Privacy Policy
Last updated: October 12, 2026
Vorzal ('we', 'us', or 'our') operates an AI-powered business automation platform. This Privacy Policy explains what information we collect, how we use it, and what rights you have regarding your data.
1. Information We Collect
We collect information you provide directly when creating an account (name, email address via Google sign-in), business information you enter during onboarding, and content from conversations managed through our platform. When you connect your Google Business Profile, we collect and store OAuth access tokens and refresh tokens to act on your behalf, your business profile data including reviews and responses, and business name and location information. We also automatically collect usage data such as pages visited, features used, log data (IP address, browser type, timestamps), and cookies and similar tracking technologies.
2. How We Use Your Information
We use your information to provide, operate, and improve the Service, including managing automated responses to your customers and processing review management requests on your behalf. We also use it to send you important service notifications and updates, respond to your support requests, detect and prevent fraud or abuse, and comply with legal obligations. We do not sell your personal data to third parties. We do not use your data to train AI models without your explicit consent.
3. Google User Data
If you connect your Google Business Profile, Vorzal accesses your Google account data strictly to provide the features you requested. Specifically: • We access your Business Profile to read and respond to reviews on your behalf. • We store OAuth tokens securely in our database solely to maintain your authorized connection. • We do not share your Google data with any third party except as required to deliver the Service (e.g., our hosting infrastructure). • You can disconnect your Google Business Profile at any time from your account settings, which will immediately revoke our access. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. WhatsApp and Messaging Data
When a business uses Vorzal to answer its customers, we process the messages sent to that business on its behalf. This includes the customer's phone number and WhatsApp profile name, the messages, voice notes and files they send, and the replies sent back. Messages are sent and received through the WhatsApp Business Platform operated by Meta, and for some businesses through Twilio. Replies are written with AI models from OpenAI and Anthropic, voice notes are transcribed and voice replies are generated with ElevenLabs (with OpenAI as a backup for transcription). These providers process the content only to perform that function. We use this data only to run the business's assistant and dashboard: answering questions, taking bookings, passing conversations to the business's team, and showing the conversation to that business. We do not sell it and do not use it for advertising.
5. Data Storage and Security
Your data is stored securely using Supabase, a cloud database platform with industry-standard security practices. We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. OAuth tokens are stored server-side and are never exposed to the browser. While we take security seriously, no system is completely secure and we cannot guarantee absolute security.
6. Data Sharing
We do not sell, trade, or rent your personal information. We may share your data with trusted service providers who assist us in operating the Service (such as our database and hosting providers), who are contractually bound to keep your information confidential. We may also disclose your data if required by law, court order, or governmental authority, or to protect the rights, property, or safety of Vorzal, our users, or the public.
7. Cookies
We use cookies and similar technologies to maintain your login session, protect against CSRF attacks (via secure state cookies in our OAuth flows), and analyze usage patterns to improve the Service. You can configure your browser to refuse cookies, but this may prevent some features from working correctly.
8. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are legally required to retain certain records. OAuth tokens are deleted immediately upon disconnecting a Google integration.
9. Your Rights
Depending on your location, you may have the right to access the personal data we hold about you, correct inaccurate data, request deletion of your data, object to or restrict our processing of your data, and receive a copy of your data in a portable format. To exercise these rights, contact us at hello@vorzal.com. We will respond to your request within 30 days.
10. Data Deletion Instructions
Anyone can ask us to delete their data, whether you use Vorzal for your business or you messaged a business that uses Vorzal, for example on WhatsApp. 1. Email hello@vorzal.com with the subject "Data deletion request", or write to us on WhatsApp at +57 314 833 4188. 2. Include the phone number or email address you used and, if you messaged a business, that business's name. 3. We confirm receipt within 3 business days and may ask you to confirm that the phone number or email is yours. 4. Within 30 days we delete your messages, voice notes and their transcripts, contact details and related records from Vorzal's systems, and confirm by the same channel. Businesses can also ask us to delete their whole account and all of their customers' conversations the same way. We cannot delete copies held outside Vorzal: messages on your own phone or on the business's devices, or data kept by Meta (WhatsApp) under WhatsApp's own privacy policy. We may keep records we are legally required to retain, such as billing records.
11. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where appropriate, by sending you an email notification. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.
13. SMS Communications
By providing your phone number and checking the SMS consent box on our contact form, you agree to receive SMS messages from Vorzal related to your inquiry and our services. Message and data rates may apply. Message frequency varies. Reply STOP at any time to unsubscribe. Reply HELP for help. We will not share your phone number with third parties for their marketing purposes.
14. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at: Email: hello@vorzal.com WhatsApp: +57 314 833 4188