Privacy Policy

This policy explains what Deep Variance collects when you use deepvariance.com or Harvey, why we collect it, who else handles it, and how to have it deleted.

Who we are

Deep Variance Inc., a Delaware corporation at 447 Sutter St, Suite 506-1420, San Francisco, CA 94108, USA, runs deepvariance.com, provides Harvey, and is the controller of the personal data described here. When this policy says "we" or "us", that is who it means. Questions about this policy or your data: founders@deepvariance.com, or by post to the address above.

The short version

• The website sets no cookies that track you, and loads no Google Analytics, until you accept analytics in the cookie banner. Cookieless visit counts from Cloudflare run for everyone.
• We do not sell personal data, share it for advertising, or use it to train AI models.
• Harvey engagements are governed by a written agreement with each customer, and Harvey never reads training data, checkpoints or model weights.

When you visit deepvariance.com

Cloudflare hosts and delivers this site (Cloudflare Workers), and processes the technical data every web request carries, such as your IP address, browser type and the page requested, in order to serve the site and protect it from abuse.

We use Cloudflare Web Analytics to count visits and page views. It sets no cookies, stores nothing on your device, and does not track you across sites. It records aggregate figures such as the page visited, the referring site, the country, the browser type and page load performance.

If you accept analytics, we also use Google Analytics to measure aggregated usage: which pages are visited, how visitors arrive, the type of device, and the approximate region. IP anonymisation is on and advertising features are off. If you reject, nothing is loaded and no analytics cookie is set. The Cookie Policy lists every cookie and storage item by name.

When you email us or use a form

If you write to us, ask for early access or ask about a pilot, we keep your message, your email address and anything you choose to tell us, and use them to reply and to run the conversation or engagement.

The contact and feedback forms store what you type, the email address if you give one, and the country your request came from, in our own database on Cloudflare. We then email ourselves a copy through Azure Communication Services so that someone reads it. Nothing you send through a form is used for anything else.

Signing up to the newsletter stores your email address, the role you chose if any, the date and the country, which together are our record that you asked for it. We only send newsletters to people who signed up, and every one carries our postal address and an unsubscribe link, as well as the one-click unsubscribe your email app may show.

Harvey

Harvey verifies the GPU capacity a customer has bought or financed. Each engagement is governed by a written engagement letter or statement of work, which controls where it differs from this policy, except where data protection law gives you rights that cannot be changed by agreement. Harvey's collectors are read-only and write only to a local directory in the customer's environment, which the customer can inspect before anything leaves. They collect hardware and configuration identifiers, performance telemetry, benchmark and job timings, and system logs. Hostnames and IP addresses are tokenised when the evidence bundle is assembled, text is scanned for secrets, and Harvey never reads training data, checkpoints or model weights.

Harvey data is mostly about machines, not people. Business contact details of the people we work with are handled like any other correspondence. Where an engagement letter permits it, we keep normalised performance ratios, never raw traces, to compare clusters across engagements, and a customer can withdraw that permission for their engagement.

Why we use personal data

• To provide the website and Harvey, and to run the engagements we agree with you (performance of a contract).
• To keep the services secure, prevent abuse and fix problems (our legitimate interests).
• To measure how the website is used, only with your consent, which you can withdraw at any time.
• To reply to you and keep records we are required to keep, such as billing records (legitimate interests and legal obligations).
• To send the newsletter, only if you asked for it (consent, which you can withdraw with the link in every email).
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Who else handles it

We use a small number of service providers, each only for the service they provide to us:

Where data is processed

Deep Variance is based in the United States and our providers may process data in the United States and other countries. Where the law requires a safeguard for data transferred out of the EU, UK or Switzerland, we and our providers use the EU standard contractual clauses (with the UK addendum) or the provider’s certification under the EU-US Data Privacy Framework.

How long we keep it

• Email correspondence: for as long as the conversation or relationship is active, and then only as long as we reasonably need it.
• Contact and feedback form submissions: deleted automatically 24 months after we receive them.
• Newsletter sign-ups: until you unsubscribe. After that we keep your address and the dates you joined and left, so that we never email you again by mistake.
• Hosting and security logs: rotated every 60 days.
• Billing records: as long as tax and accounting law requires.
• Harvey engagement data: as set out in the engagement letter. Evidence behind an issued report is kept for the period that report can be relied on.
• Google Analytics data: under the data retention setting of our Google Analytics property.
• Cloudflare Web Analytics: aggregate figures with no identifiers, kept under Cloudflare’s retention for Web Analytics.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, delete it or restrict how we use it, object to how we use it, or ask for it in a portable form. Where we rely on consent, you can withdraw it at any time. Email founders@deepvariance.com and we will answer within 30 days. You may also complain to your local data protection authority.

California residents have the right to know, delete and correct personal information, and to be free from discrimination for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising. To make a request, email us, or have an authorized agent contact us with your written permission; we may ask for information to verify your identity.

Browsers can send Do Not Track signals. The website does not respond to them, but it loads no Google Analytics unless you accept it in the cookie banner.

Children

Our services are for professionals and are not directed to children under 16. We do not knowingly collect their personal data.

Security

We protect data with measures suited to what it is, including encryption in transit. No system is perfectly secure.

Changes

When this policy changes, the date at the top changes. For a material change we will also say so on the site at least 30 days before it takes effect, unless the law requires a change sooner.

Questions about this page:founders@deepvariance.com