Consent-aware analytics
Explicitly connect your consent platform before recording exposure or outcome events. Pseudonymous identifiers are still data that must be handled according to your own product's obligations.
Visitor controls let authorized workspace users export or delete the selected visitor's recorded data. Retention is workspace configured and can range from one to 730 days. Shortening retention can remove data through the retention process.
AI connections
OAuth connections are limited to a selected workspace and chosen permissions. Access tokens expire after one hour. Refresh tokens rotate, expire after thirty days and cannot outlive a ninety-day connection. Revoke a connection at any time from Connections.
Tokens and authorization codes are stored as digests. The connection does not share your Varypilot password or Supabase sign-in session with ChatGPT, Claude or another client. Connected clients can read only the data and perform only the operations covered by their permission and your current role.
Operational records
Short-lived OAuth requests, action reviews and expired token records are pruned. Mutation retry records are kept for seven days. Connection records are removed one year after expiration or revocation. Workspace audit and billing retention follow the app's privacy and service terms.