Vorah Privacy Policy
VORAH LLC
PRIVACY POLICY
Version 1.2 | Effective Date: October 13, 2026 | Governing Law: Commonwealth of Pennsylvania
Vorah LLC | 4203 Union Deposit Rd #1210, Harrisburg, PA 17111 | privacy@vorahhq.com | www.vorahhq.com
THIS PRIVACY POLICY DESCRIBES HOW VORAH LLC COLLECTS, USES, STORES, AND SHARES INFORMATION FROM BROKERS, AGENTS, AND BUYERS WHO USE THE VORAH PLATFORM AND WEBSITE. PLEASE READ THIS POLICY IN FULL BEFORE USING THE PLATFORM OR WEBSITE. BY USING THE PLATFORM OR WEBSITE YOU AGREE TO THE PRACTICES DESCRIBED IN THIS POLICY.
1. WHO WE ARE AND HOW TO CONTACT US
Vorah LLC is a Pennsylvania limited liability company that operates a buyer intelligence platform for licensed real estate professionals. Our Platform enables listing agents to upload property video tours (as a single video or as room-by-room video clips), generate trackable Smart Links for distribution to prospective buyers, collect room-by-room buyer reaction data, and deliver Intelligence Reports to agents and brokers before in-person showings.
Company: Vorah LLC
Privacy Contact: privacy@vorahhq.com
Legal Notices: legal@vorahhq.com
Mailing Address: 4203 Union Deposit Rd #1210, Harrisburg, PA 17111
Website: www.vorahhq.com
Privacy Policy URL: www.vorahhq.com/privacy
For all privacy-related requests, questions, complaints, or data deletion requests, contact us at privacy@vorahhq.com. We will respond to all privacy requests within thirty (30) calendar days of receipt, and within forty-five (45) calendar days for California residents exercising CCPA rights.
2. SCOPE OF THIS PRIVACY POLICY
This Privacy Policy applies to:
Information collected from Brokers and Agents who create accounts and subscribe to the Platform.
Information collected from Buyers who access Smart Links and interact with property video tours through the Platform.
Information collected from visitors to www.vorahhq.com, whether or not they create an account.
Information collected through Vorah’s mobile and web application used by Brokers and Agents, including email and text message notifications.
This Privacy Policy does not apply to third-party websites, services, or applications that may be linked from the Platform or website. Vorah is not responsible for the privacy practices of any third party.
DOCUMENT FRAMEWORK: This Privacy Policy is one component of Vorah’s legal framework alongside the Terms of Service, the Early Access and Subscription Agreement, and the Buyer Consent Notice. For a Broker who has signed an Early Access and Subscription Agreement, that agreement controls in the event of any conflict. Otherwise, in the event of any conflict between this Privacy Policy and the Terms of Service regarding liability, remedies, or obligations, the Terms of Service controls.
3. THE THREE CATEGORIES OF PEOPLE WE COLLECT DATA FROM
Vorah collects different categories of data from three distinct groups of people. Understanding which category applies to you determines what data we collect, why we collect it, and what rights you have.
3.1 Brokers and Agents — Platform Subscribers
Brokers and Agents are licensed real estate professionals who subscribe to the Platform, create accounts, upload property video tours, generate Smart Links, and receive Intelligence Reports. Brokers and Agents actively choose to use the Platform and provide information as part of their subscription.
3.2 Buyers — Smart Link Users
Buyers are prospective real estate purchasers who receive a Smart Link from a Broker or Agent and choose to interact with a property video tour through the Platform. Buyers do not have paid accounts and are never required to create an account to watch a tour or react. A Buyer may choose to create a free account to save the tours they have viewed. Buyers interact with the Platform only through Smart Links distributed by Brokers or Agents. Buyers must consent to data collection, through the Buyer Consent Notice displayed before every Smart Link session, before any engagement data is collected from them.
3.3 Website Visitors
Website Visitors are individuals who visit www.vorahhq.com without necessarily creating an account or accessing a Smart Link. Website Visitors may include prospective customers, brokers evaluating the Platform, buyers who navigate to the website independently, and members of the general public.
4. WHAT INFORMATION WE COLLECT AND WHY
4.1 Information We Collect from Brokers and Agents
When Brokers and Agents create accounts and use the Platform, we collect:
Full name and contact information: Name, email address, mobile phone number, and brokerage name provided at registration.
Real estate license information: Broker license number, state of licensure, and brokerage affiliation provided at registration or in the executed subscription agreement.
Account credentials: Hashed and encrypted passwords. We never store passwords in plain text.
Property video content: Video tours and room-by-room video clips uploaded to the Platform, including the property address, room labels, listing details, and any other information included in the video or associated metadata.
Platform usage data: Login timestamps, pages visited within the Platform, features accessed, Smart Links generated, Intelligence Reports viewed, report opens and link clicks from email and text message notifications, listing uploads, and session duration.
Text message consent records: Whether an Agent or Broker opted in to text messages, the date, time, and method of opt-in, and any opt-out (STOP) or help (HELP) request.
Communication records: Emails, support requests, and other communications sent to Vorah.
Payment metadata: Payment confirmation records, invoice history, and subscription status processed through Stripe. We do not store full credit card numbers, CVV codes, or bank account information. All payment data is processed and stored by Stripe under Stripe’s Privacy Policy.
Device and browser information: IP address, device type, operating system, and browser version used to access the Platform.
Why we collect this: to provide the Platform, deliver Intelligence Reports and account notices by email and text message, process payments, verify license eligibility, track usage needed to administer the subscription and its performance guarantee, deliver customer support, comply with our legal obligations, and improve Platform performance.
4.2 Information We Collect from Buyers
BUYERS: A SUMMARY OF HOW THE HOME WAS VIEWED IS SHARED WITH THE AGENT AND BROKERAGE WHO SENT YOU THE SMART LINK. YOUR NAME IS SHARED ONLY IF YOU CHOOSE TO SHARE IT. THIS IS DISCLOSED IN THE BUYER CONSENT NOTICE YOU SEE BEFORE EVERY SMART LINK SESSION. IF YOU DID NOT CONSENT, NO ENGAGEMENT DATA WAS COLLECTED FROM YOU.
When a Buyer clicks the consent button on the Buyer Consent Notice and interacts with a Smart Link, we collect:
Smart Link session identifier: A unique ID assigned to each Smart Link session that connects the Buyer’s engagement data to the specific listing.
Consent record: Timestamp of consent, IP address at time of consent, device and browser information, and the version number of the Buyer Consent Notice displayed. This record is created the moment a Buyer clicks consent and before any viewing data is collected.
Video viewing behavior: Which rooms or room clips of the property tour the Buyer watched, how long they spent on each room, which rooms they replayed, and which rooms they skipped.
Room reaction selections: The preset reaction the Buyer taps for each room, such as “love it,” “maybe,” or “not for me.”
Preset question answers: Tap-only answers to preset, non-discriminatory questions about the Buyer’s home search, such as buying timeline. Buyers cannot type free text anywhere in the Platform.
Access timestamps: The date and time the Smart Link was accessed and the duration of the session.
IP address and device information: Used to generate the consent record and to prevent fraudulent or automated Smart Link access. Not used to identify Buyers by name or to infer Protected Characteristics.
Optional Buyer account: Only if the Buyer chooses to create one: name, email address, password (stored hashed), and phone number if provided, plus the tours the Buyer has viewed.
Sharing and contact choices: The Buyer’s choice to share their name, answers, and reactions with their own agent, or to ask a listing agent to contact them, with the date and time of each choice.
What we do NOT collect from Buyers: Unless a Buyer chooses to create an account or asks to be contacted, we do not collect the Buyer’s name, email address, or phone number. We never collect social media profiles, income, credit scores, bank or account information, or any information about any Buyer’s race, color, religion, national origin, sex, disability, familial status, sexual orientation, gender identity, marital status, age, source of income, or any other Protected Characteristic. The Platform has no free-text fields for Buyers, has no mechanism to collect Protected Characteristic information, and is not designed to do so.
Why we collect Buyer data: to generate the Intelligence Report delivered to the listing Agent and Broker, to maintain the consent record required by applicable privacy law, and to improve Platform performance using aggregated and anonymized behavioral data.
Who receives Buyer data: The Agent and Broker who generated the Smart Link receive an Intelligence Report describing how the property was viewed. Intelligence Reports describe how the property performed and do not describe Buyer characteristics. A Buyer’s name is shared only by the Buyer’s own choice, as described in Section 6.1. Vorah does not sell, rent, or share Buyer data with any other party except as described in Section 6.
4.3 Information We Collect from Website Visitors
When individuals visit www.vorahhq.com, we collect the following through Google Analytics and Google Maps, subject to the visitor’s cookie consent choice:
Google Analytics: Pages visited, time spent on each page, navigation paths, referring website, approximate geographic location derived from IP address, device type, browser type, and operating system. Google Analytics is only activated after a visitor accepts cookies through the cookie consent banner. No Google Analytics data is collected from visitors who decline cookies.
Google Maps: Location interaction data derived from IP address when a visitor interacts with map features on the website. Google Maps cookies are blocked for visitors who decline optional cookies.
Cookie choice: The visitor’s cookie choice (accept or decline), stored in a cookie on the visitor’s own device so the banner remembers it. If our consent tool also keeps a record of the choice, that record may include the time of the choice and an approximate IP address.
Server logs: Standard web server logs including IP address, page requested, timestamp, and HTTP response code. Retained for ninety (90) days for security monitoring purposes.
Why we collect website visitor data: to understand how visitors use our website, to improve website performance and content, and to enable location-based features. We do not use website visitor data to identify individual visitors by name or to make decisions about any individual.
4.4 Information We Do Not Collect — Ever
Vorah does not collect, store, or process:
Any information about any Buyer’s race, color, religion, national origin, sex, disability, familial status, sexual orientation, gender identity, marital status, age, source of income, or any other Protected Characteristic under applicable federal, state, or local law.
Free-text comments or messages from Buyers. Every Buyer input is a preset, tap-only selection.
Full credit card numbers, CVV codes, or bank account information — all payment processing is handled exclusively by Stripe.
Social Security numbers or government identification numbers.
Health or medical information of any kind.
Biometric data of any kind.
Children’s personal information — the Platform and website are not directed at individuals under the age of eighteen (18) and we do not knowingly collect information from anyone under eighteen.
5. HOW WE USE THE INFORMATION WE COLLECT
Vorah uses the information we collect for the following purposes:
Providing the Platform: To create and manage Broker and Agent accounts, process subscriptions, generate Smart Links, collect Buyer Engagement Data, generate Intelligence Reports, and operate the Broker dashboard and weekly team summaries.
Processing payments: To charge subscription fees, process renewals, send renewal reminders, issue refunds where applicable, and maintain payment records. Payment processing is handled by Stripe.
Delivering Intelligence Reports: To compile Buyer Engagement Data from Smart Link sessions into Intelligence Reports delivered to the listing Agent through the Platform, by email, or by text message, and accessible to the Broker.
Sending notifications: To send Brokers and Agents push, email, and text message notifications regarding new Buyer engagement, new Intelligence Reports, activity summaries, account activity, and Platform updates. Text messages are sent only to Brokers and Agents who have opted in, and are never sent to Buyers.
Customer support and onboarding: To respond to account inquiries, technical support requests, billing questions, and other communications, and to deliver onboarding and training.
Legal compliance: To comply with applicable law including Pennsylvania breach notification requirements, CCPA obligations for California residents, CAN-SPAM Act requirements, the Telephone Consumer Protection Act, and responses to valid legal process.
Security and fraud prevention: To monitor for unauthorized access, detect and prevent fraud, investigate security incidents, and protect the integrity of the Platform.
Platform improvement: To analyze aggregated and anonymized usage data to identify bugs, improve features, and develop new Platform capabilities. Individual user data is not used for Platform improvement without aggregation and anonymization.
Marketing communications: To send marketing emails to prospective customers using publicly available contact information, in compliance with CAN-SPAM. Existing subscribers may receive product updates and renewal notices. All recipients may opt out at any time. Vorah does not send marketing text messages.
Vorah does not use any data collected through the Platform or website to make decisions about any individual’s race, color, religion, national origin, sex, disability, familial status, or any other Protected Characteristic. Vorah does not use Buyer Engagement Data for advertising, profiling, or any purpose other than generating Intelligence Reports and improving the Platform through aggregated analysis.
6. HOW WE SHARE INFORMATION
Vorah does not sell personal information. Vorah does not share personal information with third parties for their own marketing purposes. We share information only in the following circumstances:
6.1 With the Listing Agent and Broker — Buyer Engagement Data
Buyer Engagement Data collected during a Smart Link session is shared, as an Intelligence Report describing how the property was viewed, with the Agent who generated the Smart Link and the Broker under whose account it was created. This sharing is the core function of the Platform and is disclosed to Buyers in the Buyer Consent Notice before any engagement data is collected. No engagement data is collected from, or shared about, Buyers who do not consent.
A Buyer’s identity is shared only by the Buyer’s own choice:
Link from the Buyer’s own agent. At the end of the tour, the Buyer may check a box to share their name, answers, and reactions with that agent. The box is unchecked by default. If the Buyer does not check it, the agent sees how the home was viewed, without the Buyer’s name.
Link from a listing agent. The Platform tells the Buyer that the listing agent works for the seller. A Buyer who already has an agent may send the tour to their own agent. A Buyer without an agent may ask the listing agent to contact them, which shares the Buyer’s name and phone number only. A listing agent never receives a Buyer’s name together with that Buyer’s reactions or answers.
The listing Agent may share a summary of how a property performed with the seller of that property. Seller summaries describe property performance across Buyers (for example, which rooms were most loved or most skipped) and do not identify any individual Buyer.
6.2 With Stripe — Payment Processing
We share payment information with Stripe, Inc. for the purpose of processing subscription fees and renewals. Stripe is a PCI-DSS compliant payment processor. Stripe’s collection and use of payment information is governed by Stripe’s Privacy Policy available at stripe.com/privacy. We do not store full payment card numbers or banking information.
6.3 With Google — Analytics and Maps
We share website visitor data with Google LLC through Google Analytics and Google Maps, subject to visitor cookie consent. Google Analytics receives behavioral data about website visits including pages viewed, session duration, and approximate location. Google Maps receives location interaction data when map features are used. This sharing occurs only when a visitor has accepted optional cookies through the cookie consent banner. Google’s collection and use of this data is governed by Google’s Privacy Policy at policies.google.com/privacy. We have configured Google Analytics to operate in Consent Mode v2 to respect visitor cookie preferences.
6.4 With Notification Providers — Push, Email, and Text Messages
We share the minimum Broker and Agent information needed to deliver notifications with the following service providers, which act on our behalf:
OneSignal, Inc. — push notifications within the Vorah application (device identifiers, push tokens, and delivery data).
Our email delivery provider(s), such as Resend — transactional email, including Intelligence Reports and account notices (email addresses and delivery data).
Our text messaging provider(s) — text messages to Brokers and Agents who have opted in (mobile numbers, message content, and delivery and opt-out data).
These providers do not receive Website Visitor data, and they process Buyer Engagement Data only to the extent it appears in an Intelligence Report delivered to a Broker or Agent. They may not use this information for their own purposes.
6.4A With Other Service Providers
In addition to the providers named in this Policy, Vorah may use other service providers that perform functions on our behalf, such as hosting, data storage, video processing, email and text message delivery, payments, customer support, scheduling, electronic signatures, analytics, and security. Every service provider receives only the information it needs to perform its function for Vorah, is bound by contract or its published terms to protect that information, and may not use it for its own marketing or advertising purposes. A current list of service providers is available on request at privacy@vorahhq.com.
6.5 With Firebase and Google Cloud Platform — Infrastructure
The Platform operates on Google Firebase and Google Cloud Platform infrastructure. All Platform data including Broker and Agent account data, Customer Content, and Buyer Engagement Data is stored on Firebase and Google Cloud Platform servers. Google processes this data on our behalf as a data processor under a data processing agreement. Google does not use this data for its own purposes. Google’s infrastructure privacy practices are governed by Google Cloud’s Privacy Policy.
6.6 With Legal and Regulatory Authorities
We may disclose information when required by law, regulation, court order, subpoena, or government request. Before producing any data in response to a legal request, Vorah will: (a) review the validity of the request; (b) produce only the data specifically required by valid legal process; (c) notify the affected Customer promptly unless prohibited from doing so by law; and (d) use commercially reasonable efforts to challenge overly broad requests. We do not produce data in response to informal law enforcement requests without valid legal process.
6.7 In Connection with a Business Transaction
If Vorah is acquired, merged with another company, or sells all or substantially all of its assets, personal information may be transferred to the acquiring entity as part of that transaction. We will notify affected users via email at least thirty (30) days before any such transfer takes effect. The acquiring entity will be required to honor this Privacy Policy or provide users with notice of any material changes and the opportunity to delete their data before changes take effect. Text messaging opt-in data and consent will not be transferred for any purpose other than continuing the same service.
6.8 With Your Consent
We may share information with third parties when you have given us specific consent to do so. You may withdraw consent at any time by contacting privacy@vorahhq.com.
6.9 We Do Not Sell Personal Information
Vorah does not sell, rent, trade, or otherwise transfer personal information to third parties for monetary consideration or any other valuable consideration. This applies to all categories of personal information collected from Brokers, Agents, Buyers, and Website Visitors. California residents: this means Vorah does not engage in the “sale” or “sharing” of personal information as defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act.
7. TEXT MESSAGES (SMS)
NO MOBILE INFORMATION WILL BE SHARED WITH THIRD PARTIES OR AFFILIATES FOR MARKETING OR PROMOTIONAL PURPOSES. TEXT MESSAGING ORIGINATOR OPT-IN DATA AND CONSENT WILL NOT BE SHARED WITH ANY THIRD PARTY, EXCEPT THE SERVICE PROVIDERS THAT DELIVER OUR MESSAGES.
7.1 Who Receives Text Messages
Vorah sends text messages only to Brokers and Agents who have opted in directly to Vorah, for example through an opt-in step in the Vorah application or by replying to a confirmation message. Vorah does not send text messages to Buyers and does not send marketing text messages.
7.2 What We Send
Text messages contain Intelligence Report notifications, activity summaries, and account notices, usually with a secure link to the full report. Message frequency varies with listing activity. Message and data rates may apply.
7.3 How to Stop or Get Help
Reply STOP to any Vorah text message to stop receiving texts. Reply HELP for help, or contact privacy@vorahhq.com. We honor opt-out requests promptly. Opting out of text messages does not affect your account; Intelligence Reports remain available in the Platform and by email.
7.4 Consent Records
We keep records of each opt-in and opt-out, including the date, time, and method, as required by applicable law.
8. COOKIES AND TRACKING TECHNOLOGIES
8.1 What Cookies Are
Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and understand how you use the site. Vorah uses cookies only on www.vorahhq.com. The Vorah mobile and web application uses different technologies (session tokens and device identifiers) that are not browser cookies.
8.2 Cookies We Use on vorahhq.com
vorah_cookie_consent: Strictly necessary. Stores your cookie consent choice (accept or decline) and the date of that choice. Required for the cookie banner to function. Expires after 12 months. Cannot be declined.
**Google Analytics (_ga, ga*):** Optional analytics. Tracks website visits, page views, session duration, and navigation paths. Only set after you accept cookies. Blocked if you decline. Set and managed by Google.
Google Maps: Optional functionality. Set when you interact with map features on the website. Only active after you accept cookies. Blocked if you decline. Set and managed by Google.
Any other optional tools found on the website are listed in our cookie banner and follow the same rules. Strictly necessary cookies cannot be declined because they are required for the website to function. All optional cookies are off by default and are only activated after you click Accept All Cookies on the cookie consent banner.
8.3 Your Cookie Choices
When you first visit vorahhq.com, a cookie consent banner is displayed giving you the choice to accept or decline optional cookies. You can change your choice at any time by clicking the Cookie Preferences link in the footer of any page on vorahhq.com. Your choice is stored for twelve (12) months before the banner is re-displayed.
8.4 Global Privacy Control
Vorah honors the Global Privacy Control (GPC) browser signal. If your browser sends a GPC signal to vorahhq.com, we automatically treat it as a decline of optional cookies without requiring any additional action from you.
8.5 Do Not Track
Some browsers send a Do Not Track (DNT) signal. Vorah honors DNT signals by treating them as equivalent to declining optional cookies on vorahhq.com. Because GPC is a more specific and legally recognized signal in several states, we recommend using GPC where available.
9. DATA RETENTION
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The following retention periods apply:
Broker and Agent account data: Retained during the active subscription and for thirty (30) days following account termination or cancellation. After thirty (30) days, account data is permanently deleted. Brokers and Agents may request a data export within the thirty (30) day window following termination.
Buyer Engagement Data: Retained for the duration of the associated Broker’s subscription and for thirty (30) days following that subscription’s termination. When a Broker’s account is deleted, all associated Buyer Engagement Data is deleted with it within thirty (30) days.
Payment records: Retained for seven (7) years from the date of the transaction to comply with financial recordkeeping requirements. Payment records are maintained in Stripe and in Vorah’s internal transaction logs.
Signed contracts and agreements: Retained for seven (7) years from the date of execution.
Legal notification records: Retained for seven (7) years. Records of all legal notices received from Brokers under the 48-hour notification obligation are retained as legal protection.
Cookie choices: Stored on the visitor’s device for up to twelve (12) months. Any record kept by our consent tool is retained for no more than two (2) years.
Optional Buyer account data: Retained until the Buyer deletes the account, or for two (2) years after the Buyer’s last sign-in, whichever comes first.
Buyer sharing and contact choices: Retained for the duration of the associated Broker’s subscription plus thirty (30) days.
Buyer consent records: Retained for the duration of the associated Broker’s subscription plus thirty (30) days. The consent record documents that a specific Buyer agreed to data collection before their Smart Link session.
Text message consent and opt-out records: Retained for a minimum of four (4) years after the last message sent to that number, to document consent as required by law.
Marketing opt-out records: Retained for a minimum of three (3) years. Opt-out requests are never deleted and opted-out contacts are never re-added to marketing lists without their explicit written request.
Security and access logs: Retained for two (2) years to support security incident investigation and regulatory compliance.
Server logs: Retained for ninety (90) days for security monitoring and then permanently deleted.
Aggregated and anonymized data: Retained indefinitely. Once data is aggregated and anonymized such that no individual can be identified, it is no longer personal information and is not subject to deletion obligations.
10. DATA SECURITY
Vorah implements commercially reasonable technical and organizational security measures designed to protect personal information from unauthorized access, disclosure, alteration, loss, or destruction. Our security measures include:
Encryption of data in transit using TLS/HTTPS for all communications between users and the Platform.
Encryption of data at rest within Firebase and Google Cloud Platform infrastructure.
Secure, expiring links in email and text message notifications, so full reports are viewed inside the Platform.
Access controls limiting Platform data access to authorized Vorah personnel on a need-to-know basis.
Security and access logging retained for two (2) years to detect and investigate anomalous access events.
Payment processing exclusively through Stripe, a PCI-DSS Level 1 certified payment processor, ensuring payment card data never touches Vorah’s systems.
No security system is impenetrable and no method of electronic transmission or storage is one hundred percent secure. Vorah cannot guarantee absolute security of personal information. In the event of a confirmed data breach affecting personal information, Vorah will notify affected individuals in accordance with applicable breach notification law, as described in Section 18.
Breach notifications will be sent to the email address on file for affected Brokers and Agents. For Buyers whose Buyer Engagement Data may be affected, notification will be provided through the associated Broker in accordance with our Terms of Service.
11. YOUR PRIVACY RIGHTS
11.1 Rights Available to All Users
Regardless of your location, you have the following rights with respect to your personal information:
Right to Access: You may request a copy of the personal information we hold about you.
Right to Correction: You may request correction of inaccurate personal information we hold about you.
Right to Deletion: You may request deletion of your personal information subject to our legal retention obligations. Some information must be retained for legal compliance purposes and cannot be deleted upon request.
Right to Data Export: Brokers and Agents may request an export of their account data within thirty (30) days of account termination.
Right to Opt Out of Marketing: You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting privacy@vorahhq.com. Opt-out requests are processed within ten (10) business days.
Right to Stop Text Messages: Reply STOP to any Vorah text message, as described in Section 7.
To exercise any of these rights, submit a written request to privacy@vorahhq.com. We will respond within thirty (30) calendar days. We may need to verify your identity before processing your request. We will not discriminate against you for exercising any privacy right.
11.2 California Residents — CCPA and CPRA Rights
CALIFORNIA RESIDENTS HAVE SPECIFIC RIGHTS UNDER THE CALIFORNIA CONSUMER PRIVACY ACT (CCPA) AS AMENDED BY THE CALIFORNIA PRIVACY RIGHTS ACT (CPRA). THESE RIGHTS ARE IN ADDITION TO THE RIGHTS AVAILABLE TO ALL USERS.
If you are a California resident, you have the following additional rights:
Right to Know: You have the right to know what personal information we collect, use, disclose, and sell or share about you, and for what purposes. This Privacy Policy serves as our disclosure. You may also submit a specific request to privacy@vorahhq.com.
Right to Delete: You have the right to request deletion of personal information we collected from you, subject to certain exceptions including our legal retention obligations.
Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
Right to Opt Out of Sale or Sharing: Vorah does not sell or share personal information as defined under CCPA/CPRA. There is nothing to opt out of. We honor this right by design.
Right to Limit Use of Sensitive Personal Information: Vorah does not collect sensitive personal information as defined under CPRA beyond what is necessary to provide the Platform. We do not use sensitive personal information for any purpose beyond Platform operation.
Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.
Right to Know About Automated Decision-Making: Vorah does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.
DO NOT SELL OR SHARE MY PERSONAL INFORMATION: Vorah does not sell or share personal information as defined under California law. If you wish to confirm this or submit a formal opt-out request as a precautionary measure, contact privacy@vorahhq.com with the subject line “California Privacy Request — Do Not Sell or Share.”
California Shine the Light: California Civil Code Section 1798.83 permits California residents to request information about personal information disclosed to third parties for direct marketing purposes. Vorah does not disclose personal information to third parties for their direct marketing purposes. There is nothing to report under this provision.
Response Timeline for California Residents: We will respond to CCPA/CPRA requests within forty-five (45) calendar days. We may extend this period by an additional forty-five (45) days where reasonably necessary, with prior notice to you.
11.3 Residents of Other States with Privacy Laws
Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws have rights under those laws that are similar to those described above, including rights to access, correct, delete, and opt out of certain processing. Vorah does not sell personal information, use personal information for targeted advertising, or engage in profiling that produces legal effects. To exercise any right under applicable state law, contact privacy@vorahhq.com. We will respond within forty-five (45) calendar days.
11.4 Buyers — Special Rights and Procedures
Buyers with an optional account may delete it at any time from their account settings or by contacting privacy@vorahhq.com. Buyers who interacted with a Smart Link and wish to exercise data rights should contact privacy@vorahhq.com with the subject line “Buyer Data Request” and include the approximate date of their Smart Link session and the property address if known. Where a Buyer has no account, we will identify the relevant session data using the information provided and will:
Forward the request in writing to the listing Broker within five (5) business days — the Broker is the Data Controller for that Buyer’s engagement data.
Where technically feasible, identify and delete the specific Smart Link session data from Vorah’s systems without affecting the Broker’s account.
Confirm deletion or the limitations on deletion to the Buyer in writing within thirty (30) days of the request.
Retain a log of the request, the forwarding to the Broker, and the deletion confirmation for three (3) years.
Buyers who did not click the consent button on the Buyer Consent Notice have no engagement data in our systems because no engagement data is collected from non-consenting Buyers.
12. BUYER CONSENT NOTICE — HOW BUYER DATA IS COLLECTED
Every Buyer must see and actively consent to Vorah’s Buyer Consent Notice before any engagement data is collected from them. This Section explains how that process works.
12.1 What the Buyer Consent Notice Does
The Buyer Consent Notice is a full-screen disclosure displayed to every Buyer the first time they access any Smart Link and on every subsequent access to any Smart Link, regardless of prior consent on a different Smart Link. The notice explains: what data will be collected, including room reactions and preset question answers; that a summary of how the home was viewed will be shared with the Agent and Broker who sent the link; that the Buyer’s name is shared only by the Buyer’s choice; that no account is required; that the data will not be used for advertising or to identify the Buyer by name; and that Vorah does not collect information about Protected Characteristics.
12.2 Consent Is Affirmative and Documented
Consent is obtained through an affirmative button click on the Buyer Consent Notice labeled “I Understand — Show Me the Tour.” Passive actions such as scrolling, hovering, or remaining on the page do not constitute consent. At the moment a Buyer clicks consent, the Platform records: the Smart Link identifier; the timestamp of consent in UTC; the Buyer’s IP address; the device type and browser; and the version number of the Buyer Consent Notice displayed. This consent record is stored in Firestore and retained for the duration of the associated Broker’s subscription plus thirty (30) days.
12.3 Buyers Who Do Not Consent
The Buyer Consent Notice includes a clearly visible “No Thank You — Exit” button of equal prominence to the consent button. Buyers who click this button exit the Smart Link experience. Only the IP address and timestamp of the exit event are kept, briefly and for security purposes only; they are not included in any Intelligence Report or shared with any Broker or Agent. Buyers who do not consent cannot have data used against them in any way and retain all rights to view and purchase the property through normal channels.
12.4 Data Collection Does Not Begin Until Consent Is Confirmed
No engagement data of any kind is collected before a Buyer clicks the consent button. The Platform does not collect page view events, video load events, or any analytics data before consent is given. If the consent record cannot be successfully written to Firestore, the Platform does not display the tour. No tour is shown without a successful consent record.
13. PUSH AND EMAIL NOTIFICATIONS
Vorah uses OneSignal, Inc. to deliver push notifications within the Vorah mobile and web application, and Resend to deliver transactional emails such as Intelligence Reports and account notices. These services are not used to collect data from Website Visitors or Buyers.
13.1 What These Providers Process on Our Behalf
Device identifiers and push notification tokens necessary to deliver push notifications to specific devices.
Email addresses used to deliver email notifications.
Notification delivery data including whether a notification was delivered or opened.
Device type, operating system, and application version for notification compatibility purposes.
13.2 How to Manage Notification Preferences
Brokers and Agents can manage push notification preferences through their device settings (iOS or Android). Email notification preferences can be managed within the Vorah application account settings or by contacting privacy@vorahhq.com. Text message preferences are managed as described in Section 7. Disabling notifications does not affect Platform access or subscription status.
13.3 Provider Privacy Practices
Each provider’s processing of data on our behalf is governed by our agreement with that provider and by its privacy policy. These providers do not use data processed on Vorah’s behalf for their own marketing or advertising purposes.
14. THIRD-PARTY LINKS AND SERVICES
The Platform and website may contain links to third-party websites, services, or resources. Vorah is not responsible for the privacy practices, content, or security of any third-party website or service. This Privacy Policy applies only to information collected by Vorah through the Platform and website. We encourage you to review the privacy policies of any third-party service you access through the Platform or website.
Third-party services integrated into the Platform or website and their respective privacy policies:
Stripe — stripe.com/privacy
Google Analytics / Google Cloud / Google Maps — policies.google.com/privacy
Firebase (Google) — firebase.google.com/support/privacy
OneSignal — onesignal.com/privacy
Resend — resend.com/legal/privacy-policy
Our text messaging provider(s) and any other current service providers — a current list is available on request at privacy@vorahhq.com
15. CHILDREN’S PRIVACY
The Platform and website are not directed at individuals under the age of eighteen (18). Vorah does not knowingly collect personal information from anyone under the age of eighteen. If we become aware that we have inadvertently collected personal information from a person under eighteen, we will delete that information promptly. If you believe we have collected information from a minor, please contact privacy@vorahhq.com immediately.
16. FAIR HOUSING AND PROTECTED CHARACTERISTICS
Vorah is designed to avoid collecting or inferring Protected Characteristics. This Section explains specifically what we do and do not collect. Nothing in this Policy is a representation that any particular use of the Platform by a broker or agent complies with Fair Housing Laws; compliance in use is the responsibility of the broker and agent.
16.1 What Vorah Does Not Collect
The Platform has no mechanism to collect, infer, or store any information about any Buyer’s race, color, religion, national origin, sex, disability, familial status, sexual orientation, gender identity, marital status, age, ancestry, source of income, or any other Protected Characteristic under applicable federal, state, or local law. The Buyer Consent Notice explicitly discloses this to Buyers. Vorah’s data collection from Buyers is limited strictly to observable viewing behavior (which rooms were watched, for how long, which were replayed, and which were skipped), the preset reaction tapped for each room, and tap-only answers to preset, non-discriminatory questions. Buyers cannot enter free text.
16.2 Broker and Agent Responsibilities
While Vorah does not collect Protected Characteristic information, Brokers and Agents may independently possess information about Buyers’ Protected Characteristics through their normal course of business. Brokers and Agents are solely responsible for ensuring that Intelligence Reports and Buyer Engagement Data are never used in combination with Protected Characteristic information to make discriminatory decisions. This obligation is set out in detail in Vorah’s Terms of Service and in each Broker’s executed Early Access and Subscription Agreement.
16.3 Vorah’s Platform Design Commitment
Vorah actively designs the Platform to minimize fair housing risk. Intelligence Reports describe how a property performed, with no demographic labels, no Protected Characteristic fields, and no design elements that could facilitate discriminatory use. Any future Platform feature that could create fair housing risk will be reviewed by qualified legal counsel before deployment.
17. DATA PROCESSING ROLES — BROKER AS DATA CONTROLLER
Vorah operates in different data processing roles depending on the type of data involved:
17.1 Vorah as Data Controller
Vorah acts as the Data Controller for: Broker and Agent account information collected during registration and subscription; optional Buyer account information; text message consent records; Website Visitor data collected through Google Analytics and Google Maps; payment metadata collected through Stripe; and marketing communications sent to prospective customers. As Data Controller for this data, Vorah determines the purposes and means of processing and is directly responsible for compliance with applicable privacy law.
17.2 Broker as Data Controller for Buyer Engagement Data
The Broker is the Data Controller for all Buyer Engagement Data collected under the Broker’s account. The Broker determines which listings have Smart Links, which Buyers receive Smart Links, and how Intelligence Reports are used. Vorah acts as a data processor for Buyer Engagement Data, collecting and processing it on the Broker’s behalf and delivering it to the Broker in the form of an Intelligence Report. Brokers are solely responsible for ensuring their use of Buyer Engagement Data complies with all applicable privacy laws in their operating jurisdiction, including jurisdiction-specific obligations that may exceed what Vorah’s Buyer Consent Notice alone satisfies.
17.3 Implications for Buyers
Because the Broker is the Data Controller for Buyer Engagement Data, Buyers with data rights requests related to their Smart Link session data should contact Vorah at privacy@vorahhq.com and Vorah will forward the request to the relevant Broker within five (5) business days per Section 11.4. Vorah will also delete the identifiable session data from Vorah’s systems where technically feasible.
18. BREACH NOTIFICATION
In the event of a security breach that compromises the personal information of Pennsylvania residents, Vorah will provide notification without unreasonable delay in accordance with the Pennsylvania Breach of Personal Information Notification Act. Notification will be provided to:
Affected Pennsylvania residents via email to the address on file.
The Pennsylvania Attorney General’s Office where required by law.
Consumer reporting agencies where required by law.
For breaches affecting residents of other states, Vorah will provide notification within the timeframe required by applicable state law.
19. CHANGES TO THIS PRIVACY POLICY
Vorah may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. We distinguish between material and non-material changes:
19.1 Material Changes
A material change is any update that: expands the categories of personal information we collect; adds new third-party sharing relationships; changes the purposes for which we use personal information; reduces the rights available to users; or materially alters our data retention practices. For material changes, we will: provide written notice to all active Brokers and Agents at the email address on file at least thirty (30) days before the change takes effect; post the updated Privacy Policy at www.vorahhq.com/privacy with the new effective date; and increment the version number of this Privacy Policy. Continued use of the Platform after the effective date of a material change constitutes acceptance of the updated Privacy Policy.
19.2 Non-Material Changes
Non-material changes include clarifications, typographical corrections, formatting updates, and changes that do not alter users’ substantive rights or Vorah’s data practices. Adding or replacing a service provider that performs the same type of function described in Section 6, under the same protections, is a non-material change. Non-material changes may be made without prior notice. The updated Privacy Policy will be posted at www.vorahhq.com/privacy with the updated date.
19.3 Version Archive
Vorah maintains an archive of all prior versions of this Privacy Policy. Prior versions are available upon request by contacting privacy@vorahhq.com. Each version is identified by its effective date and version number.
20. CONTACT US — PRIVACY REQUESTS AND COMPLAINTS
For all privacy-related matters including data access requests, correction requests, deletion requests, opt-out requests, complaints, and questions about this Privacy Policy, contact us at:
Privacy Email: privacy@vorahhq.com
Subject Line Format: “Privacy Request — [Your Name] — [Type of Request]”
Mailing Address: Vorah LLC, Attn: Privacy, 4203 Union Deposit Rd #1210, Harrisburg, PA 17111
Response Time: 30 days for general requests; 45 days for California CCPA/CPRA requests
Extension: We may extend by up to 45 additional days where reasonably necessary with prior notice
If you are not satisfied with our response to a privacy request or complaint, you have the right to file a complaint with the applicable state attorney general or data protection authority in your jurisdiction. California residents may contact the California Privacy Protection Agency at cppa.ca.gov. Pennsylvania residents may contact the Pennsylvania Attorney General’s Office at attorneygeneral.gov.
END OF PRIVACY POLICY
Version 1.2 | Effective Date: October 13, 2026 | www.vorahhq.com/privacy
Vorah LLC | 4203 Union Deposit Rd #1210, Harrisburg, PA 17111 | privacy@vorahhq.com