1. Introduction

Vorafy Limited ("Vorafy", "we", "us", or "our") is a New Zealand company that operates a brand-site builder platform at vorafy.com and portal.vorafy.com. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our services. It applies to all users — including brand owners (tenants), their customers, and visitors to vorafy.com. By using Vorafy, you agree to the practices described in this policy. If you do not agree, please do not use our services. This policy is governed by the New Zealand Privacy Act 2020.

2. Information We Collect

We collect information you provide directly, information generated through your use of our services, and information from third-party integrations you choose to connect.

2.1 Account information: your name, email address, and password when you register.
2.2 Brand and business information: your brand name, domain, logo, content, and any other information you enter into Vorafy to build your site.
2.3 Billing information: payment card details are processed and stored by Stripe. We do not store full card numbers on our servers.
2.4 Usage data: IP address, browser type, pages visited, and actions taken within the platform — used for security, analytics, and improving the service.
2.5 Third-party integration data: if you connect external services (such as Google Search Console), we collect only the data described in the relevant section of this policy.

3. How We Use Your Information

We use your information to provide, operate, and improve the Vorafy platform; process payments and manage subscriptions; send transactional emails; respond to support requests; monitor security and prevent fraud; and comply with legal obligations under New Zealand law.

4. Google API and Search Console Data

Vorafy integrates with the Google Search Console Data API to provide the SEO Insights feature. This section describes how we handle data obtained through Google APIs.

4.1 What we access: When you connect your Google account, we request read-only access to your Google Search Console data via the webmasters.readonly OAuth scope. This includes search query data (keywords, clicks, impressions, CTR, and average position) for the Search Console property you select.
4.2 Why we access it: We use this data solely to display keyword performance insights, rankings, and opportunity reports within your Vorafy dashboard. We do not use it for advertising, profiling, or any purpose unrelated to the SEO Insights feature.
4.3 Read-only access: Vorafy never writes to, modifies, or deletes any data in your Google Search Console account. Access is strictly read-only.
4.4 Data storage: Search Console query data is stored in your Vorafy account to power the SEO Insights dashboard. It is not shared with any third party, sold, or used for any purpose other than displaying insights to you within Vorafy.
4.5 Access tokens: OAuth access and refresh tokens are encrypted at rest. They are used only to fetch your Search Console data on your behalf and are never exposed to other users.
4.6 Disconnecting: You can disconnect Google Search Console at any time from your brand's Integrations page. Disconnecting revokes Vorafy's access. Previously synced keyword data remains in your account unless you request deletion.
4.7 Compliance: Our use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements.

5. Third-Party Service Providers

We share data with third-party providers only to the extent necessary to operate our platform. These providers are required to handle your data securely and in accordance with applicable privacy laws. We do not sell your personal information to any third party.

5.1 Stripe — payment processing. Card data is handled directly by Stripe (stripe.com/privacy).
5.2 DigitalOcean Spaces — cloud storage for media files and brand assets.
5.3 Resend — transactional email delivery for account notifications and password resets.
5.4 Google LLC — Search Console API integration (described above). See policies.google.com/privacy.

6. Data Security

We take reasonable technical and organisational measures to protect your personal information from unauthorised access, loss, or disclosure. These include encryption of sensitive data at rest (including OAuth tokens), HTTPS across all Vorafy domains, and access controls limiting staff access to production data. No system is completely secure. If you become aware of a security issue, please contact us at privacy@vorafy.com.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. If you close your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it by law (e.g. billing records for tax purposes). Google Search Console data synced to your account is retained until you disconnect the integration and request deletion, or close your account.

8. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to access the personal information we hold about you, request correction of inaccurate information, and request deletion of your personal information (subject to legal retention obligations). You may also lodge a complaint with the New Zealand Privacy Commissioner at privacy.org.nz. To exercise any of these rights, contact us at privacy@vorafy.com.

9. Cookies

Vorafy uses cookies to maintain your session, remember preferences, and improve your experience. We do not use third-party advertising cookies. You can disable cookies in your browser, but some features may not function correctly without them.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date and notify registered users by email for material changes. Continued use of Vorafy after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us: Vorafy Limited Email: privacy@vorafy.com Website: vorafy.com