Privacy Policy

Vorlio (“we”, “us”, or “our”) provides an integrated project management and client collaboration organization available at app.vorlio.site and as a self-hosted software solution. This Privacy Policy details our commitments regarding the collection, processing, and safeguarding of personal data.

Our core architectural rule is simple: your work belongs to you. Whether you track time, conduct video calls, store confidential client deliverables, or run autopilot rules, we treat your content with strict confidentiality and provide transparent controls over who can view it.

Depending on how you interact with Vorlio, we process the following categories of information:

• Account & Profile Information: When you register or join a organization, we collect your name, email address, hashed password, and optional avatar image.
• Organization Content & Projects: Tasks, subtasks, descriptions, custom fields, deadlines, priorities, status workflows, documents, comments, attachments, checklist items, and cycle backlogs created inside your organization.
• Time Tracking & Timesheets: Active timer sessions, manual time logs, billable and non-billable hour classifications, hourly rates, and timesheet approvals.
• Billing & Invoice Data: Client billing details, line items, applied taxes, discounts, and payment status records generated within Vorlio Invoices.
• Technical & Device Telemetry: IP addresses, browser user agent, session authentication tokens (epm_*), and access logs maintained for rate limiting, security auditing, and fraud prevention.

We process your data strictly to fulfill our contractual commitments and service functions, including:

We do not sell your personal information. We do not serve third-party behavioral ads, nor do we profile your team for advertising networks.

Vorlio includes native video conferencing, screen sharing, and audio calling designed to bypass commercial snoopers:

• Internal Media Servers: Audio and video streams flow directly through Vorlio’s dedicated media architecture. They are not relayed through third-party video call platforms.
• Voice Notes: When you record a voice message, audio files are processed for speech-to-text transcription. Once the transcription is completed, audio temporary buffers are promptly discarded.
• Meeting Recordings & Notes: Recordings and AI-assisted meeting summaries remain exclusively inside your organization and are accessible only by authorized participants.

Features such as Ask Vora, Daily Brief summaries, and automated task synthesis operate under strict confidentiality constraints:

On self-hosted instances, Vora runs on your own server hardware. Under no circumstances is your proprietary organization data used to train public foundation models.

When working with outside clients, freelancers, or contractors, Vorlio enforces strong isolation barriers:

• Guests only see the specific Hubs, reviews, or pages explicitly shared with them.
• Internal team comments, internal task estimations, member profiles, and unbilled timesheets are hidden from client view.
• Clients and guests cannot see other clients or organizations hosted on the same installation.

We employ comprehensive technical and operational measures to safeguard your information against unauthorized access, alteration, or disclosure:

• Encryption: All network traffic is encrypted in transit using industry-standard TLS (HTTPS / WSS).
• Authentication: Time-based one-time passwords (TOTP 2FA) and active session management with one-click remote device revocation.
• API Security: Personal API tokens are stored using cryptographic hashes (vor_*) and webhooks are signed via HMAC-SHA256 headers.
• Read more: Review our full security architecture on our Security & Architecture page.

Deleted tasks, documents, and projects are held in the organization Trash for 30 days to protect against accidental loss. After 30 days, or upon explicit purge by an organization administrator, items are permanently deleted.

When an organization owner terminates an account or deletes an organization, all associated records, attachments, and user memberships are permanently excised from live databases. Organization owners can generate full CSV, JSON, and document exports at any time prior to account deletion.

Regardless of your geographic location, Vorlio provides standard rights over your personal data:

For any privacy inquiries, data deletion requests, or questions regarding our data handling practices, reach out directly to our privacy officer: