Privacy Policy

Effective Date: August 6, 2026

Last updated: August 6, 2026

Vorda Holdings LLC, a Delaware limited liability company ("Vorda," "we," "us," or "our") operates an agentic operating system for one human being, a personal-management platform that, with your permission, connects to your bank, card, and brokerage accounts, your calendar, and your email inboxes (and, over time, additional sources you opt into) so that it can help you manage money, time, and inbox in one place. This Privacy Policy explains how we handle your information when you create an account, connect data sources, use Vorda, or otherwise interact with Vorda at usevorda.com and our mobile applications (collectively, the "Services").

The data Vorda touches is unusually sensitive: your transactions, your meetings, the people you talk to, what they wrote you, what you have not replied to. We treat it that way. The commitments below are deliberately strict: we do not sell your data, we do not share it with advertisers, we do not use it to train machine-learning models, and we do not allow humans to read your connected-account data except in the narrow circumstances described in Section 4.

By accessing the Services, you confirm that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.

1. Information We Collect

1.1 Information You Provide When You Sign Up

When you create a Vorda account you provide:

• Identity and contact details: name, email address, and (optionally) a profile photo. Authentication is handled by Firebase Authentication; we receive the verified email and a stable Firebase user identifier.
• Preferences: time zone, briefing channel (email, push, or both), preferred briefing time, AI model preference (Claude or OpenAI), and daily token-budget settings.

1.2 Information We Collect via Connected Accounts ("Connector Data")

You explicitly connect each data source on the /connectors page. Once connected, we periodically sync data from that source so the platform can show it back to you and so Vorda can answer questions about it. The current sources are:

• Plaid (bank accounts and credit cards). When you complete Plaid Link, we receive an access token and item identifier, and we sync your accounts (name, type, mask, balances), transactions (date, amount, merchant, category, payment channel), and liabilities (statement balances, due dates) covering up to the maximum history Plaid provides for the institution (typically 24 months). We do not receive online-banking usernames or passwords; Plaid holds those.
• Google Calendar. When you complete the Google consent flow we receive a refresh token and access token. We sync your calendar events (title, time, location, attendees, description, conferencing link) from the calendars you grant access to. We currently use the read-only Calendar scopes.
• Gmail. When you complete the Google consent flow we receive a refresh token and access token. We sync your email threads and messages (headers, meaning sender, recipients, subject, date; the message body in text/plain and text/HTML; attachment counts but not attachment binaries) from up to three Gmail mailboxes per Vorda account that you explicitly grant access to. We use gmail.readonly to read and gmail.modify solely to create drafts in your Gmail Drafts folder for you to review and send. We never send mail on your behalf. The Vorda codebase contains no users.messages.send code path.
• Vorda Health (Apple HealthKit and Oura). When you install the Health Skill you connect your own body and training data from two sources. Apple HealthKit is read on your device under your per-category HealthKit permission (no health data is sent to Apple by us); Oura is connected through Oura's OAuth consent flow, and we sync your Oura data from the Oura API. Across these sources we sync your workouts and training (including cardio, and recovery sessions such as sauna, cold plunge, and mobility), sleep (sessions and sleep stages), heart-rate variability, resting heart rate, and Oura readiness / sleep / activity scores, activity and energy (steps, active energy, exercise minutes), body composition (weight, body-fat percentage, lean mass), vitals (blood pressure, SpO2, respiratory rate, body and wrist temperature), cardiorespiratory fitness (VO2 max), and mindfulness minutes. We also derive rolling baselines (for example your 7-day HRV and 30-day resting-heart-rate baselines) to power recovery and anomaly signals. This is health and biometric data, a sensitive category: we never sell it, never share it with advertisers, and never use it to train machine-learning models (see Sections 4 and 5).

Additional Connectors, for example journal, goals, news, investments, tax, travel, and memberships, may be added over time. Each new Connector is opt-in: you authorize it through that source's own consent flow before any data is synced, this Privacy Policy and the Subprocessors list are updated before the new Connector becomes available to you, and the Connector can be revoked at any time on the schedule described in Section 5.

1.3 Information We Generate About You

To make the platform useful we derive a second layer of information from your raw connector data:

• Categorization and tagging of transactions, threads, and events (e.g., "needs reply," "VIP," "unusual spend").
• Briefings and insights: the morning briefing, weekly summary, and ad-hoc anomaly alerts Vorda produces. These are stored in your account so you can re-read them.
• Agent events: discrete signals Vorda watches for (e.g., large_transaction, calendar_conflict, vip_email_silent_too_long). These are AI memory, not raw audit logs.
• Cross-Skill connections: once you have connected two or more Skills, Vorda may connect signals across them when writing your briefing, for example noting that a dinner on tonight's calendar is one your rewards card earns more on, or that a rise in dining spend lines up with dinners you have scheduled. Where a connection is stored as a structured record rather than as briefing text, we also record which specific items it rests on, for example the card and the calendar event it joined, so it is clear what Vorda concluded and why. Vorda receives no compensation for these recommendations. A connection is kept in two places: as part of the briefing that contains it, and, where it is stored as a structured record, in a standalone list you can review and delete at any time in /settings (see Section 8.1). That standalone record also notes when Vorda last drew on it. When you delete a connection, we delete that standalone record and keep a fingerprint of it, a hash rather than the connection itself, which exists only so Vorda does not draw the same conclusion again. The briefing that already contained the connection is kept as written, so deleting a connection does not edit briefings you have already been sent. Retention for all three is in Section 5. These connections are used to serve you inside Vorda and to measure whether the feature is useful, which we report only in aggregate. We do not sell them, we do not share them, and we do not use them to train machine-learning models.
• Conversation history: messages you exchange with Vorda, the tools it invoked, and the responses returned.
• Intents: proposed write actions (e.g., draft a reply, label a thread) that require your approval before execution.
• Training plans: if you use training plans in Vorda Health, the plan we generate for you, its revisions, your benchmark results, and your adherence records. Because that data starts from a goal and constraints you write yourself, it is described in full in Section 1.6.

1.4 Information We Collect Automatically

When you use the Services we automatically collect:

• Device information: IP address, browser type and version, operating system, device identifiers, and language settings.
• Usage information: pages visited, features used, session duration, and aggregated interactions with the Platform.
• Authentication information: Firebase ID tokens (short-lived) and, if you opt in, biometric identifiers used by your device locally for sign-in (these never leave your device).
• Server logs: error reports and performance data used to diagnose issues. Logs never contain decrypted tokens, decrypted email content, or full account numbers.

1.5 Information from Third Parties

We may receive limited information about you from:

• Plaid: the verified institution identity, account masks, and the connection-status webhook stream tied to your linked items.
• Google: the verified sub (Google user id) and email claims from the OAuth id_token, plus the webhook / Pub/Sub change notifications for Calendar and Gmail.
• Firebase Authentication: the verified identity provider, email-verification status, and MFA status reported by Google's Identity Platform.
• Apple HealthKit, which provides the health and workout samples you permit Vorda to read on your device. HealthKit shares that data with the Vorda app on-device under your per-category permission, and we sync it to Vorda; we send no health data to Apple.
• Oura, which provides your verified Oura account data (sleep, readiness, activity, HRV, and related biometrics) retrieved from the Oura API under your OAuth grant.

1.6 Training Data (Vorda Health Training Plans)

If you use training plans in Vorda Health, we hold a second class of health data. It is not synced from Apple HealthKit or Oura: part of it you write yourself, and part of it we generate for you.

• Provided by you: the training goal you set (goal type, event name and date, start date, plan length, sessions per week, your self-reported experience level, and the gym whose equipment the plan should assume) and the free-text context you write to shape the plan. That field is there for your constraints, and people write injuries and medical limitations into it (for example "bad knee, no running"). We treat what you write there as health information about you. The field is optional: you can leave it blank, or describe a limitation without naming a diagnosis. If you import a plan instead of generating one, the plan text you paste is also data you provide, and it may carry the same kind of health information.
• Generated by Vorda: the plan itself and every revision of it (with the reason for the change and whether you, Vorda, or the system made it), the weekly phases and targets, the prescribed sessions, your benchmark results (measured tests such as a timed run, a max-repetition set, or a one-rep-max lift) and the training zones we derive from them, and adherence records that link each prescribed session to what you actually logged.

We use training data to generate and revise your plan, to warn you when a scheduled session conflicts with a constraint you stated, to resolve your training zones from your benchmarks, and to let Vorda answer questions about your plan and your adherence. We treat all of it the way we treat your synced health data: we never sell it, never share it with advertisers, and never use it to train machine-learning models. It is disclosed only to our zero-retention AI subprocessors (Anthropic, or OpenAI if you enable it) at inference time, when a plan is generated or revised or when you ask Vorda about it (see Sections 3 and 4). No additional subprocessor is involved: training plans add no new vendor to the list in Section 11.

Deleting a plan deletes that plan and everything held under it: its revisions, its prescribed sessions, and the adherence records for those sessions. Your benchmark results are kept at the account level, not under one plan, because they describe your measured performance across plans and set your training zones, so deleting a plan detaches a benchmark from it but does not delete the result. Benchmarks are deleted when you uninstall Vorda Health or close your account. The full schedule is in Section 5.

1.7 Sensitive Information

By its nature, Connector Data may include financial transactions, calendar meetings, and email correspondence that are sensitive to you. If you install Vorda Health, it also includes health and biometric data from Apple HealthKit and Oura (see Section 1.2), which is a special category of personal data. We collect health and biometric data only when you install the Health Skill (an opt-in action) and grant the relevant source through its own permission step: the iOS Health permission sheet for Apple HealthKit (which records the specific categories you grant) and Oura's OAuth grant for Oura. Where the law requires explicit consent for this special category (for example under the GDPR), that consent is the affirmative grant you give in those steps. Like all your health data, we never sell it or share it with advertisers, and it is disclosed only to our zero-retention AI subprocessors at inference time (see Sections 3 and 4). You decide which sources to connect and which accounts to grant. You may disconnect any source at any time from /connectors, which immediately stops syncing and triggers the deletion described in Section 5.

Your training data is in the same special category. A constraint you type, such as "bad knee, no running," states a medical condition, and the plans, benchmarks, and adherence records we generate from it describe your body and your health. We give the whole of Section 1.6 the same special-category treatment as your synced health data, even though it comes from you and from us rather than from a connected source. Where the law requires explicit consent for this category (for example under the GDPR's Article 9, and under U.S. consumer-health-data laws that treat this information as sensitive), we ask you for it directly. Before you can save a constraint or import a plan, we show you what the data is, that it goes to our AI providers under zero-retention terms, that we never sell it or use it to train models, and how to withdraw. We record that you agreed, which version of that wording you were shown, and when. We also record a fingerprint of the exact text on your screen and check it against the published wording, so your consent can never be recorded against a paragraph you did not read. The constraint field is still optional: you can use training plans without describing a medical condition, and if you leave it empty we do not ask you for anything. You can withdraw in Settings at any time, which stops us using it going forward. Because this data is not synced from Apple HealthKit or Oura, disconnecting either source does not by itself delete it; uninstalling the Health Skill or closing your account does, and deleting a plan removes the records held under that plan, on the schedule in Section 5.

2. How We Use Your Information

We use your information for the following purposes:

• Provide the Services. Operate the dashboards (/money, /calendar, /inbox), run Vorda chat, generate daily and weekly briefings, fire anomaly alerts, and let you triage and draft replies to email.
• Connect and sync your accounts. Refresh OAuth and Plaid tokens, run incremental syncs on webhook delivery, and back-fill data where the source supports it.
• Communicate with you. Send the briefings and anomaly alerts you have configured, plus service-related messages (security notices, billing, OAuth-grant expiry warnings).
• Improve the Services. Diagnose errors, monitor performance, and refine features based on aggregated, de-identified usage signals. We do not use Connector Data, Vorda conversations, or any user content to train machine-learning models.
• Security and abuse prevention. Detect and respond to fraud, unauthorized access, and conduct that violates our Terms of Service.
• Legal compliance. Comply with applicable laws, regulations, and lawful requests.

We will never use your information for cross-context behavioral advertising or for targeting by third parties.

3. How We Share Your Information

We share your information only as described below.

• With service providers (subprocessors). We share information with vendors who help us run the Services, under contracts that require them to protect your information and use it only for our purposes. The current roster lives in Subprocessors.md (Section 11 below summarizes it) and at <https://usevorda.com/legal/subprocessors>.
• With AI providers, under zero-retention enterprise terms. When you use Vorda chat or receive a generated briefing, the relevant portion of your data is sent to Anthropic and/or OpenAI for inference under enterprise agreements that contractually require zero retention of inputs/outputs and no training on your data. See Section 4 for the full Limited Use commitment.
• For legal reasons. We may disclose information when required by law, regulation, legal process, or governmental request, and to protect the rights, property, or safety of Vorda, you, or others.
• With your explicit consent, for purposes you have specifically agreed to.
• In a business transfer. If Vorda is involved in a merger, acquisition, financing, or sale of assets, your information may transfer as part of that transaction. We will notify you in advance and your information will continue to be protected by this Privacy Policy or an equivalent successor.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We do not provide your personal information to advertisers, data brokers, or third-party targeting platforms.

4. Limited Use Commitments for Google Workspace APIs

Vorda's use of information received from Google APIs (Gmail and Google Calendar) adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

1. Only to provide user-facing features. Data accessed via Gmail and Calendar APIs is used only to provide and improve the features described in this Privacy Policy: inbox triage, calendar overview, draft replies, briefings, and the AI assistant. It is not used for any unrelated purpose.
2. No transfer for unrelated purposes. We do not transfer Gmail or Calendar data to third parties except (a) as necessary to provide or improve the features above, (b) to comply with applicable law, (c) as part of a merger, acquisition, or sale of assets with appropriate notice to you, or (d) with your affirmative consent.
3. No advertising. We do not use Gmail or Calendar data for advertising purposes, including but not limited to serving, retargeting, personalizing, or ranking advertisements.
4. No human reading. We do not allow humans to read your Gmail or Calendar data unless (a) we have obtained your affirmative consent, (b) it is necessary for security purposes (such as investigating abuse or a bug you have reported), (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymized so it cannot be linked back to you. Access requests from Vorda personnel are logged in our audit-trail system.
5. No model training. We do not use Gmail or Calendar data to develop, improve, or train generalized or non-personalized AI/ML models. Our AI subprocessors (Anthropic and OpenAI) operate under enterprise agreements that contractually require zero retention of inputs and outputs and prohibit training on customer data.

The same Limited Use commitments apply to Plaid financial data and to any other Connector Data we hold on your behalf, by our own choice.

5. Data Retention and Deletion

We retain your information for as long as your account is active and as needed to provide the Services. The retention windows below apply per data class.

You may request earlier deletion at any time by emailing privacy@usevorda.com or by deleting your account in /settings → Account.

6. Data Security

We protect your information using technical and organizational measures appropriate to its sensitivity, including:

• Encryption in transit using TLS 1.3 (or, where 1.3 is not supported by the requesting client, TLS 1.2).
• Encryption at rest using AES-256-GCM for all sensitive data, including every OAuth token, Plaid item, and webhook payload. Master keys are managed by Google Cloud Secret Manager and are rotated; ciphertext is versioned so rotation does not require a full re-encryption pass.
• Token isolation. OAuth tokens are decrypted only at point of use and never written to logs or analytics pipelines. The credential-storage helper (services/connectors/shared/credentials.ts in our source tree) is the single audited code path that reads or writes tokens.
• Multi-tenant discipline from day one. Every domain table has a user_id column with composite indexing, and every database query in router code goes through a scoped database helper that auto-applies a WHERE user_id = ... filter. A CI lint test fails any pull request that imports the raw database client in a router file.
• Access controls including role-based access, the principle of least privilege, multi-factor authentication for administrative access (provided by Firebase Identity Platform), and automated session timeout.
• Audit logging of access to user data. Every authenticated request and every administrative action writes an immutable row to audit_logs, also exportable to Google Cloud Logging.
• Webhook idempotency. Inbound webhook deliveries from Plaid and Google are deduplicated against a webhook_deliveries table so retries never produce duplicate data or duplicate actions.
• Edge protections. Cloudflare provides DNS, DDoS mitigation, and an edge-level web application firewall for traffic to usevorda.com and api.usevorda.com. Google Cloud Armor enforces geographic restrictions consistent with U.S. export-control and sanctions law (see Section 18 of the Terms of Service).
• Regular vulnerability scanning and penetration testing of the Platform.
• Secure software development practices and protections against the OWASP Top 10.
• Vendor risk management. Every subprocessor in Section 11 is contractually bound to protect your information.
• Independent security review. We plan to commission a Cloud Application Security Assessment (CASA) Tier 2 prior to opening Vorda to external users beyond initial testing.

No system is perfectly secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a security incident affecting your information, we will notify you and applicable regulators consistent with applicable law.

7. International Users and Data Transfers

Vorda Holdings LLC is organized under the laws of Delaware, and our primary infrastructure is hosted on Google Cloud Platform in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States and may also be processed by our AI subprocessors in the United States.

For transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable) or another lawful transfer mechanism. We perform transfer impact assessments where required.

8. Your Rights and Choices

Depending on your location, you may have the rights described below. We will respond to verified requests within the timeframes required by applicable law.

8.1 Rights Available to All Users

• Access: request a copy of the personal information we hold about you, including a structured export of your Connector Data.
• Correction: ask us to correct information that is inaccurate or incomplete (you can also edit your own profile and preferences in /settings).
• Deletion: ask us to delete your information, subject to the limited exceptions described in Section 5.
• Portability: request a copy of your information in a structured, machine-readable format (JSON).
• Disconnect a source: revoke any connector at any time from /connectors; we stop syncing immediately and proceed with deletion per Section 5.
• Manage what Vorda connects across your Skills: review every cross-Skill connection it holds as a standalone record, in the words your briefing used, and delete any of them or all of them, in /settings. Deleting is permanent in both directions: the record goes, and Vorda is stopped from drawing that same connection again. This does not edit briefings you have already been sent, which are kept as written per Section 5.
• Opt out of non-essential communications: turn off briefings, push notifications, or marketing emails in /settings → Notifications. Service-related communications (e.g., security notices, billing) cannot be opted out of while your account is active.

8.2 Additional Rights for EEA, UK, and Swiss Residents

If you are located in the EEA, the United Kingdom, or Switzerland, you also have the right to:

• object to or restrict our processing of your personal data;
• withdraw consent at any time where we rely on your consent;
• lodge a complaint with your local supervisory authority.

We process your personal data on the following legal bases under the GDPR / UK GDPR:

• Contract: to provide the Services that you have requested.
• Legitimate interests: to operate, secure, and improve the platform and to prevent abuse. We have balanced these interests against your rights.
• Legal obligation: to comply with applicable law.
• Consent: where we ask for it (e.g., optional marketing communications, optional AI features that send your Connector Data to AI subprocessors).

8.3 Additional Rights for California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know, delete, and correct your personal information; to opt out of "sale" or "sharing" of personal information; and to non-discrimination for exercising these rights.

We confirm: we do not sell or share personal information in the senses defined by the CCPA/CPRA. We do not engage in cross-context behavioral advertising.

8.4 Exercising Your Rights

To exercise any of these rights, contact privacy@usevorda.com. We may need to verify your identity before responding. You may also designate an authorized agent to act on your behalf, subject to verification.

9. Children's Privacy

The Services are not intended for, or directed to, individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a child has provided information to us, please contact privacy@usevorda.com.

10. Third-Party Links and Services

The Platform may link to or integrate with third-party sites or services (for example, the institution-selection screens that Plaid renders, or a "View in Gmail" link). This Privacy Policy does not apply to those services, and we are not responsible for their practices. Review their privacy policies before using them.

11. Subprocessors

We rely on the subprocessors below to provide the Services. Each is contractually bound to protect your information. The authoritative list, including the data classes shared with each subprocessor and the legal mechanism for any international transfer, lives in Subprocessors.md in our public legal repository and at <https://usevorda.com/legal/subprocessors>.

We may update this list. Material changes are published at <https://usevorda.com/legal/subprocessors> and, for institutional partners under a Data Processing Agreement, notified with the lead time required under that agreement.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date above and provide notice through the Platform or by email. Your continued use of the Services after the change becomes effective constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

For privacy questions or requests:

Vorda Holdings LLC Privacy: privacy@usevorda.com Legal: legal@usevorda.com Security: security@usevorda.com Website: usevorda.com

EEA, UK, and Swiss residents may also contact their local supervisory authority. The lead supervisory authority for our processing of EEA personal data is the Irish Data Protection Commission.