Privacy

Who we are

Vivari operates from Cyprus, in the EU, which means the GDPR and Cyprus's ePrivacy law (Law 112(I)/2004) apply to everything below natively — not as a courtesy. For anything privacy-related, including exercising the rights described further down, write to hello@vivari.ai. A person reads that inbox.

What we collect when you request early access

The early-access form is the only place on this site that asks you for anything. Only your email is required — that's the lead, and how we reach you at launch. We also note which page you signed up from.

If you fill in the optional application, we also keep what you chose to tell us: roughly how big your team is, which tools you already use, what you plan to build first, and how you'd like to be notified. A phone number is stored only if you tick the explicit SMS-consent box — without it, the number is dropped on our server and never written anywhere. If you take the Stranger Test and choose to attach it, your score travels with your lead so our follow-up is relevant. All of this rests on your consent, and all of it is skippable.

A hidden honeypot field catches bots. If it's filled in, we discard the whole submission — it is never written to storage. Alongside your submission we also record the timestamp, your browser's user-agent string, and the referring page, purely to catch abusive or malformed submissions; that pair rides on our legitimate interest in keeping the form clean, not on your consent.

What we observe without a form

This site runs Vercel Web Analytics. It sets no cookie, reads nothing already on your device, and identifies visits with an anonymized hash that rotates daily — not a persistent ID we could tie back to you. It records aggregate interaction events — things like "requested early access" or "completed the Stranger Test" — as counts, never the content you typed. This rests on our legitimate interest in knowing whether the site works, not on consent — see the next section for why.

Cookies and local storage

We store exactly one thing on your device today: a localStorage flag named vivari-motion that remembers whether you've asked for reduced motion — strictly necessary, no banner or consent required under ePrivacy Art. 5(3). We set no advertising or marketing cookies, and no third-party fingerprinting script runs on this site. Why that's true, and what changes the day it isn't, is its own page: see the cookie policy for the full breakdown, including exactly which cookies GA4 and Clarity would set if either is ever switched on.

Who processes it on our behalf

We keep the list of hands touching your data short on purpose.

• Vercel — hosts this site, runs the early-access form's serverless function, and provides the cookieless Web Analytics described above.
• Upstash — the Redis database where your early-access lead record actually lives.
• An internal notification webhook (e.g. a private Discord or Slack channel), when configured — mirrors new leads so our small team notices them promptly. It receives the same lead fields as Upstash and is bound by the same rules in this policy.

Not active yet, named here so nothing arrives unannounced: Resend, for transactional email once we send any; Google Analytics (GA4) and Microsoft Clarity, both gated behind the consent banner described above the moment either is switched on. None of these run today.

Vercel and Upstash are US-headquartered and may process data on infrastructure outside the EU/EEA. Where that happens, it relies on the Standard Contractual Clauses or equivalent GDPR-approved safeguards their processing agreements provide.

How long we keep it

Your early-access lead record — email and everything attached to it — is kept until launch plus twelve months, or until you ask us to delete it, whichever comes first. The anti-abuse timestamp/user-agent/referer trail lives alongside it under the same clock. Server console logs are ephemeral and follow Vercel's own short, plan-dependent log retention; they are not a second copy of your data, just a debugging trail. Vercel Web Analytics keeps aggregate counts, not anything identifiable back to a raw record.

Your rights

Under the GDPR you can ask us to let you access what we hold on you, correct it, erase it, hand it to you in a portable format, or object to how we're using it — and you can withdraw consent at any point, exactly as easily as you gave it. Email hello@vivari.ai for any of these. An erasure request means we delete your lead record outright — from Upstash, from any internal notification mirror, everywhere. You also have the right to lodge a complaint with your national data protection authority — in Cyprus, the Office of the Commissioner for Personal Data Protection — if you think we've gotten this wrong.

California visitors

The same facts hold under the CCPA/CPRA: we do not sell personal information, and we do not share it for cross-context behavioral advertising, so no "Do Not Sell or Share" link is legally required — we're stating it anyway. You can ask to know or delete what we hold the same way as above, and where your browser sends the Global Privacy Control signal, we treat it as an opt-out of analytics and marketing by default.

Children

This site is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a minor gave us information, email hello@vivari.ai and we'll remove it.

Changes to this policy

We'll update the effective date above whenever this page changes, and call out anything material — a new sub-processor, a new tracker, a new lawful basis — in the section it belongs to rather than burying it in a changelog. This version is effective July 1, 2026.