VÖR - Privacy Policy

1. Introduction

VÖR ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services (the "Service").

The data controller for the Service is Akademiet for Kunstig Intelligens AS ("AFKI"), org. no. 933 480 860, Nydalsveien 28, 0484 Oslo, Norway.

Please read this Privacy Policy carefully. By using our Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide Directly

Account Information:

• Name
• Email address
• Phone number
• Profile photo (optional)
• User role (Customer or Provider)

For Customers:

• Postcode/zip code for service matching
• Full address (shared only after job acceptance)
• Video recordings of service needs
• Job descriptions and details
• Ratings and reviews

For Providers:

• Business name and description
• Service categories and expertise
• Service area (postcodes covered)
• Professional credentials (if provided)
• Pricing and availability
• Payout and billing information (collected and processed by Stripe)

2.2 Information Collected Automatically

Usage Data:

• Device information (model, operating system, unique device identifiers)
• App usage patterns and interactions
• IP address and general location
• Log data (access times, pages viewed, crashes)
• Performance metrics

Location Data:

• Postcode/zip code (required for service matching)
• Approximate location based on IP address
• Precise device location captured at specific moments with your permission: when you create a job request (to match you with nearby Providers and show distances) and when a Provider captures job documentation photos (each photo is stamped with the position where it was taken, as evidence of work performed)
• We do NOT track your precise GPS location continuously or in the background

Communication Data:

• In-app messages between Customers and Providers
• SMS and email delivery status
• Push notification interactions

2.3 AI Processing Data

Video Analysis:

• Video recordings submitted by Customers
• AI-generated analysis and estimates
• Service categorization data
• This data is processed to provide estimates and match services

2.4 Payment Information

For Customers:

• When you pay through the app (In-App Payment / VÖR Protect), your card details are collected and processed directly by our payment processor, Stripe — we never see or store full card numbers
• We store transaction records (amounts, status, job reference) needed to operate the payment-protection flow and to meet bookkeeping obligations
• Where In-App Payment is not available, Customers pay Providers directly outside our platform and we process no Customer payment data

For Providers:

• Payout onboarding and payout details are collected and processed by Stripe (Stripe Connect); we receive account status, not bank credentials
• Where fees are invoiced (regions without In-App Payment), billing information is processed via Stripe

3. How We Use Your Information

3.1 Core Service Delivery

• Creating and managing your account
• Matching Customers with suitable Providers
• Processing video analysis with AI
• Facilitating communication between users
• Sending notifications about jobs and updates
• Processing Provider Success Fees

3.2 Service Improvement

• Analyzing usage patterns to improve features
• Personalizing user experience
• Developing new services
• Improving the quality of our AI estimates
• Troubleshooting technical issues

3.3 Safety and Security

• Preventing fraud and abuse
• Enforcing Terms and Conditions
• Protecting user safety
• Complying with legal obligations
• Resolving disputes

3.4 Communication

• Sending service-related notifications
• Responding to support requests
• Sending marketing communications (with consent)
• Notifying about policy changes

4. How We Share Your Information

4.1 Between Customers and Providers

Information Shared with Providers:

• Customer name
• Postcode (before job acceptance)
• Full address (after job acceptance)
• Video and job description
• Contact information (after job acceptance)
• Ratings and reviews

Information Shared with Customers:

• Provider name and business name
• Profile photo and description
• Service categories
• Ratings and reviews
• Contact information (after job acceptance)
• Adjusted estimates

4.2 Service Providers

We share information with third-party service providers:

AI processing providers:

Vör analyses your request using a combination of our own systems and external AI providers acting as our data processors.

• What we share: the video recording you submit (including its audio), the approximate location of the job, and the text of your job description.
• Why: to identify the work required, generate a cost estimate, and produce follow-up questions about the job.
• What we do not share: we do not send your payment details, your card data, or your contact details to any AI provider.
• Retention: video files are deleted from the AI provider automatically within 48 hours.
• Who: the providers currently engaged are named in our Sub-processor list. Each is bound by a data processing agreement requiring protection equivalent to that set out in this policy.

We ask for your explicit consent in the app — and show you what is sent and who it is sent to — before any recording is transmitted for AI analysis.

Changes to our providers. AI technology moves quickly, and we may add, replace or remove providers as the Service develops. The Sub-processor list is the authoritative, up-to-date record of who processes your data, and the in-app consent screen always names the providers in use at that moment. Where a change would materially affect how your personal data is processed — for example a new category of data being shared, or processing in a new jurisdiction — we will inform you before it takes effect. Routine substitutions that do not change what is shared or how it is protected are reflected in the Sub-processor list.

Firebase (Google):

• Account data
• Usage analytics
• Push notifications
• Crash reports

Amazon Web Services (Amazon SES):

• Email addresses and message content, for transactional email
• Processed in the EU (eu-north-1)

LinkMobility:

• Phone numbers and message content, for SMS notifications

Stripe:

• Customer payment transactions (In-App Payment)
• Provider payout onboarding and payout information (Stripe Connect)
• Transaction data for platform-fee and invoicing purposes

Cloud Storage:

• Video and image files
• User-generated content

4.3 Legal Requirements

We may disclose information when required by law:

• To comply with legal processes
• To respond to government requests
• To enforce our Terms and Conditions
• To protect rights, property, or safety
• In connection with fraud prevention

4.4 Business Transfers

If VÖR is involved in a merger, acquisition, or sale, your information may be transferred. We will notify you before your information is transferred and becomes subject to different privacy practices.

4.5 With Your Consent

We may share information for other purposes with your explicit consent.

5. Data Retention

5.1 Active Accounts

We retain your information while your account is active and as needed to provide services.

5.2 After Account Deletion

• Most data is deleted within 30 days
• Some data retained for legal compliance (e.g., transaction records)
• Anonymized analytics may be retained indefinitely
• Backups may contain data for up to 90 days

5.3 Legal Requirements

We retain data as required by law, including:

• Financial records (7 years)
• Dispute resolution records (as needed)
• Fraud prevention data (as needed)

6. Your Rights and Choices

6.1 Access and Correction

You can:

• Access your personal information
• Update or correct inaccurate data
• Request account deletion
• Export your data

How: Contact support@vor.rocks or use in-app settings

6.2 Marketing Communications

You can opt out of:

• Marketing emails (unsubscribe link in emails)
• Push notifications (device settings)
• SMS marketing (reply STOP)

Note: You cannot opt out of service-related communications

6.3 GDPR Rights (European Users)

If you are in the EU/EEA, you have rights under GDPR:

• Right to Access: Obtain copies of your personal data
• Right to Rectification: Correct inaccurate information
• Right to Erasure: Request deletion ("right to be forgotten")
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File complaints with supervisory authorities

To exercise these rights: Email privacy@vor.rocks

6.4 California Privacy Rights (CCPA)

California residents have rights under CCPA:

• Right to Know: What personal information we collect and how we use it
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt out of sale of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: Equal service regardless of privacy rights exercise

To exercise these rights: Email privacy@vor.rocks

6.5 Location Settings

You can:

• Disable location services (may limit functionality)
• Provide postcode manually instead of auto-detection

7. Data Security

7.1 Security Measures

We implement reasonable security measures:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Access controls and authentication
• Regular security assessments
• Secure cloud infrastructure

7.2 Your Responsibility

You are responsible for:

• Keeping login credentials secure
• Using strong passwords
• Not sharing account access
• Reporting security concerns

7.3 No Guarantee

No security measures are 100% secure. We cannot guarantee absolute security of your information.

8. Children's Privacy

Our Service is NOT intended for users under 18. We do not knowingly collect information from children. If you believe we have collected information from a child, contact us immediately, and we will delete it.

9. International Data Transfers

9.1 Data Location

Your information may be transferred to and processed in:

• Norway (primary data center)
• European Union
• United States (third-party services)

9.2 Safeguards

We use standard contractual clauses and other legal mechanisms to protect data transferred internationally.

10. Third-Party Links and Services

Our Service may contain links to third-party websites or services. We are not responsible for their privacy practices. Please review their privacy policies.

11. AI and Automated Decision-Making

11.1 AI Video Analysis

• We use AI to analyze videos and generate estimates
• The analysis combines our own systems with external AI providers, who act as our data processors. The providers in use are named in our Sub-processor list and on the consent screen in the app.
• Before your first video is sent, the app shows you what data is sent and who it is sent to, and asks for your consent. Nothing is sent unless you agree.
• Estimates are recommendations, not final decisions
• Providers can modify AI-generated estimates
• You can request human review by contacting support

11.2 Provider Matching

• AI helps match Customers with suitable Providers
• Matching considers location, category, and availability
• Final selection is made by the Customer

11.3 Translation Services

• We use AI for multi-language support
• Translations may not be 100% accurate
• Important communications are in your selected language

12. Cookies and Tracking

12.1 Mobile App

Our mobile app uses:

• Analytics SDKs (Firebase Analytics)
• Performance monitoring
• Crash reporting
• Push notification tokens

12.2 Website (vor.rocks)

Our website uses:

• Essential cookies (required for functionality)
• Analytics cookies (usage tracking, with consent)
• Marketing cookies (advertising, with consent)

To manage cookies: Use your browser settings or website cookie preferences

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Changes are effective when posted. We will notify you of material changes via:

• Email notification
• In-app notification
• Prominent notice on website

Continued use after changes constitutes acceptance.

14. Contact Us

14.1 General Inquiries

Email: support@vor.rocks
Website: https://www.vor.rocks

14.2 Privacy-Specific Inquiries

Email: privacy@vor.rocks

14.3 Data Protection Officer (if required)

For GDPR-related matters:
Email: dpo@vor.rocks

14.4 Mailing Address

VÖR
Akademiet for Kunstig Intelligens AS (AFKI)
Org. no. 933 480 860
Nydalsveien 28, 0484 Oslo, Norway

15. Legal Basis for Processing (GDPR)

We process personal data based on:

• Consent: When you provide explicit consent
• Contract Performance: To provide services you requested
• Legal Obligation: To comply with laws and regulations
• Legitimate Interests: For fraud prevention, security, and service improvement

16. Supervisory Authority

If you are in the EU/EEA and have concerns about our data practices, you can lodge a complaint with:

Norwegian Data Protection Authority (Datatilsynet)
Website: https://www.datatilsynet.no
Email: postkasse@datatilsynet.no