VARAPER / PRIVACY
Privacy Policy
Updated 17 October 2026
Mahsa Shaghaghi, personally operating VaraPer in Italy, is the data controller for the processing described here. For privacy questions, withdrawal of consent or rights requests, contact varaper.co@gmail.com.
This policy covers the VaraPer website, Early Access emails, optional analytics, form security, Reviews & Feedback and contact emails. The Cookie Policy explains browser storage. The separate Review Terms govern review submissions and content permission.
Early Access and Brevo emails
When you enter your email and select JOIN EARLY ACCESS, you request VaraPer product updates, early-access announcements and launch emails. We use your address for that specific marketing purpose with your consent under GDPR Article 6(1)(a). Joining is voluntary and is not required to browse the website. It does not sign you up for unrelated third-party marketing.
Brevo processes the subscription, VaraPer Early Access list membership, email delivery, bounces and unsubscribes on our behalf. Related records can include the signup time and source, subscription status and technical form information such as IP/browser details where collected by the service. The wording presented with the signup action explains the requested emails. The subscription form does not ask for health information.
You can unsubscribe at any time through the link in an email or by writing to varaper.co@gmail.com. Withdrawal does not affect processing that was lawful beforehand. Email consent is separate from review publication consent and optional website analytics.
Email opens and clicks
Brevo can measure opens using tracking pixels and clicks using individualised links. Its account configuration currently permits recipient-linked measurement; campaign settings may differ. Such measurement can reveal interaction with an email and associated technical information. The signup action and website analytics choice do not themselves obtain separate consent to email tracking or profiling. Measurement requiring additional consent must use an appropriate separate mechanism before use. You can contact us about your email data and preferences.
Google Analytics 4
We use Google Analytics 4 only with analytics consent, under Article 6(1)(a), to understand website use. GA4 does not load before you grant analytics consent. Without consent, the website does not load Google's analytics library. Accepting analytics allows Google to receive page, browser, device and usage information, including technical network information, and use analytics cookies.
A genuine accepted email submission can send a generic sign_up event when analytics consent is granted. Our custom signup event does not include your email, review content, CAPTCHA token, provider response or submission identifier. Advertising consent remains denied and Google signals and advertising-personalisation signals are disabled in our configuration.
Use Cookie settings to change or withdraw analytics consent. Rejecting analytics does not prevent subscribing, reading the website or using reviews. The Cookie Policy lists storage purposes and lifetimes. See also Google's Privacy Policy.
Invisible Cloudflare Turnstile and security
The subscription form uses Cloudflare Turnstile in Invisible mode to reduce automated spam. It runs in the background and verifies a token through Brevo. Cloudflare processes security signals such as IP address, browser/user-agent information, TLS characteristics and the site key/origin. Our basis for necessary, proportionate protection is our legitimate interest under Article 6(1)(f) in preventing abuse and protecting the service.
Cloudflare describes its processing for website protection and improvement of bot detection in the Cloudflare Turnstile Privacy Addendum, which supplements its Privacy Policy. Cloudflare acts as a processor for protecting customer websites and as a controller for improving Turnstile. These security checks are separate from optional GA4 analytics and do not add a marketing-consent checkbox. If a check prevents signup, contact us for help.
Website hosting and security services also process requests and technical logs needed to deliver pages, diagnose problems and prevent abuse. Review rate limiting uses a salted, short-lived IP-derived identifier; the review database does not store raw IP addresses for that purpose.
Reviews and optional media
The review service is for adults aged 18 or over. Only a star rating is required; written review text, a display name and one photo or video are optional. You can submit a rating without written text. We process the submission, reference, timestamps, moderation status and recorded consent/policy versions to receive feedback, moderate it and publish approved reviews. Voluntary processing and publication of identifiable review content and optional media rely on consent under Article 6(1)(a). Necessary security relies on legitimate interests. Applicable legal obligations support handling rights requests and required disclosures.
Reviews remain private until approved by Mahsa Shaghaghi, the initial sole moderator. There is no automatic approval or AI moderation. Approved reviews display the rating and date, any optional text provided, an optional name or “Anonymous”, and approved media. Only approved reviews contribute to displayed ratings and structured data. Content may still identify you without a name, and public content can be indexed or copied worldwide.
One JPEG, PNG, WebP, MP4 or WebM attachment of up to 20 MiB is accepted. Media is stored privately in Cloudflare R2 and exposed by the application only while the associated review is approved. Original filenames are not retained. Some photo metadata is removed, but complete removal is not guaranteed and video metadata may remain.
Please do not submit identifiable health information, medical records, X-rays, scans, prescriptions or other medical documents. The review form does not request separate consent for health-data processing, and identifiable health-information submissions must not be approved for publication. Content containing prohibited sensitive information may be rejected or removed. This service does not authorise public dissemination of health information or medical case studies.
Reviewing does not subscribe you to emails or transmit review content automatically to Brevo. Content permission under the Review Terms is separate from the GDPR basis for processing. To withdraw publication consent or request removal, contact us with your review reference if available. The moderation tools remove a whole review rather than editing its text or separately deleting an attachment. Removal cannot erase independent third-party copies.
Contact emails
If you email VaraPer, we process your address, message and information you choose to include to answer and follow up. Our basis is our legitimate interest under Article 6(1)(f) in answering enquiries and handling correspondence. A contact email does not automatically subscribe you to marketing. Please avoid sending unnecessary sensitive or medical information.
Processors, service providers and disclosures
We use Brevo for subscriptions and email delivery; Sites and Cloudflare services for website hosting, security, the D1 review database and R2 review media; Cloudflare Turnstile for anti-bot checks; Google for optional GA4 analytics; and the provider of our contact mailbox for correspondence. Providers receive the information needed for their service. Where they act as processors, processing is on our behalf; some providers also process technical/service data for their own purposes under their privacy notices, including Cloudflare's Turnstile purposes explained above.
Authorised service access is limited to operational needs. We may disclose information where legally required or necessary to handle a legal claim. We do not sell the Early Access mailing list or reuse review content for unrelated advertising through this service.
International transfers
Providers may process or access data outside Italy or the European Economic Area. Restricted transfers require a lawful transfer mechanism, such as an applicable adequacy decision or Standard Contractual Clauses with appropriate safeguards where needed. Processing is not represented as exclusively EU-based. Contact us for information about the provider arrangements relevant to your data and how to obtain applicable safeguards.
Retention
Active email subscriptions are retained while you wish to receive the stated updates and the mailing list serves that purpose. After unsubscribe, only records necessary to honour suppression, demonstrate subscription/withdrawal history, meet applicable obligations or address a specific claim are retained for that continuing purpose and relevant legal time limits.
Pending reviews become eligible for cleanup after 180 days and rejected reviews after 90 days. Cleanup runs during subsequent service activity rather than at a guaranteed deletion time. Approved reviews may remain while relevant to the product/review service, unless removed following withdrawal or another applicable reason. Deletion removes the review, media and associated application consent records, subject to successful completion; provider backups and logs can have separate retention arrangements. Rate-limit identifiers expire within approximately two hours.
Contact correspondence is kept for the enquiry and necessary follow-up, then only for relevant legal or dispute-handling needs. Consent preferences have 180-day logical validity; GA cookies have a configured 180-day expiry and may be renewed on use. The signup duplicate-prevention flag is held for the browser tab session. See the Cookie Policy. Technical logs and backups follow relevant provider arrangements rather than these browser-storage periods.
Your GDPR rights
Subject to the GDPR conditions, you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing, and withdraw consent without affecting earlier lawful processing. Contact varaper.co@gmail.com. For subscription requests, use the subscribed address; for reviews, include a reference if available. We may request proportionate verification and respond within applicable GDPR time limits.
You may complain to the Garante per la protezione dei dati personali or your competent supervisory authority. We do not use this subscription/review service for solely automated decisions producing legal or similarly significant effects. A technical anti-bot refusal is handled through the contact option above.
Policy updates
We update this notice when relevant processing changes. A new policy does not silently expand existing email-consent purposes or review reuse permissions. Where additional consent is required, it must be requested separately.