Privacy notice

Last updated: 10 November 2026

This notice explains what personal data Voro HQ collects, why, who sees it and what you can do about it. We have kept it short and plain. If anything is unclear, write to us at support@vorohq.com.

You can ask for this notice in Hindi or any other language in the Eighth Schedule to the Constitution of India by writing to grievance@vorohq.com.

Who we are

Voro HQ is run by Voro Ventures Private Limited, CIN U62099DC2026PTC475687, registered office 603-604, Bhutani Alphathum, Sector 90, Noida, Uttar Pradesh-201305, India.

• For your account data (your name, email, sign-ins and billing), we decide how it is used. We are the Data Fiduciary under India's Digital Personal Data Protection Act 2023 (DPDP Act) and the controller under the EU General Data Protection Regulation (GDPR).
• For the content your team puts in a workspace (tasks, docs, chat, contacts, files), the workspace owner decides what happens to it. We process it only on their instructions, to run Voro HQ for them. If you are in someone else's workspace, questions about that content go to the workspace owner first.

What we collect and why

What	Why we need it	Legal basis
Name, email, password (stored only as a one-way hash), and optionally phone, timezone and language	To give you an account, sign you in and talk to you	Your consent and our contract with you
Devices you sign in from, a shortened IP address, the city we estimate from it, sign-in and security events	To keep your account safe and warn you about new sign-ins	Legitimate use for security, and our legal duties
Workspace content your team adds	To run Voro HQ for your workspace	The workspace owner's instructions
Plan, seats, usage (such as AI credits and WhatsApp messages), invoices, and your billing name, address and GSTIN	To apply plan limits, bill you and meet tax law	Our contract and our legal duties
What you agreed to, when, and which version of a notice	To prove consent and let you withdraw it	Our legal duties

We collect only what a feature needs. Card and bank details go straight to Razorpay and never reach our servers.

What we never do

• We do not sell your data, rent it or share it for advertising.
• We do not train AI models on your data, and our AI providers do not either.
• Only you, and the people you share them with, can read your Voro Vault items. They are encrypted on your device before they reach us, we cannot read them, and they are never sent to any AI.
• We do not knowingly collect data about children. Voro HQ is for people aged 18 or over.

AI features (Voro Brain)

AI is off until a workspace owner turns it on. When it is on:

• What you ask, and the content Voro Brain needs to answer, is sent to Anthropic (Claude) or OpenAI (voice, transcription, and backup when Claude is busy). Both process it under data processing agreements and do not use it to train their models.
• We never send Vault items, the email addresses and phone numbers of your contacts, or fields your workspace marks "Keep away from AI". Before anything leaves, we also mask Aadhaar and PAN numbers, card and bank account numbers and anything that looks like a password or key.
• Letting Voro Brain search the whole workspace is a separate choice the owner makes, recorded as consent, and it can be withdrawn in one click.
• Conversations are encrypted and visible only to you. We keep them for 90 days.

Google data

If you sign in with Google or connect Google Calendar, we receive your name, email address and, for calendar sync, the calendar events you choose to sync. We use this data only to sign you in and to keep your Voro HQ calendar and Google Calendar in step.

Voro HQ's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google data only to provide the features you turned on;
• we do not sell it, use it for advertising, or use it to train or improve AI or machine learning models;
• no person at Voro reads it unless you ask us to for support, it is needed for security or the law requires it.

You can disconnect Google at any time in Settings, and you can also remove our access from your Google Account.

Our website

Our website, vorohq.com, sets no cookies. To see which pages help people, it counts visits as daily totals by page, the site that sent you, your country and your type of device. It never stores your IP address or anything that could follow you from one day to the next.

If you join early access, ask about Enterprise or write to us through the website, we keep your name, email address, company and message to reply to you and, only if you tick the box, to send you product news. We keep early access sign-ups and Enterprise enquiries for 2 years, and contact messages for 1 year.

Who else sees your data

A few companies help us run Voro HQ. They are listed, with what they do and where, on our subprocessors page. Each one has a data processing agreement with us and may use your data only to provide its service. Some providers are used only once they are switched on, and appear on that page from that moment.

We share data with the authorities only when Indian law requires it, and we push back on requests that are too broad.

Where your data lives

Your data is stored in India, in Amazon Web Services' Mumbai region. A few providers, such as the AI providers, process data outside India. Where data leaves India or the European Economic Area, we use contracts with the safeguards the law requires, such as the EU Standard Contractual Clauses.

How long we keep it

Every kind of data has a fixed time we keep it, and a daily job deletes it when that time is up. For example:

• device records: 90 days;
• security logs: 1 year;
• AI conversations: 90 days;
• a deleted workspace stays in the Trash for 30 days and is then erased for good;
• a workspace whose trial or plan ended without payment is deleted 90 days later, after several reminders;
• invoices: 8 years, because Indian tax law requires it.

When you delete your account, we remove or anonymise your personal data straight away, except what the law requires us to keep.

Your rights

Wherever you live, you can:

• See and download your data: Settings > Privacy > Download your data.
• Correct or update it: Settings > Profile.
• Delete your account: Settings > Privacy.
• Withdraw consent as easily as you gave it, for example product news in Settings > Privacy. Withdrawing consent to the terms means closing your account. Withdrawal does not affect what was done before.
• Nominate someone to use these rights for you if you die or cannot act yourself: Settings > Privacy > Nominate someone.
• Raise a grievance with our Grievance Officer (see below).

If you are in the European Union, the UK or the EEA, you also have the right to ask us to restrict processing, to object to processing based on legitimate interests, to receive your data in a portable format, and to complain to your local data protection authority.

We answer requests within 30 days. We may ask you to confirm who you are first, so that nobody else gets your data.

Grievances

Our Grievance Officer is Esha Mahato, grievance@vorohq.com.

You can also raise a grievance in Settings > Privacy and track it by its ticket number. We confirm we have it straight away, and reply within 30 days, well inside the 90 days the DPDP Rules 2025 allow. If you are not happy with our answer, you can complain to the Data Protection Board of India. Our grievances page explains each step.

Security and breaches

We encrypt data in transit and at rest, encrypt sensitive fields again inside the database, offer two-step sign-in and passkeys, and log every sensitive action. Only a small number of trained staff can reach production systems, and support staff can see a workspace only when its owner allows it.

If a breach affects your personal data, we will tell you without delay, in plain words: what happened, what it means for you and what you can do. We report it to the Data Protection Board of India, and within 72 hours to the authorities where the GDPR or Indian law requires.

Cookies

We use only the cookies Voro HQ needs to work. Our cookie notice lists them.

Changes to this notice

When we change this notice, we publish the new version here with a short summary of what changed, keep the earlier versions on this page, and ask you to agree again before you continue.