Privacy Policy
We believe project management and client collaboration should never come at the expense of your privacy. Here is a clear, transparent breakdown of how Vorlio handles and protects your data.
Your Data Stays Yours
Vorlio is built to run on your own infrastructure or secure cloud instance. We never sell, monetize, or harvest your team or client data.
Zero Third-Party AI Scraping
Vorlio AI (Ask Vorlio, Daily Brief, transcripts) runs privately. Your workspace files, docs, and messages are never fed to external AI training sets.
Strict Role-Based Isolation
Private spaces, internal notes, and unbilled timesheets remain invisible to external client guests and restricted members.
Full Export & True Deletion
Export all your tasks, documents, and timesheets at any time in open formats. 30-day trash recovery with complete purge on demand.
1. Overview & Scope
Vorlio (“we”, “us”, or “our”) provides an integrated project management and client collaboration workspace available at app.vorlio.site and as a self-hosted software solution. This Privacy Policy details our commitments regarding the collection, processing, and safeguarding of personal data.
Our core architectural rule is simple: your work belongs to you. Whether you track time, conduct video calls, store confidential client deliverables, or run automations, we treat your content with strict confidentiality and provide transparent controls over who can view it.
2. Information We Collect
Depending on how you interact with Vorlio, we process the following categories of information:
- Account & Profile Information: When you register or join a workspace, we collect your name, email address, hashed password, and optional avatar image.
- Workspace Content & Projects: Tasks, subtasks, descriptions, custom fields, deadlines, priorities, status workflows, documents, comments, attachments, checklist items, and sprint backlogs created inside your workspace.
- Time Tracking & Timesheets: Active timer sessions, manual time logs, billable and non-billable hour classifications, hourly rates, and timesheet approvals.
- Billing & Invoice Data: Client billing details, line items, applied taxes, discounts, and payment status records generated within Vorlio Invoices.
- Technical & Device Telemetry: IP addresses, browser user agent, session authentication tokens (
epm_*), and access logs maintained for rate limiting, security auditing, and fraud prevention.
3. How We Use Your Information
We process your data strictly to fulfill our contractual commitments and service functions, including:
Delivering Core Features
Powering real-time collaboration, board updates via WebSockets, task assignments, and calendar syncing.
Enforcing Access Control
Ensuring workspace boundaries, private spaces, and guest visibility restrictions are strictly upheld.
Timesheet & Invoice Preparation
Calculating billable summaries and converting tracked team time into clear, editable invoices.
Security & Account Integrity
Validating two-factor authentication, verifying API keys, signing webhooks, and preventing brute force attacks.
We do not sell your personal information. We do not serve third-party behavioral ads, nor do we profile your team for advertising networks.
4. Audio, Video Meetings & Voice Notes
Vorlio includes native video conferencing, screen sharing, and audio calling designed to bypass commercial snoopers:
- Internal Media Servers: Audio and video streams flow directly through Vorlio’s dedicated media architecture. They are not relayed through third-party video call platforms.
- Voice Notes: When you record a voice message, audio files are processed for speech-to-text transcription. Once the transcription is completed, audio temporary buffers are promptly discarded.
- Meeting Recordings & Notes: Recordings and AI-assisted meeting summaries remain exclusively inside your workspace and are accessible only by authorized participants.
5. Vorlio AI & Machine Learning
Features such as Ask Vorlio AI, Daily Brief summaries, and automated task synthesis operate under strict confidentiality constraints:
Permission-Aware Retrieval
When you ask Vorlio AI a question, it queries only the tasks, docs, discussions, and meeting notes that your user account already has explicit permission to view. It never leaks confidential data from private Spaces you cannot access.
On self-hosted instances, Vorlio AI runs on your own server hardware. Under no circumstances is your proprietary workspace data used to train public foundation models.
6. Client Portal & Guest Separation
When working with outside clients, freelancers, or contractors, Vorlio enforces strong isolation barriers:
- Guests only see the specific Spaces, reviews, or docs explicitly shared with them.
- Internal team comments, internal task estimations, member profiles, and unbilled timesheets are hidden from client view.
- Clients and guests cannot see other clients or workspaces hosted on the same installation.
7. Security & Safeguards
We employ comprehensive technical and operational measures to safeguard your information against unauthorized access, alteration, or disclosure:
- Encryption: All network traffic is encrypted in transit using industry-standard TLS (HTTPS / WSS).
- Authentication: Time-based one-time passwords (TOTP 2FA) and active session management with one-click remote device revocation.
- API Security: Personal API tokens are stored using cryptographic hashes (
vor_*) and webhooks are signed via HMAC-SHA256 headers. - Read more: Review our full security architecture on our Security & Architecture page.
8. Retention & Deletion
Deleted tasks, documents, and lists are held in the workspace Trash for 30 days to protect against accidental loss. After 30 days, or upon explicit purge by a workspace administrator, items are permanently deleted.
When a workspace owner terminates an account or deletes a workspace, all associated records, attachments, and user memberships are permanently excised from live databases. Workspace owners can generate full CSV, JSON, and document exports at any time prior to account deletion.
9. Your Privacy Rights (GDPR & CCPA)
Regardless of your geographic location, Vorlio provides standard rights over your personal data:
Request a copy of all personal data and workspace items in machine-readable format.
Update or correct inaccurate profile, company, or task details directly in Settings.
Request complete deletion of your user account and personal history from our servers.
Revoke integrations, disable push notifications, or turn off calendar feed subscriptions at any time.
10. Contact Us
For any privacy inquiries, data deletion requests, or questions regarding our data handling practices, reach out directly to our privacy officer:
Put your team’s work in one place.
Set up your company, invite the team and start your first project in a few minutes.