Legal

Privacy Policy

Last updated: 2026-10-12

This Privacy Policy describes how EllisJaims Ltd, a company registered in England and Wales under company number 17150623, with registered office at 160 City Road, London EC1V 2NX, trading as VarsaAI ("VarsaAI", "we", "us"), collects, uses and protects information about users of VarsaAI Referencing.

This policy covers VarsaAI Referencing and the VarsaAI Referencing MCP connector only.

1. Information we collect

  • Account information — your Referencing account email address, name, workspace and role.
  • OAuth connections — the authorisation records created when you connect the MCP connector from an AI assistant.
  • Verification data — the claims you submit and the citations, evidence, verification reports, exports, receipts, sign-offs and shared links created from them.
  • Reference-library items — the sources, notes and tags you save in your workspace library.
  • Usage logs and connector request metadata — timestamps, tool name, run outcome and credit consumption.

2. How we use it

To verify claims and return citations, provide and secure the service, meter usage against your plan, respond to support requests and meet legal obligations. We do not sell personal data, and we do not use your claims, outputs or library content to train foundation models.

3. Evidence sources

To find evidence, we send search queries built from claim text to public scientific and regulatory databases: PubMed/NCBI, Europe PMC, openFDA/FDA and ClinicalTrials.gov. We send no account information to these sources.

4. Sub-processors

  • Microsoft Azure Cloud — hosting for the MCP connector, plus database, sign-in and storage.
  • Cloudflare — website hosting and content delivery.
  • Anthropic — evidence processing, where required.
  • OpenAI — embeddings for reference-library search.

5. Data retention

  • Usage logs: kept for 12 months.
  • Library items: kept until you delete them (soft-deleted for 30 days, then purged).
  • Verification reports, exports, receipts and sign-offs: kept for the life of the account unless you delete them sooner.
  • Account records: kept for the life of the account, then deleted within 90 days of closure.

6. Your controls

  • Delete library items and verifications from your workspace.
  • Revoke shared links at any time.
  • Disconnect the MCP connector from your AI assistant to end its access.
  • Request export or deletion of your data at support@varsaai.com.

7. Your rights (GDPR / CCPA)

You can request access to, export of, correction of or deletion of your personal data by emailing support@varsaai.com. We respond within 30 days.

8. Cookies

We use essential cookies for authentication and session management, and analytics cookies to understand overall product usage. You can control non-essential cookies in your browser.

9. International transfers

Data may be processed in the United States, the United Kingdom and the European Economic Area. Transfers rely on Standard Contractual Clauses or equivalent safeguards.

10. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Access is restricted per workspace, and access tokens are scoped and can be revoked.

11. Contact

EllisJaims Ltd (trading as VarsaAI), registered in England and Wales, company number 17150623, registered office at 160 City Road, London EC1V 2NX. Questions? Contact us at support@varsaai.com.