How data is protected
What is stored, who can read it and how it can be deleted at any time.
This is a translation for reference. The Spanish version is the governing text.
Data controller
The controller of the personal data of accounts is Varsel, run by Cristian Inostroza Bustos. Any question or request is received at soporte@varsel.cl.
In short
- Data is used only to calculate the analysis of whoever uploads it. It is not sold, not shared and not used for anything else.
- The model trained on that data is stored encrypted with the data itself. Without the original file nobody can read it, not even the site administrator.
- Everything can be deleted at any time with Delete my data, in the app's side menu.
During calculation
- Using the workspace requires signing in with a Google account.
- While a forecast is being calculated, the file is read in the server's memory. That copy is deleted automatically after 6 hours of inactivity, or immediately with Delete my data.
- The trained model is stored encrypted with a key derived from the data itself. The key is not stored anywhere, so the model can only be opened with the same file. That is why, when a job is reopened, the forecast appears instantly.
- Delete my data also removes that model. The next time, it is trained again.
Saved work
- Analyses are saved in My forecasts together with the file, which is stored encrypted, so they can be reopened without uploading it again.
- Everything is stored inside the team's workspace. A job marked «Only me» is visible only to whoever saved it; a shared one is visible to the team members, who sign in with their Google account and the Company ID. The workspace administrator can remove anyone and generate a new Company ID. The site administrator does not review user data.
- Team chat messages are stored in the company's room and can only be read by its members, from the company space. Anyone who leaves the company stops seeing them. Attachments (up to 10 MB each) are kept in a private company folder and opened with links that expire in 5 minutes. Each person can delete their own messages and the administrator can delete any of them; deleting a message deletes its file, and closing the company deletes them all.
- Each open analysis is tied to the account that created it, so nobody else can open it even if they know its identifier.
- The theme, colors and background chosen in the settings are saved with the account.
- Each analysis can be deleted from My forecasts. It stays in the trash for 30 days, where it can be restored or deleted permanently, and is then removed with its file, the model, the scenarios and the live data.
- From Google sign-in, only the name and email are used.
- If sales are brought in from Bsale, access is used only to read sales, stock and branches; Varsel does not create or modify anything in Bsale. By default it is not stored. With the «Stay connected» option, access is stored encrypted to update the analysis and is deleted with Disconnect in the workspace's Saved connections or with Delete my data.
- With WooCommerce, Shopify or Mercado Libre, access is used only to read orders, products and stock; Varsel does not create or modify anything in the store. Keys follow the same rule: by default they are not stored, and with «Stay connected» they remain encrypted until Disconnect or Delete my data.
- With the stock alert on, stock is read every morning through that connection and, if a product crosses its reorder point, a notice is sent only to the email of the account that turned it on. For that, the analysis's current forecast is stored with it. The alert is turned off in the same analysis.
Personal key (optional)
With an account, analyses in My forecasts can be protected with a key known only to their owner. Files are encrypted with it and nobody else can read them, not even the site administrator. The key is not stored anywhere: if it is forgotten, protected analyses cannot be recovered and the data must be uploaded again. Protected analyses are also not updated automatically through a link or the API, because the site cannot read them without the key.
AI advisor
When a question is asked to the advisor, the site sends a summary of the analysis figures to Anthropic, the provider of the language model, to generate the answer. Under its commercial terms, that information is not used to train its models. Anyone who prefers not to send their figures can simply not use the advisor; the rest of the site works the same.
Usage statistics
To know how many people use the site, visits, page views, forecasts generated and questions to the advisor are counted, using an anonymous fingerprint that does not identify anyone. No data from the files is included in these statistics. To limit free questions, a daily counter is kept with an anonymous fingerprint of the IP address; the address itself is not stored. On public pages, such as the home page, Product and Solutions, Google Analytics is also used to count visits in aggregate: which pages are viewed, from which country and on what type of device. It is not used inside the workspace and does not receive analysis data.
Where the site runs
The public site is served from Vercel. The application and models run on Hugging Face servers, and saved analyses and encrypted models are stored in Supabase. All communication is encrypted (HTTPS).
What personal data is processed and why
- Account: Google name and email, to sign in, save analyses and send any alerts that are turned on. Basis: providing the service requested when signing in.
- Team: emails of the people added to a workspace and their role, to give the team access. They are added by the workspace administrator.
- Team chat messages and files: for the company's internal conversation.
- Contact: name, email and message from the form, only to reply.
- Site usage: counters with anonymous fingerprints, to measure usage and prevent abuse.
Data is not sold or used for advertising. No automated decisions are made about people: forecasts are calculated on products and sales.
Data inside the files
Sales histories usually contain dates, products and quantities, with no personal data. If a file or connection includes personal data of third parties, such as customer names, the company that uploads it is responsible for it and Varsel processes it only on its behalf and to calculate its analysis. Uploading only the columns needed for the forecast is recommended.
How long each item is kept
- File during calculation: in server memory for up to 6 hours of inactivity, or until Delete my data.
- Encrypted model: until Delete my data; it cannot be opened without the original file.
- Saved analyses, files and scenarios: while the account exists or until they are deleted; deleted items stay in the trash for 30 days and are then removed.
- Connections with Bsale or stores: only with «Stay connected», until Disconnect or Delete my data.
- Team chat: until each message is deleted or the company is closed.
- Sign-in attempts with a Company ID: an anonymous fingerprint deleted the next day.
- Session: the sign-in cookie expires after 8 hours.
Providers and data outside Chile
To operate, the site uses providers that may store or process data outside Chile, mainly in the United States: Vercel (website), Hugging Face (forecast calculation), Supabase (database and files), Anthropic (AI advisor, only with the figures summary described above), Google (sign-in and visit statistics for public pages) and the email service that sends alerts. Each receives only what is needed for its part of the service.
Data rights
Anyone can request access to their data, its correction, deletion or portability, or the blocking of its processing, and object to it, by writing to soporte@varsel.cl from the account email. The reply is given within the time limits set by law. If the reply is not satisfactory, a complaint can be filed with Chile's Personal Data Protection Agency.
Security and incidents
Access keys to the database and providers live only on the servers, never in the browser. Saved connections and models are encrypted, and the database does not allow reads from outside the server. If an incident affecting personal data occurred, affected people and the authority would be informed as required.
This policy may be updated; relevant changes are announced on the site. Last updated: November 9, 2026.
Questions or deletion requests: soporte@varsel.cl.