Privacy Policy

vorynq ("we", "us") processes personal data about you as a user of the service in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent international data-protection legislation that may apply where you live (including the California Consumer Privacy Act / CPRA, Brazil's LGPD, and similar laws).

1. Data controller

vorynq is the data controller for the processing of your personal data. Contact: privacy@vorynq.com.

2. What we process

Account data: email, name, profile picture (via Google sign-in or email sign-up).
Asset data: the assets, images, valuations and notes you enter.
Payment data: handled by Stripe — we store only a customer ID and subscription status.
Technical data: IP address, browser, login times (security log).

3. Purposes and legal bases

Providing the service (GDPR art. 6(1)(b) — performance of a contract).
Security and abuse prevention (art. 6(1)(f) — legitimate interest).
Analytics and marketing only with your consent (art. 6(1)(a)).

4. Sub-processors

We use the following sub-processors:

Supabase (database, authentication) — EU / US
Stripe (payments) — EU / US
Google Gemini and Lovable AI Gateway (AI image analysis and portfolio import)
Cloudflare (hosting and CDN) — global

Where data is transferred outside the EU/EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum) and apply additional safeguards as required.

5. Retention

We retain your data for as long as your account is active. When you delete your account, all personal data is deleted within 30 days, except where law requires longer retention (for example accounting records).

6. Your rights

Subject to applicable law, you have the rights of access, rectification, erasure ("right to be forgotten"), restriction, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

You may exercise these rights at any time by exporting or deleting your account directly from Settings, or by contacting privacy@vorynq.com.

You also have the right to lodge a complaint with your local supervisory authority — for example the Danish Data Protection Agency (datatilsynet.dk), the UK Information Commissioner's Office (ico.org.uk), or the relevant authority in your country of residence.

7. US residents — CCPA/CPRA, Virginia, Colorado and other state rights

If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, you have the right to (a) know what personal information we collect and how we use it, (b) access and receive a copy of that information, (c) correct inaccurate information, (d) delete it, (e) opt out of "sale" or "sharing" for cross-context behavioural advertising, and (f) not be discriminated against for exercising these rights.

We do not sell your personal information and we do not share it for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act / CPRA. We do not knowingly collect data from anyone under 16. Categories of personal information we collect are listed in Section 2 above (identifiers, commercial information, internet activity, user content); sources, purposes and recipients are listed in Sections 2-4. We retain data as described in Section 5.

Exercise any of these rights by exporting or deleting your account from Settings, or by emailing privacy@vorynq.com. You may use an authorised agent. If we deny a request, you may appeal by replying to our denial email. California residents may also contact the California Attorney General at oag.ca.gov/privacy.

8. Cookies

See our Cookie Policy for details.

9. Changes

We may update this policy. Material changes will be announced by email or in the app.