Privacy Policy — Vara CRM

Vara CRM (“Vara”, “we”, “us”) is a customer relationship management service that helps sales teams capture, organise and follow up leads, including leads that come from Facebook and Instagram lead ads. The service is operated by Cozyland LLP.

This policy explains what information Vara processes, why, who can see it, and the choices you have. It applies to the Vara admin portal and the Vara service behind it. Vara is a business tool: accounts are created by an organisation's administrators (it is invite-only), and the organisation decides which leads and Facebook Pages are connected.

Where an organisation (our customer) uses Vara to manage its own leads, that organisation decides what lead data is collected and why, and Vara processes that data on its behalf. If you submitted a lead form and want to exercise rights over that data, you may also contact the organisation you gave it to.

Provided by users of Vara (our customers' team members)

• Account and profile information: name, email address, mobile number, status, assigned roles and teams, and a password (used for sign-in; handled by our backend).
• Content they create in the CRM: notes, tasks and follow-ups, tags, contacts, documents, activity and call outcomes, and changes to lead status.

Received through the Facebook / Instagram integration

• Facebook account identifier and display name of the person who authorised the connection, the permissions granted or declined, and the authorisation's status and expiry.
• Identifiers and names of the Facebook Pages, ad accounts and campaigns you connect.
• Lead Ads submissions: the lead's name, phone number, email address and any other answers on the form, plus identifiers and timestamps for the lead, Page, form, campaign, ad set and ad, and whether it came via Facebook or Instagram or was organic.
• Access tokens issued by Meta so Vara can act on your authorisation (see sections 4 and 7).

Generated by using the service

• A session cookie that keeps you signed in, and the records the CRM produces about leads (timeline, status history, assignments).
• Integration sync records (a log of inbound lead events, with status, retry count and error messages) used to show you whether a lead was imported.
• Technical information that our hosting and servers may process when you use the service (such as IP address, browser type and request logs), used for security and troubleshooting. The admin portal's own code does not include third-party advertising or analytics trackers.

We use information only to provide and run the service, specifically to:

• Import leads from connected Facebook Pages and forms into the CRM.
• Display and organise lead information for authorised users in your organisation.
• Support sales workflows: assigning leads to projects and people, follow-ups, status tracking and reporting.
• Maintain the Facebook and Instagram integration, including showing connection health and retrying failed imports.
• Provide support and troubleshoot problems.
• Secure, maintain and improve the service, and prevent misuse.
• Meet legal obligations.

An authorised member of your organisation can connect Vara to Facebook using Facebook Login for Business. Vara then processes only what the permissions granted allow. Vara may request some or all of these permissions: pages_show_list, pages_read_engagement, pages_manage_metadata, leads_retrieval, ads_management, pages_manage_ads, business_management and ads_read. They are used to list the Pages you can connect, subscribe those Pages to lead notifications, read lead-form submissions, and read the ad and campaign details attached to leads.

• What you grant and configure decides what is accessed. Some permissions are optional; without them some details (for example campaign names) may be missing.
• Lead information is used to provide the CRM functionality you asked for, as described in section 3, and for nothing unrelated to your authorisation or this policy.
• Vara does not read or send Instagram or Messenger messages and does not publish content to Facebook or Instagram. It reads lead-form submissions and related ad metadata.

Revoking access. You can disconnect a Facebook authorisation or a single Page in Vara (Integrations), or remove Vara from your Facebook settings under Business Integrations. These are two different actions. Disconnecting a Page tries to unsubscribe that Page from Meta lead notifications (if Meta does not confirm this, the Page is still disconnected) and deletes its stored Page access token; the Page's mappings, sync records and imported leads are kept. Disconnecting a Facebook authorisation deletes the stored user token. Pages connected through that authorisation are only disconnected too if you choose that option, and in that case Vara also asks Meta to remove its grant (skipped if the same Facebook user is still connected in another organisation). Neither action deletes leads already imported; see section 10.

Depending on where you are, we process information because:

• it is necessary to provide the service you or your organisation requested;
• you or your organisation authorised it, for example by connecting a Facebook Page, or the lead agreed when submitting a lead form;
• it serves our legitimate interests in operating, securing and improving the service, where these are not outweighed by your rights; and
• we must comply with a legal obligation.

Our customers are responsible for having a lawful basis, and any notices and consents required, for the leads they collect and manage in Vara.

We share personal information only:

• With service providers that help us run Vara, namely cloud hosting and infrastructure for the admin portal (Vercel) and for our backend service and database, under their terms and only to provide those services;
• With Meta, as part of the integration you set up (for example, subscribing a Page to lead notifications or retrieving a lead from Meta);
• Within your organisation: users with the right permissions can see the leads and projects they are given access to; and
• Where required by law, legal process or to protect rights, safety and the security of the service.

We use these safeguards:

• Access is by password sign-in; accounts are created by an administrator.
• Every request is checked by our backend, which enforces permissions and keeps each organisation's data separate.
• Your session token is kept in an HTTP-only cookie that page scripts cannot read, and production traffic uses encrypted (HTTPS) connections.
• Meta access tokens are kept by our backend in encrypted form and are never sent to your browser.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If you believe your account or data has been compromised, contact us immediately at info@cozyland.in.

We keep information for as long as reasonably necessary to provide the service, meet contractual obligations, support legitimate operational needs and comply with applicable law. We have not set a fixed retention period that applies to all data.

• Meta access tokens are removed when the authorisation or Page is disconnected.
• Imported leads, mappings and sync records are kept when an integration is disconnected, so that history is preserved and a reconnection resumes where it left off, until they are deleted as described in section 10.
• Some notes, tasks, contacts, documents and tags can be deleted by authorised users inside Vara. Information may also remain in backups or logs for a period after deletion; we have not set a fixed period.

Depending on where you live, you may have the right to access, correct or delete your personal information, to withdraw an authorisation or consent, to object to or restrict certain processing, and to receive a copy of your data. To exercise these rights, write to info@cozyland.in. We may need to verify your identity first. If we hold your data on behalf of an organisation, we may direct your request to that organisation. You may also lodge a complaint with your local data protection authority.

You can ask us to delete information associated with your Facebook or Instagram integration, including lead data that came from Meta.

1. Identify the Vara organisation, the connected Facebook Page(s) or authorisation, and the email address or name on your Vara account (or, if you are a lead, the name, phone number or email you submitted).
2. Email info@cozyland.in with the subject “Meta data deletion request”, stating that you want your Meta-related data deleted, with enough detail to locate it.
3. We will verify the request where necessary and process it in line with applicable law and any retention we are legally required to keep. Requests are handled manually, and we have not set a fixed completion timeframe.

Three different actions

• Disconnecting Meta access (done by you in Vara or in Facebook settings) stops new leads from the disconnected Pages and deletes the stored access token. It does not delete leads already imported.
• Deleting imported lead data is not available as a self-service feature in the portal. Our team handles such requests manually, outside the portal's normal screens, and will tell you what can be removed and what must be retained.
• Your Vara account. An administrator can deactivate your account in the portal. Erasing the account's personal details is handled manually on request and is separate from the other two.

Deletion requests are processed manually by our team; there is no self-service deletion button. Vara does not currently run an automated Meta deauthorisation or data-deletion callback. Removing Vara in your Facebook settings does not by itself delete data held in Vara, so please send a request as described above.

Vara is a business tool for sales teams and is not directed at children. We do not knowingly collect personal information from children. If you believe a child's information has been submitted through a lead form connected to Vara, contact us at info@cozyland.in and we will take appropriate steps.

Information may be processed in countries other than the one you live in, including where our hosting providers and Meta operate. Where the law requires, we rely on appropriate safeguards for such transfers. We do not state that your data stays in any particular country.

We may update this policy. When we do, we change the “last updated” date above, and for material changes we will give notice, for example by email to account administrators or a notice in the service. Continued use after the effective date means the updated policy applies.

Cozyland LLP is responsible for this policy. For any privacy question or request, contact: info@cozyland.in