Effective Date: August 2, 2026
Last Updated: August 2, 2026
This Privacy Policy explains how NDAS Inc., a Delaware corporation located at 1881 Washington Avenue, Suite 12G, Miami Beach, Florida 33139 ("VaraFix," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with the VaraFix platform.
VaraFix is a business-to-business service for collision repair facilities. It is not directed to consumers or to the general public.
Understanding this distinction matters, because different rules apply to each.
Information about the repair facility that subscribes to VaraFix and the people who use it — business name, address, contact details, user names and email addresses, billing information, and how the Service is used. We act as the controller of this information.
Collision repair estimates routinely contain personal information about third parties who are not our customers — most commonly the vehicle owner. This can include names, addresses, telephone numbers, vehicle identification numbers, insurance claim numbers, and policy references.
We do not collect this information from the individuals it describes, and we have no relationship with them. It arrives inside documents uploaded by our customer. We process it solely on our customer's behalf, at their direction, for the purpose of delivering the Service to them. With respect to this information, our customer is the controller and VaraFix acts as a processor (or "service provider" under California law).
If you are a vehicle owner whose information may appear in an estimate, the repair facility that holds your file is the party responsible for that information. Please contact them directly. We will assist them in responding to your request. See Section 10.
Account and business information — business name, repair facility address or addresses, contact name, email address, telephone number, job title, and labor rate configuration.
User information — for each person invited to the account: name, email address, role, and location assignments.
Billing information — billing contact and address. Payment card details are collected and stored by Stripe, Inc., not by us. We receive only a payment token, the card brand, the last four digits, and the expiration date.
Uploaded documents — collision repair estimates and related documents you submit for review, including all information contained within them.
Questions and communications — questions submitted to Ask VaraFix, support requests, and other correspondence.
Usage data — pages viewed, features used, number of reviews and questions submitted, timestamps, and actions taken within the Service.
Technical data — IP address, browser type and version, operating system, device type, and referring page.
Authentication data — login timestamps, session information, and security events.
We do not knowingly collect information from anyone under 18. We do not sell personal information. We do not use tracking technologies to build advertising profiles or serve targeted advertising.
We use information to:
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
Please read this section carefully.
VaraFix uses artificial intelligence to read uploaded documents and to answer questions submitted through Ask VaraFix. To provide these features, the contents of uploaded documents and the text of submitted questions are transmitted to our AI provider, Anthropic, PBC, for processing.
We use Anthropic's commercial API under terms that provide that customer inputs and outputs are not used to train Anthropic's models.
Findings generated by artificial intelligence are recommendations for your review. They are not verified conclusions and should be independently confirmed before you rely on them.
We use the following providers to deliver the Service. Each receives only the information necessary to perform its function, and each is bound by contractual obligations regarding confidentiality and security.
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, backend functions | Account data, user data, uploaded documents, results |
| Vercel, Inc. | Application hosting and delivery | Technical and usage data |
| Anthropic, PBC | AI processing of documents and questions | Document contents, question text |
| Stripe, Inc. | Payment processing and subscription billing | Billing contact, payment method, transaction records |
| Resend | Transactional email delivery | Recipient email address, message contents |
| Webflow, Inc. | Marketing website hosting | Website visitor technical data, form submissions |
This list is current as of the effective date and may change. We will update this Policy when it does.
We disclose information only as follows:
a. To service providers, as described in Section 6, to deliver the Service.
b. Within your organization. Users on your account may see information belonging to the locations they are assigned to. Owners and administrators may see information across your entire organization. You control who is invited and what they can access.
c. For legal reasons. When required by law, subpoena, court order, or other legal process, or where we reasonably believe disclosure is necessary to protect rights, safety, or property, investigate fraud, or enforce our Terms.
d. In a business transaction. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the acquirer honoring this Policy or providing notice of any change.
e. With your direction or consent.
We do not sell personal information. We do not rent, trade, or share personal information with third parties for their own marketing purposes.
Account and business information is retained for as long as your account exists.
Uploaded documents and results are retained for as long as your account exists, including after cancellation. This is deliberate: cancelled customers retain read-only access to their complete history, because a supplement may arrive on a job billed months earlier.
Billing records are retained as required by tax and accounting obligations, generally seven years.
Usage and technical logs are retained for a limited period for security and diagnostic purposes.
You may request deletion of your account and its contents. See Section 10. Certain records may be retained where required by law or for legitimate business purposes such as fraud prevention and financial recordkeeping.
We maintain administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, location-scoped permissions, and audit logging.
Payment card data is handled entirely by Stripe, a PCI-DSS Level 1 certified provider. We never receive or store full card numbers.
No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials and for promptly removing access for users who leave your organization.
If we become aware of a breach affecting your information, we will notify you as required by applicable law.
You may access and update most account information directly within the Service. For anything not editable in the Service, contact support@varafix.com.
You may request deletion of your account and its contents by contacting support@varafix.com. We will respond within the time required by applicable law. Certain records may be retained where required by law.
If you are a California resident, you have the right to know what personal information we collect and how it is used, to request deletion or correction, to opt out of sale or sharing, and not to be discriminated against for exercising these rights.
We do not sell personal information and we do not share it for cross-context behavioral advertising.
To exercise these rights, contact support@varafix.com. We will verify your identity before responding.
If applicable to you, you may have rights of access, rectification, erasure, restriction, portability, and objection under the GDPR or UK GDPR. Contact support@varafix.com.
VaraFix is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.
If your personal information appears in an estimate uploaded to VaraFix, the repair facility holding your file is the party responsible for that information. Please direct your request to them. If you contact us directly, we will refer you to our customer and assist them in responding, as our agreement with them requires.
Transactional emails — account confirmations, invitations, billing notices, and service notifications — are part of the Service and cannot be disabled while your account is active. If we send optional communications, each will include an unsubscribe link.
Our marketing website and the Service use cookies and similar technologies that are necessary to operate them, including maintaining login sessions, remembering preferences, and securing the Service.
We do not use advertising cookies or third-party tracking for advertising purposes. Most browsers allow you to control cookies, but disabling them may prevent the Service from functioning.
The Service is not directed to individuals under 18 and we do not knowingly collect their information. If we learn we have collected such information, we will delete it. Contact support@varafix.com if you believe this has occurred.
We may update this Policy. Material changes will be communicated by email or by notice within the Service before taking effect. The "Last Updated" date above reflects the most recent revision. Continued use after a change takes effect constitutes acceptance.
NDAS Inc.
1881 Washington Avenue, Suite 12G
Miami Beach, Florida 33139
Privacy and support: support@varafix.com
Sales and organizations: sales@varafix.com