping the accounting records the law requires of your business, so download a copy before you ask us to delete.
- Payment records: as long as the law requires for accounting and tax.
- API logs and waiting records: the log of API calls is kept for 30 days. A record sent in through the API waits until it is taken in or thrown away. A revoked key is kept (its name and hash, no secret) so the log still makes sense.
- Morning emails: we keep a record that one was sent (the company and the date, never its content) for about two months. Resend keeps its own delivery records under its own policy.
9. Your rights
You may ask us to: tell you what we hold about you; correct it; delete your account; and explain how it is used. You may also withdraw consent you have given and you may complain (section 14). To use any of these, write to us. We will reply within 30 days. To delete your account, write to us from the email address on the account.
For the personal data in your books, your own customers' rights are against you. If one of them writes to us about your books, we will pass it to you and help you answer.
10. Things you should know
- Varavil needs an internet connection to open and save your books. A change is not on another device until it has been saved.
- If two people change the same record at once, the second save is refused with a message to reload, so that nobody's work is silently overwritten.
- Anyone using your signed-in computer can see what the app shows. Sign out when you step away: Varavil does not sign you out by itself yet.
- The service can be interrupted. We do not promise it will always be available: it depends on Google's services.
- Notes you type about your customers are personal data about them. You are responsible for how you use them and for telling your customers what you keep, as the law requires of you.
- Messages you send go through your own WhatsApp, phone or email, under their own terms.
11. Security
We protect your books with the controls Google's services provide and with database rules that let each person reach only their own company. No system is perfectly secure; our security notes say plainly what is and is not protected.
12. Children
Varavil is for businesses and is not meant for anyone under 18. We do not knowingly create accounts for children.
13. Cookies and similar storage
Varavil uses no tracking or advertising cookies. Your browser's own storage holds the sign-in token (so you stay signed in), a copy of the app's files (so it opens quickly), and small preferences such as which menu sections are open. It does not hold your books.
14. Contact and complaints
For anything about this policy or your information, including a complaint:
Varavil, No. 13, Plot No. 288, Devi Seemathaman Nagar, Pallavan Nagar Extension, Maduravoyal, Chennai 600095, Tamil Nadu, India
Email: Varavilsupport@gmail.com
If we do not resolve your complaint you may also approach the authority that the law provides for in India.
15. Changes to this policy
If we change this policy in a way that matters (for example if the AI tier is ever added), we will tell you in the app and by email before the change takes effect. The date at the top shows when it was last updated.
16. Books you saved in this browser before 29 October 2026
Before this date Varavil saved books in your browser, encrypted with a passphrase. Those books are not on our servers and we have never held them. If you have some, the app still lets you open them and download them, and you can then bring the information into your books on the server. Until you delete them, they stay in that browser, protected by the passphrase you chose.
Start your 30-day free trial No card needed.