Privacy Policy
Last updated: 28 September 2026
1. Who we are
Vario is a WooCommerce variation management tool that provides a spreadsheet interface for editing product variations. The Service is operated by WP Butler, established in Denmark, in the European Union.
For the personal data described in this policy, we are the data controller as defined by the EU General Data Protection Regulation (GDPR). Where we process product data from your WooCommerce store on your behalf, we act as a data processor and you are the controller.
You can reach us about anything in this policy at info@getwebbed.dk.
2. What data we collect
We try to collect as little as possible. Here is the complete list:
- Account data: your email address, your name (if you provide one), and a hash of your password. We never store your password in readable form – it is hashed with bcrypt and cannot be reversed.
- Store connection data: the URL of your WooCommerce store and the name you give the connection.
- WooCommerce API credentials: the consumer key and consumer secret issued by your store. These are encrypted at rest with AES-256-GCM before they are written to our database.
- Cached product and variation data: product names, variation attributes, SKUs, prices, sale prices, stock quantities and stock status, synced from your store so the spreadsheet can be shown and searched quickly.
- Saved views and change history: the grid layouts you save, and a record of the edits you save through Vario (which field of which product or variation changed, and its old and new value), so you can review and undo them.
- Subscription data: your plan, subscription status and a customer reference from our payment provider. We do not store card numbers – we never see them.
- Password reset requests: when you ask to reset a forgotten password, we email you a single-use link that expires after 60 minutes. We store only a one-way hash of the secret in that link, never the link itself.
- Technical and usage data: server logs (IP address, timestamp, requested URL, error messages) and basic product usage such as when a sync last ran. Logs exist so we can keep the Service secure and working. Your IP address is also used, only in memory and for a short time, to slow down repeated sign-in, sign-up and password reset attempts.
- Website analytics: on our public pages only (such as the home page and the demo), a cookieless analytics tool counts page views and clicks on sign-up buttons. See section 9.
We do not collect customer data, order data, or payment data from your WooCommerce store, and we do not buy personal data from third parties.
3. Why we process it, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account data | Creating your account, signing you in, service emails | Performance of a contract (Art. 6(1)(b)) |
| Store URL & API credentials | Connecting to your store so you can read and edit variations | Performance of a contract (Art. 6(1)(b)) |
| Cached product data | Showing, filtering and editing the spreadsheet without re-querying your store | Performance of a contract (Art. 6(1)(b)) |
| Subscription data | Billing, invoicing and plan limits | Performance of a contract and legal obligation (Art. 6(1)(b), 6(1)(c)) |
| Saved views & change history | Restoring your grid layouts, reviewing and undoing your edits | Performance of a contract (Art. 6(1)(b)) |
| Logs & security data | Keeping the Service available, debugging, preventing abuse | Legitimate interests (Art. 6(1)(f)) |
| Website analytics (public pages) | Understanding which pages of our website are useful, in aggregate | Legitimate interests (Art. 6(1)(f)) |
| Product update emails | Telling you about new features, if you opt in | Consent (Art. 6(1)(a)) – withdrawable at any time |
We do not use your data for automated decision-making or profiling, and we do not sell it to anyone.
4. How your API credentials are protected
Your WooCommerce consumer key and secret are the most sensitive thing you give us, so we treat them accordingly:
- They are encrypted at rest using AES-256-GCM, an authenticated encryption scheme.
- The encryption key is held in the application environment, not in the database, so a database dump on its own does not reveal your credentials.
- They are decrypted only in memory, only for the duration of a request you triggered.
- They are never shown back to you in full after the connection is made, never written to logs, and never shared with third parties.
- All traffic to Vario and from Vario to your store runs over HTTPS.
Vario only changes your store when you ask it to – when you save changes you have reviewed. It reads from your store when you run a sync and, to keep your product data current, may run a read-only refresh on a schedule a few times a day. If you turn on live updates, your store notifies Vario about product changes itself. See our Security page for the full technical picture.
5. Sub-processors
We use a small number of service providers to run Vario. They process data only on our instructions and are bound by data processing agreements:
- Our hosting and database provider – runs the application and stores the data described above. Servers are located in the EU/EEA.
- Polar – handles subscriptions, payments and invoicing. Polar receives your email address and billing details. Card details go directly to Polar and its payment partners; they never pass through Vario.
- Our transactional email provider – delivers account emails such as password reset links, and receives your email address and the email’s content for that purpose.
Where a sub-processor transfers data outside the EU/EEA, that transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision. We will tell you before adding a new sub-processor that materially changes how your data is handled.
6. How long we keep data
- Account and store connection data: for as long as your account exists.
- Cached product and variation data: for as long as the store connection exists. It is overwritten on each sync, and deleted immediately when you disconnect the store.
- API credentials: deleted immediately when you disconnect the store or delete your account.
- Password reset links: the stored hash is removed by a regular clean-up once the link has expired, and a new request immediately replaces any older unused link.
- Server logs: kept for a short period (normally up to 30 days) and then deleted.
- Invoices and accounting records: retained for five years after the end of the financial year, as required by the Danish Bookkeeping Act.
Inactive free accounts may be deleted after a long period of inactivity. We will email you first.
7. Deleting your data
You can delete your account at any time from your account settings (you confirm with your password). Deleting your account removes your account record, your store connections, your encrypted API credentials, your saved views, your change history and all cached product and variation data. Any active Vario Pro subscription is canceled with our payment provider at the same time, so you are not charged again, and Vario removes the webhooks it registered in your store when the store can be reached. Backups containing the deleted data are rotated out within 30 days.
Deleting your Vario account does not revoke the API key inside your WooCommerce store. We recommend also deleting the key under WooCommerce → Settings → Advanced → REST API so it can never be used again.
Deleting your Vario account never changes or deletes anything in your store. Your products and variations stay exactly as they are.
8. Your rights under the GDPR
If you are in the EU/EEA, you have the right to:
- Access – get a copy of the personal data we hold about you.
- Rectification – have inaccurate data corrected.
- Erasure – have your data deleted (“the right to be forgotten”).
- Restriction – ask us to pause processing while a dispute is resolved.
- Portability – receive your data in a structured, machine-readable format, or have it sent to another provider.
- Objection – object to processing based on our legitimate interests.
- Withdraw consent – at any time, where processing is based on consent. This does not affect processing that already happened.
You can use the rights of access and portability yourself at any time: Settings → Your data → Export my data downloads a copy of your profile, store connections, saved views and change history as a JSON file. You can correct your name and email and delete your account in Settings too.
For anything else, write to info@getwebbed.dk and we will respond within one month. Exercising your rights is free.
If you are not satisfied with how we handle your data, you can complain to the Danish Data Protection Agency, Datatilsynet (Carl Jacobsens Vej 35, 2500 Valby, Denmark – datatilsynet.dk), or to the supervisory authority in your own country.
9. Cookies
Vario uses cookies that are strictly necessary to run the Service: a session cookie that keeps you signed in, and a security cookie that protects against cross-site request forgery. These do not require consent under the ePrivacy rules because the Service cannot work without them.
On our public website pages (such as the home page and the demo) we use a privacy-friendly analytics tool that we run ourselves. It does not set cookies, does not store your IP address and does not build a profile of you; it only counts page views and clicks on sign-up buttons in aggregate. It is never loaded on the pages you use while signed in.
Fonts are served from Vario’s own servers, so your browser does not contact Google Fonts or any other font service. We do not use advertising cookies, and we do not embed third-party trackers on the pages you use while signed in.
10. Data breaches
If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet within 72 hours of becoming aware of it, and notify you without undue delay where the risk is high. If the breach could have exposed store credentials, we will tell you which connections are affected so you can revoke the keys in WooCommerce.
11. Children
Vario is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.
12. Changes to this policy
We may update this Privacy Policy as the Service evolves. The “Last updated” date at the top always reflects the current version. If a change materially affects how we handle your data, we will notify you by email or inside the Service before it takes effect.
13. Contact
Questions, requests, or complaints about privacy? Email info@getwebbed.dk and a human will read it.