Privacy Policy

1. Information We Collect

A. Information you provide to us

• Account and profile data: name, email address, phone number, delivery addresses, password, language preferences, and profile settings.
• Waitlist and inquiry data: if you join our waitlist or contact us as a prospective customer, merchant partner, or investor, the contact and business information you submit.
• Order data: items purchased, order history, dietary or preference selections you choose to save, delivery instructions, tips, and communications with merchants, couriers, or support.
• Payment data: payment card details are collected and processed by our PCI-DSS-compliant payment processor, Stripe. VORA receives limited data such as card brand, last four digits, and transaction status we do not store full card numbers.
• Communications: messages, reviews, ratings, survey responses, and support conversations.
• Merchant and courier data: business name, tax information (e.g., Form W-9), licenses and permits, bank payout details (collected via Stripe), and identity-verification information, where applicable.

B. Information collected automatically

• Device and usage data: IP address, device identifiers, browser and operating-system type, app version, pages viewed, features used, referring URLs, and crash logs.
• Location data: approximate location derived from your IP address; precise geolocation from your device only if you grant permission (used for delivery addresses, ETAs, and service-area checks). You can disable precise location at any time in your device settings.
• Cookies and similar technologies: we use strictly necessary cookies and a privacy-focused, cookieless analytics service. We do not use third-party advertising or targeting cookies. See our Cookie Policy for details.

C. Information from other sources

• Merchants and couriers: order status, delivery confirmations, and fulfillment details.
• Service providers: fraud-prevention, payment, and identity-verification signals from our payment processor and security vendors.
• Publicly available sources, where lawful (for example, verifying a merchant's business license status).

2. How We Use Personal Information

• Provide, operate, and improve the Platform, including processing orders, payments, deliveries, refunds, and support;
• Connect you with merchants and couriers and share the information needed to fulfill your orders;
• Personalize your experience, including culturally relevant product discovery and recommendations;
• Communicate with you about your orders and account (transactional messages), and with your consent where required by law send marketing communications, which you can opt out of at any time;
• Conduct analytics, research, and product development, including improving our logistics, forecasting, and discovery systems, using de-identified or aggregated data where feasible;
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
• Comply with legal obligations (tax, accounting, food-safety cooperation, lawful requests); and
• Protect the rights, safety, and property of VORA, our users, merchants, couriers, and the public.

3. How We Disclose Personal Information

• Merchants and couriers, to fulfill your orders (e.g., your first name, order contents, delivery address and instructions);
• Service providers acting on our behalf under contract payment processing (Stripe), cloud hosting, analytics, communications and customer-support tools, and fraud prevention who may use the information only to provide services to us;
• Corporate transactions: in connection with a merger, financing, acquisition, or sale of assets, subject to standard safeguards;
• Legal and safety: to comply with law, respond to lawful requests, enforce our Terms, or protect rights, safety, and property; and
• With your direction or consent.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral (targeted) advertising. If our practices change, we will update this Policy and provide the notices and opt-out mechanisms required by law including a "Do Not Sell or Share" opt-out and recognition of Global Privacy Control signals before any such practice begins. See our Do Not Sell or Share My Personal Information page.

4. Data Retention

We retain personal information for as long as needed for the purposes described above, including to maintain your account, comply with legal obligations (e.g., tax and transaction records), resolve disputes, and enforce agreements. Retention periods vary by data type; when data is no longer needed, we delete or de-identify it. Order and payment records are typically retained for the period required by tax and accounting law.

5. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and monitoring. No system is completely secure; please protect your account credentials and notify us of any suspected unauthorized access. In the event of a data breach affecting your personal information, we will notify you and regulators as required by applicable law, including Florida's Information Protection Act (Fla. Stat. § 501.171).

6. Your Privacy Rights and Choices

A. Choices available to everyone

• Marketing opt-out: use the unsubscribe link in any marketing email or reply STOP to any marketing text; transactional messages about your orders will continue.
• Push notifications and precise location: manage these in your device settings.
• Account information: review and update your profile in the app, or contact us.

B. U.S. state privacy rights

Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Texas, Oregon, and others), and subject to applicable thresholds and exemptions, you may have the right to:

1. Know / access the personal information we hold about you;
2. Correct inaccurate personal information;
3. Delete your personal information;
4. Portability obtain a copy in a usable format;
5. Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling noting that VORA does not currently sell or share personal information or engage in such advertising or profiling; and
6. Limit the use of sensitive personal information noting that we do not use or disclose sensitive personal information for purposes that would trigger this right.

We will not discriminate against you for exercising any of these rights.

How to submit a request: email privacy@tryvora.app from the email address associated with your account (or include enough information for us to verify your identity, such as your name and the phone number or addresses on your account). We will verify your identity, respond within the time required by law (generally 45 days, extendable with notice), and explain the basis for any denial. Appeals: if we deny your request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state Attorney General. Authorized agents: you may use an authorized agent to submit requests on your behalf with proof of authorization.

C. California notice at collection (CCPA/CPRA)

For California residents: we collect the categories of personal information described in Section 1: identifiers; customer records; commercial information; internet or other electronic network activity; geolocation data; audio/electronic information (support communications); and professional information for merchant and courier contacts. The sources, purposes, and disclosure categories are described in Sections 1–3, and retention is described in Section 4. In the preceding 12 months, we have not sold personal information and have not shared personal information for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes requiring a "Right to Limit" notice. We disclose personal information to service providers for business purposes as described in Section 3.

7. Children's Privacy

The Platform is intended for adults 18 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at privacy@tryvora.app and we will delete it as required by COPPA and applicable law.

8. Third-Party Links and Services

The Platform may contain links to third-party sites and services (including merchant sites and Stripe's payment interface). Their privacy practices are governed by their own policies, which we encourage you to review.

9. International Users and Data Transfers

The Platform is operated from the United States and is currently intended for U.S. users. If you access the Platform from outside the U.S., you understand your information will be processed in the United States. If we expand to other countries in the future, we will provide region-specific privacy disclosures and implement lawful transfer mechanisms as required by the laws of those regions.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, provide additional notice (such as email or in-app notice). Your continued use after the effective date constitutes acknowledgment of the updated Policy.

11. Contact Us