Privacy Policy

Last updated: 2026-10-10

1. Who we are

[LEGAL INPUT REQUIRED: operator legal entity name] (“Valori”, “we”, “us”) operates Valori Cloud at valori.systems. This policy explains what personal data we process, why, and the choices you have. For privacy questions or requests, contact support@valori.systems.

2. Information we collect

• Account information — an email address and password if you register directly, or your name and email address if you sign in with Google or GitHub. We do not collect any other profile fields at signup.
• Authentication and security information — session tokens; a record of login attempts (timestamp, success or failure, IP address, and user agent), visible to you in your account’s login history; and, if you enable it, a two-factor authentication secret. We do not store your password in plain text.
• Project and API usage — project and collection names, request counts, rate-limit state, and operational metrics used to run the Service and enforce plan limits.
• Customer Data — the vectors, metadata, graph structures, and text you store in your projects. We treat this as confidential and process it only to provide the Service; we do not use it to train models or for advertising. If you configure an external embedding provider, text you submit for embedding is sent to that provider under its own terms — see Section 5.
• Logs — application and server logs, which may include IP addresses, user agents, and request metadata, used for security and debugging.
• Billing information — for paid plans, a billing contact and a reference to your payment method. Card details are handled entirely by our payment processor (Dodo Payments, or Stripe for subscriptions predating our migration to Dodo) and are never stored by Valori.
• Support and feedback — messages you send to support@valori.systems and any feedback you submit in-product.

3. How we use personal data

• To provide, maintain, and secure the Service and your account.
• To detect and prevent fraud, abuse, and unauthorized access (including the login-attempt and session records described above).
• To enforce plan limits, rate limits, and our Acceptable Use Policy.
• To process payments and send billing and transactional communications.
• To respond to support requests and to improve the Service.
• To comply with legal obligations.

4. Legal bases (EEA/UK users)

Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract (to provide the Service); legitimate interests (security, abuse prevention, product improvement); consent (where specifically requested, such as optional cookies, if introduced in future); and legal obligation (tax and accounting records).

5. Service providers and subprocessors

We share personal data with vendors that process it on our behalf:

• Supabase — Authentication and application database
• Dodo Payments — Payment processing and billing
• Stripe — Payment processing and billing for subscriptions predating the Dodo migration
• Vercel — Web application hosting and CDN
• Resend — Transactional account and billing email delivery
• Zoho Mail — Business email for support correspondence
• [LEGAL INPUT REQUIRED: data-plane / vector-node compute host] — Hosting customer vector and graph database instances

If you configure an external embedding provider (for example, an OpenAI-compatible API) for your own project, text you submit through that project’s ingest or search features is sent to the provider you configured. That provider acts as an independent controller or processor under its own terms, not ours — we do not route this traffic through a Valori-operated subprocessor and do not control that provider’s own data handling.

We do not sell personal data and do not share it with third parties for their own marketing.

6. International transfers

Personal data may be processed in countries other than where you are located, including by the subprocessors listed above. Where required, transfers of EEA/UK personal data outside the EEA/UK are made under [LEGAL INPUT REQUIRED: international transfer mechanism].

7. Data retention

• Account data: [LEGAL INPUT REQUIRED: account data retention period].
• Logs and login history: [LEGAL INPUT REQUIRED: log retention period].
• Billing and invoice records: [LEGAL INPUT REQUIRED: billing record retention period].
• Customer Data: retained while your project exists. Deleting a project removes it from the Service’s active index. Depending on your hosting tier, the underlying storage directory may be removed immediately, or may persist for a period as part of routine infrastructure maintenance before being purged — we do not currently operate a guaranteed deletion timeline for every hosting tier, and this is an open item we intend to close (see the legal review checklist).

8. Security

We use encryption in transit for the dashboard and API, database access controls, and row-level security policies scoped to your account and organization. Stored state is chained with a cryptographic (BLAKE3) hash so that unauthorized changes to it are detectable after the fact. This detects tampering; it is not a backup mechanism and does not prevent data loss from infrastructure failure or unauthorized access to the systems it runs on. We do not currently apply encryption at rest beyond what our infrastructure providers apply by default, and TLS termination for the underlying data plane is an operational configuration, not a guarantee independent of how a given deployment is run. No system is perfectly secure; you are responsible for protecting your own credentials and API keys, and we encourage enabling two-factor authentication.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing. To exercise these rights, contact support@valori.systems. You may also lodge a complaint with your local data protection authority. Account deletion and personal-data export requests are handled manually today — there is no self-service “delete my account” control yet. A self-service snapshot download is available for your project data from your dashboard, but it is a raw data file rather than a structured personal-data export.

10. Cookies

We use a small number of cookies, described in the Cookie Policy. We do not currently use advertising or analytics cookies.

11. Children

The Service is not directed to children under 16 and we do not knowingly collect their personal data.

12. Applicable law

Depending on where you and your organization are located, laws such as the EU and UK GDPR, India’s Digital Personal Data Protection Act, and applicable US state privacy laws may give you additional rights. We have not completed a jurisdiction-by-jurisdiction compliance assessment, and this policy should not be read as a representation that every such law’s specific requirements (for example, a formal Records of Processing Activities, or a India-specific consent framework) have been separately implemented.

13. Changes to this policy

We may update this policy. Material changes will be notified by email or an in-product notice. The “last updated” date above reflects the current draft revision, not necessarily a date on which it took legal effect — see the banner at the top of this page.

14. Contact

[LEGAL INPUT REQUIRED: operator legal entity name]
[LEGAL INPUT REQUIRED: registered business address]
support@valori.systems