VORAH LLC
PRIVACY POLICY
Version 1.0 | Effective Date: April 17, 2026 | Governing Law: Commonwealth of Pennsylvania
Vorah LLC | 4203 Union Deposit Rd #1210, Harrisburg, PA 17111 | privacy@vorahhq.com | www.vorahhq.com
THIS PRIVACY POLICY DESCRIBES HOW VORAH LLC COLLECTS, USES, STORES, AND SHARES INFORMATION FROM BROKERS, AGENTS, AND BUYERS WHO USE THE VORAH PLATFORM AND WEBSITE. PLEASE READ THIS POLICY IN FULL BEFORE USING THE PLATFORM OR WEBSITE. BY USING THE PLATFORM OR WEBSITE YOU AGREE TO THE PRACTICES DESCRIBED IN THIS POLICY.
1. WHO WE ARE AND HOW TO CONTACT US
Vorah LLC is a Pennsylvania limited liability company that operates a buyer intelligence platform for licensed real estate professionals. Our Platform enables listing agents to upload property video tours, generate trackable Smart Links for distribution to prospective buyers, collect room-by-room buyer reaction data, and deliver Intelligence Reports to agents and brokers before in-person showings.
Company
Vorah LLC
Privacy Contact
privacy@vorahhq.com
Legal Notices
legal@vorahhq.com
Mailing Address
4203 Union Deposit Rd #1210, Harrisburg, PA 17111
Website
www.vorahhq.com
Privacy Policy URL
www.vorahhq.com/privacy
For all privacy-related requests, questions, complaints, or data deletion requests, contact us at privacy@vorahhq.com. We will respond to all privacy requests within thirty (30) calendar days of receipt, and within forty-five (45) calendar days for California residents exercising CCPA rights.
2. SCOPE OF THIS PRIVACY POLICY
This Privacy Policy applies to:
Information collected from Brokers and Agents who create accounts and subscribe to the Platform.
Information collected from Buyers who access Smart Links and interact with property video tours through the Platform.
Information collected from visitors to www.vorahhq.com, whether or not they create an account.
Information collected through Vorah's mobile application used by Brokers and Agents.
This Privacy Policy does not apply to third-party websites, services, or applications that may be linked from the Platform or website. Vorah is not responsible for the privacy practices of any third party.
DOCUMENT FRAMEWORK: This Privacy Policy is one component of Vorah's four-document legal framework alongside the Terms of Service, the Early Access and Subscription Agreement, and the Buyer Consent Notice. In the event of any conflict between this Privacy Policy and the Terms of Service regarding liability, remedies, or obligations, the Terms of Service controls.
3. THE THREE CATEGORIES OF PEOPLE WE COLLECT DATA FROM
Vorah collects different categories of data from three distinct groups of people. Understanding which category applies to you determines what data we collect, why we collect it, and what rights you have.
3.1 Brokers and Agents — Platform Subscribers
Brokers and Agents are licensed real estate professionals who subscribe to the Platform, create accounts, upload property video tours, generate Smart Links, and receive Intelligence Reports. Brokers and Agents actively choose to use the Platform and provide information as part of their subscription.
3.2 Buyers — Smart Link Users
Buyers are prospective real estate purchasers who receive a Smart Link from a Broker or Agent and choose to interact with a property video tour through the Platform. Buyers do not have paid accounts. Buyers interact with the Platform only through Smart
Links distributed by Brokers or Agents. Buyers must consent to data collection before any data is collected from them through the Buyer Consent Notice displayed before every Smart Link session.
3.3 Website Visitors
Website Visitors are individuals who visit www.vorahhq.com without necessarily creating an account or accessing a Smart Link. Website Visitors may include prospective customers, brokers evaluating the Platform, buyers who navigate to the website independently, and members of the general public.
4. WHAT INFORMATION WE COLLECT AND WHY
4.1 Information We Collect from Brokers and Agents
When Brokers and Agents create accounts and use the Platform, we collect:
Full name and contact information
Name, email address, phone number, and brokerage name provided at registration.
Real estate license information
Broker license number, state of licensure, and brokerage affiliation provided at registration or in the executed subscription agreement.
Account credentials
Hashed and encrypted passwords. We never store passwords in plain text.
Property video content
Video tours uploaded to the Platform, including the property address, listing details, and any other information included in the video or associated metadata.
Platform usage data
Login timestamps, pages visited within the Platform, features accessed, Smart Links generated, Intelligence Reports viewed, and session duration.
Communication records
Emails, support requests, and other communications sent to Vorah.
Payment metadata
Payment confirmation records, invoice history, and subscription status processed through Stripe. We do not store full credit card numbers, CVV codes, or bank account information. All payment data is processed and stored by Stripe under Stripe's Privacy Policy.
Device and browser information
IP address, device type, operating system, and browser version used to access the Platform.
Why we collect this: to provide the Platform, process payments, verify license eligibility, generate Intelligence Reports, deliver customer support, comply with our legal obligations, and improve Platform performance.
4.2 Information We Collect from Buyers
BUYERS: YOUR DATA IS SHARED WITH THE LISTING AGENT AND BROKER WHO SENT YOU THE SMART LINK. THIS IS DISCLOSED IN THE BUYER CONSENT NOTICE YOU SEE BEFORE EVERY SMART LINK SESSION. IF YOU DID NOT CONSENT, NO DATA WAS COLLECTED FROM YOU.
When a Buyer clicks the consent button on the Buyer Consent Notice and interacts with a Smart Link, we collect:
Smart Link session identifier
A unique ID assigned to each Smart Link session that connects the Buyer's engagement data to the specific listing.
Consent record
Timestamp of consent, IP address at time of consent, device and browser information, and the version number of the Buyer Consent Notice displayed. This record is created the moment a Buyer clicks consent and before any viewing data is collected.
Video viewing behavior
Which rooms or sections of the property video the Buyer watched, how long they spent on each room, which rooms they replayed, and which rooms they skipped or fast-forwarded through.
Reaction tag selections
Room-by-room emotion tags selected by the Buyer during the tour — such as indicating they loved, were neutral about, or skipped a particular room.
Access timestamps
The date and time the Smart Link was accessed and the duration of the session.
IP address and device information
Used to generate the consent record and to prevent fraudulent or automated Smart Link access. Not used to identify Buyers by name or to infer Protected Characteristics.
What we do NOT collect from Buyers: We do not collect Buyer names, email addresses, phone numbers, social media profiles, financial information, credit scores, or any information about any Buyer's race, color, religion, national origin, sex, disability, familial status, sexual orientation, gender identity, source of income, or any other Protected Characteristic. The Platform has no mechanism to collect Protected Characteristic information and is not designed to do so.
Why we collect Buyer data: to generate the Intelligence Report delivered to the listing Agent and Broker, to maintain the consent record required by applicable privacy law, and to improve Platform performance using aggregated and anonymized behavioral data.
Who receives Buyer data: The listing Agent and Broker who generated the Smart Link receive the Intelligence Report summarizing the Buyer's engagement. Vorah does not sell, rent, or share Buyer Engagement Data with any other party except as described in Section 6.
4.3 Information We Collect from Website Visitors
When individuals visit www.vorahhq.com, we collect the following through Google Analytics and Google Maps, subject to the visitor's cookie consent choice:
Google Analytics
Pages visited, time spent on each page, navigation paths, referring website, approximate geographic location derived from IP address, device type, browser type, and operating system. Google Analytics is only activated after a visitor accepts cookies through the cookie consent banner. No Google Analytics data is collected from visitors who decline cookies.
Google Maps
Location interaction data derived from IP address when a visitor interacts with map features on the website. Google Maps cookies are blocked for visitors who decline optional cookies.
Cookie consent record
The visitor's cookie choice (accept or decline), the timestamp of that choice, the banner version displayed, and the visitor's approximate IP address. This record is maintained regardless of the visitor's choice and is retained for two (2) years for regulatory compliance purposes.
Server logs
Standard web server logs including IP address, page requested, timestamp, and HTTP response code. Retained for ninety (90) days for security monitoring purposes.
Why we collect website visitor data: to understand how visitors use our website, to improve website performance and content, and to enable location-based features. We do not use website visitor data to identify individual visitors by name or to make decisions about any individual.
4.4 Information We Do Not Collect — Ever
Vorah does not collect, store, or process:
Any information about any Buyer's race, color, religion, national origin, sex, disability, familial status, sexual orientation, gender identity, source of income, or any other Protected Characteristic under applicable federal, state, or local law.
Full credit card numbers, CVV codes, or bank account information — all payment processing is handled exclusively by Stripe.
Social Security numbers or government identification numbers.
Health or medical information of any kind.
Biometric data of any kind.
Children's personal information — the Platform and website are not directed at individuals under the age of eighteen (18) and we do not knowingly collect information from anyone under eighteen.
5. HOW WE USE THE INFORMATION WE COLLECT
Vorah uses the information we collect for the following purposes:
Providing the Platform
To create and manage Broker and Agent accounts, process subscriptions, generate Smart Links, collect Buyer Engagement Data, generate Intelligence Reports, and operate the Broker dashboard.
Processing payments
To charge subscription fees, process renewals, issue refunds where applicable, and maintain payment records. Payment processing is handled by Stripe.
Delivering Intelligence Reports
To compile Buyer Engagement Data from Smart Link sessions into Intelligence Reports delivered to the listing Agent and accessible to the Broker.
Sending notifications
To send Brokers and Agents push notifications and email notifications through OneSignal regarding new Buyer engagement, new Intelligence Reports, account activity, and Platform updates. OneSignal is used exclusively within the mobile and web application and is not used on the public website.
Customer support
To respond to account inquiries, technical support requests, billing questions, and other communications from Brokers and Agents.
Legal compliance
To comply with applicable law including Pennsylvania breach notification requirements, CCPA obligations for California residents, CAN-SPAM Act requirements, and responses to valid legal process.
Security and fraud prevention
To monitor for unauthorized access, detect and prevent fraud, investigate security incidents, and protect the integrity of the Platform.
Platform improvement
To analyze aggregated and anonymized usage data to identify bugs, improve features, and develop new Platform capabilities. Individual user data is not used for Platform improvement without aggregation and anonymization.
Marketing communications
To send marketing emails to prospective customers using publicly available contact information, in compliance with CAN-SPAM. Existing subscribers may receive product updates and renewal notices. All recipients may opt out at any time.
Vorah does not use any data collected through the Platform or website to make decisions about any individual's race, color, religion, national origin, sex, disability, familial status, or any other Protected Characteristic. Vorah does not use Buyer Engagement Data for advertising, profiling, or any purpose other than generating Intelligence Reports and improving the Platform through aggregated analysis.
6. HOW WE SHARE INFORMATION
Vorah does not sell personal information. Vorah does not share personal information with third parties for their own marketing purposes. We share information only in the following circumstances:
6.1 With the Listing Agent and Broker — Buyer Engagement Data
Buyer Engagement Data collected during a Smart Link session is shared with the listing Agent who generated the Smart Link and the Broker under whose account the Smart Link was created. This sharing is the core function of the Platform and is disclosed to Buyers in the Buyer Consent Notice before any data is collected. Buyers who do not consent do not have their data shared with anyone because no data is collected from non-consenting Buyers.
6.2 With Stripe — Payment Processing
We share payment information with Stripe, Inc. for the purpose of processing subscription fees and renewals. Stripe is a PCI-DSS compliant payment processor. Stripe's collection and use of payment information is governed by Stripe's Privacy Policy available at stripe.com/privacy. We do not store full payment card numbers or banking information.
6.3 With Google — Analytics and Maps
We share website visitor data with Google LLC through Google Analytics and Google Maps, subject to visitor cookie consent. Google Analytics receives behavioral data about website visits including pages viewed, session duration, and approximate location. Google Maps receives location interaction data when map features are used. This sharing occurs only when a visitor has accepted optional cookies through the cookie consent banner. Google's collection and use of this data is governed by Google's Privacy Policy at policies.google.com/privacy. We have configured Google Analytics to operate in Consent Mode v2 to respect visitor cookie preferences.
6.4 With OneSignal — Push and Email Notifications
We share Broker and Agent account information with OneSignal, Inc. for the purpose of delivering push notifications and email notifications through the Vorah mobile and web application. OneSignal receives device identifiers, push notification tokens, email addresses, and notification delivery data necessary to send notifications on our behalf. OneSignal is used exclusively within the application and does not receive website visitor data or Buyer Engagement Data. OneSignal's privacy practices are governed by OneSignal's Privacy Policy available at onesignal.com/privacy.
6.5 With Firebase and Google Cloud Platform — Infrastructure
The Platform operates on Google Firebase and Google Cloud Platform infrastructure. All Platform data including Broker and Agent account data, Customer Content, and Buyer Engagement Data is stored on Firebase and Google Cloud Platform servers. Google processes this data on our behalf as a data processor under a data processing agreement. Google does not use this data for its own purposes. Google's infrastructure privacy practices are governed by Google Cloud's Privacy Policy.
6.6 With Legal and Regulatory Authorities
We may disclose information when required by law, regulation, court order, subpoena, or government request. Before producing any data in response to a legal request, Vorah will: (a) review the validity of the request; (b) produce only the data specifically required by valid legal process; (c) notify the affected Customer promptly unless prohibited from doing so by law; and (d) use commercially reasonable efforts to challenge overly broad requests. We do not produce data in response to informal law enforcement requests without valid legal process.
6.7 In Connection with a Business Transaction
If Vorah is acquired, merged with another company, or sells all or substantially all of its assets, personal information may be transferred to the acquiring entity as part of that transaction. We will notify affected users via email at least thirty (30) days before any such transfer takes effect. The acquiring entity will be required to honor this Privacy Policy or provide users with notice of any material changes and the opportunity to delete their data before changes take effect.
6.8 With Your Consent
We may share information with third parties when you have given us specific consent to do so. You may withdraw consent at any time by contacting privacy@vorahhq.com.
6.9 We Do Not Sell Personal Information
Vorah does not sell, rent, trade, or otherwise transfer personal information to third parties for monetary consideration or any other valuable consideration. This applies to all categories of personal information collected from Brokers, Agents, Buyers, and Website Visitors. California residents: this means Vorah does not engage in the "sale" or "sharing" of personal information as defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act.
7. COOKIES AND TRACKING TECHNOLOGIES
7.1 What Cookies Are
Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and understand how you use the site. Vorah uses cookies only on www.vorahhq.com. The Vorah mobile and web application uses different technologies (session tokens and device identifiers) that are not browser cookies.
7.2 Cookies We Use on vorahhq.com
Cookie Name
Purpose / Type
vorah_cookie_consent
Strictly necessary. Stores your cookie consent choice (accept or decline) and the date of that choice. Required for the cookie banner to function. Expires after 12 months. Cannot be declined.
Google Analytics (_ga, _gid, _ga_*)
Optional analytics. Tracks website visits, page views, session duration, and navigation paths. Only set after you accept cookies. Blocked if you decline. Set and managed by Google.
Google Maps
Optional functionality. Set when you interact with map features on the website. Only active after you accept cookies. Blocked if you decline. Set and managed by Google.
Strictly necessary cookies cannot be declined because they are required for the website to function. All optional cookies are off by default and are only activated after you click Accept All Cookies on the cookie consent banner.
7.3 Your Cookie Choices
When you first visit vorahhq.com, a cookie consent banner is displayed giving you the choice to accept or decline optional cookies. You can change your choice at any time by clicking the Cookie Preferences link in the footer of any page on vorahhq.com. Your choice is stored for twelve (12) months before the banner is re-displayed.
7.4 Global Privacy Control
Vorah honors the Global Privacy Control (GPC) browser signal. If your browser sends a GPC signal to vorahhq.com, we automatically treat it as a decline of optional cookies without requiring any additional action from you. A consent record is written noting the GPC signal as the basis for the decline.
7.5 Do Not Track
Some browsers send a Do Not Track (DNT) signal. Vorah honors DNT signals by treating them as equivalent to declining optional cookies on vorahhq.com. Because GPC is a more specific and legally recognized signal in several states, we recommend using GPC where available.
8. DATA RETENTION
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The following retention periods apply:
Broker and Agent account data
Retained during the active subscription and for thirty (30) days following account termination or cancellation. After thirty (30) days, account data is permanently deleted. Brokers and Agents may request a data export within the thirty (30) day window following termination.
Buyer Engagement Data
Retained for the duration of the associated Broker's subscription and for thirty (30) days following that subscription's termination. When a Broker's account is deleted, all associated Buyer Engagement Data is deleted with it within thirty (30) days.
Payment records
Retained for seven (7) years from the date of the transaction to comply with financial recordkeeping requirements. Payment records are maintained in Stripe and in Vorah's internal transaction logs.
Signed contracts and agreements
Retained for seven (7) years from the date of execution.
Legal notification records
Retained for seven (7) years. Records of all legal notices received from Brokers under the 48-hour notification obligation are retained as legal protection.
Cookie consent records
Retained for two (2) years from the date of the consent interaction for regulatory compliance purposes.
Buyer consent records
Retained for the duration of the associated Broker's subscription plus thirty (30) days. The consent record documents that a specific Buyer agreed to data collection before their Smart Link session.
Marketing opt-out records
Retained for a minimum of three (3) years. Opt-out requests are never deleted and opted-out contacts are never re-added to marketing lists without their explicit written request.
Security and access logs
Retained for two (2) years to support security incident investigation and regulatory compliance.
Server logs
Retained for ninety (90) days for security monitoring and then permanently deleted.
Aggregated and anonymized data
Retained indefinitely. Once data is aggregated and anonymized such that no individual can be identified, it is no longer personal information and is not subject to deletion obligations.
9. DATA SECURITY
Vorah implements commercially reasonable technical and organizational security measures designed to protect personal information from unauthorized access, disclosure, alteration, loss, or destruction. Our security measures include:
Encryption of data in transit using TLS/HTTPS for all communications between users and the Platform.
Encryption of data at rest within Firebase and Google Cloud Platform infrastructure.
Access controls limiting Platform data access to authorized Vorah personnel on a need-to-know basis.
Security and access logging retained for two (2) years to detect and investigate anomalous access events.
Payment processing exclusively through Stripe, a PCI-DSS Level 1 certified payment processor, ensuring payment card data never touches Vorah's systems.
No security system is impenetrable and no method of electronic transmission or storage is one hundred percent secure. Vorah cannot guarantee absolute security of personal information. In the event of a confirmed data breach affecting personal information, Vorah will notify affected individuals in accordance with applicable breach notification law including:
Pennsylvania: within thirty (30) days of discovery of a breach affecting Pennsylvania residents.
California: in the most expedient time possible and without unreasonable delay, generally within forty-five (45) days of discovery.
Virginia: within sixty (60) days of discovery of a breach affecting Virginia residents.
Other states: within the timeframe required by applicable state law.
Breach notifications will be sent to the email address on file for affected Brokers and Agents. For Buyers whose Buyer Engagement Data may be affected, notification will be provided through the associated Broker in accordance with our Terms of Service.
10. YOUR PRIVACY RIGHTS
10.1 Rights Available to All Users
Regardless of your location, you have the following rights with respect to your personal information:
Right to Access: You may request a copy of the personal information we hold about you.
Right to Correction: You may request correction of inaccurate personal information we hold about you.
Right to Deletion: You may request deletion of your personal information subject to our legal retention obligations. Some information must be retained for legal compliance purposes and cannot be deleted upon request.
Right to Data Export: Brokers and Agents may request an export of their account data within thirty (30) days of account termination.
Right to Opt Out of Marketing: You may opt out of marketing communications at any time by replying STOP to any marketing email or by contacting privacy@vorahhq.com. Opt-out requests are processed within ten (10) business days.
To exercise any of these rights, submit a written request to privacy@vorahhq.com. We will respond within thirty (30) calendar days. We may need to verify your identity before processing your request. We will not discriminate against you for exercising any privacy right.
10.2 California Residents — CCPA and CPRA Rights
CALIFORNIA RESIDENTS HAVE SPECIFIC RIGHTS UNDER THE CALIFORNIA CONSUMER PRIVACY ACT (CCPA) AS AMENDED BY THE CALIFORNIA PRIVACY RIGHTS ACT (CPRA). THESE RIGHTS ARE IN ADDITION TO THE RIGHTS AVAILABLE TO ALL USERS.
If you are a California resident, you have the following additional rights:
Right to Know: You have the right to know what personal information we collect, use, disclose, and sell or share about you, and for what purposes. This Privacy Policy serves as our disclosure. You may also submit a specific request to privacy@vorahhq.com.
Right to Delete: You have the right to request deletion of personal information we collected from you, subject to certain exceptions including our legal retention obligations.
Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
Right to Opt Out of Sale or Sharing: Vorah does not sell or share personal information as defined under CCPA/CPRA. There is nothing to opt out of. We honor this right by design.
Right to Limit Use of Sensitive Personal Information: Vorah does not collect sensitive personal information as defined under CPRA beyond what is necessary to provide the Platform. We do not use sensitive personal information for any purpose beyond Platform operation.
Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.
Right to Know About Automated Decision-Making: Vorah does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.
DO NOT SELL OR SHARE MY PERSONAL INFORMATION: Vorah does not sell or share personal information as defined under California law. If you wish to confirm this or submit a formal opt-out request as a precautionary measure, contact privacy@vorahhq.com with the subject line "California Privacy Request — Do Not Sell or Share."
California Shine the Light: California Civil Code Section 1798.83 permits California residents to request information about personal information disclosed to third parties for direct marketing purposes. Vorah does not disclose personal information to third parties for their direct marketing purposes. There is nothing to report under this provision.
Response Timeline for California Residents: We will respond to CCPA/CPRA requests within forty-five (45) calendar days. We may extend this period by an additional forty-five (45) days where reasonably necessary, with prior notice to you.
10.3 Virginia, Colorado, Connecticut, and Texas Residents
Residents of Virginia, Colorado, Connecticut, and Texas have rights under their respective state privacy laws (VCDPA, CPA, CTDPA, and TDPSA) that are similar to those described above, including rights to access, correct, delete, and opt out of certain processing. Vorah does not sell personal information, use personal information for targeted advertising, or engage in profiling that produces legal effects. To exercise any right under applicable state law, contact privacy@vorahhq.com. We will respond within forty-five (45) calendar days.
10.4 Buyers — Special Rights and Procedures
Buyers who interacted with a Smart Link and wish to exercise data rights should contact privacy@vorahhq.com with the subject line "Buyer Data Request" and include the approximate date of their Smart Link session and the property address if known. Because Buyers do not have named accounts in our system, we will identify the relevant session data using the information provided and will:
Forward the request in writing to the listing Broker within five (5) business days — the Broker is the Data Controller for that Buyer's engagement data.
Where technically feasible, identify and delete the specific Smart Link session data from Vorah's systems without affecting the Broker's account.
Confirm deletion or the limitations on deletion to the Buyer in writing within thirty (30) days of the request.
Retain a log of the request, the forwarding to the Broker, and the deletion confirmation for three (3) years.
Buyers who did not click the consent button on the Buyer Consent Notice have no data in our systems because no data was collected from non-consenting Buyers.
11. BUYER CONSENT NOTICE — HOW BUYER DATA IS COLLECTED
Every Buyer must see and actively consent to Vorah's Buyer Consent Notice before any data is collected from them. This Section explains how that process works.
11.1 What the Buyer Consent Notice Does
The Buyer Consent Notice is a full-screen disclosure displayed to every Buyer the first time they access any Smart Link and on every subsequent access to any Smart Link, regardless of prior consent on a different Smart Link. The notice explains: what data will be collected; that the data will be shared with the listing Agent and Broker; that the data will not be used for advertising or to identify the Buyer by name; and that Vorah does not collect information about Protected Characteristics.
11.2 Consent Is Affirmative and Documented
Consent is obtained through an affirmative button click on the Buyer Consent Notice labeled "I Understand — Show Me the Tour." Passive actions such as scrolling, hovering, or remaining on the page do not constitute consent. At the moment a Buyer clicks consent, the Platform records: the Smart Link identifier; the timestamp of consent in UTC; the Buyer's IP address; the device type and browser; and the version number of the Buyer Consent Notice displayed. This consent record is stored in Firestore and retained for the duration of the associated Broker's subscription plus thirty (30) days.
11.3 Buyers Who Do Not Consent
The Buyer Consent Notice includes a clearly visible "No Thank You — Exit" button of equal prominence to the consent button. Buyers who click this button exit the Smart Link experience without having any data collected beyond the IP address and timestamp of the exit event, which are retained briefly for security purposes and not included in any Intelligence Report or shared with any Broker or Agent. Buyers who do not consent cannot have data used against them in any way and retain all rights to view and purchase the property through normal channels.
11.4 Data Collection Does Not Begin Until Consent Is Confirmed
Zero data collection of any kind occurs before a Buyer clicks the consent button. The Platform does not collect page view events, video load events, or any analytics data before consent is given. If the consent record cannot be successfully written to Firestore, the Platform does not display the tour. No tour is shown without a successful consent record.
12. ONESIGNAL — PUSH AND EMAIL NOTIFICATIONS
Vorah uses OneSignal, Inc. to deliver push notifications and email notifications to Brokers and Agents through the Vorah mobile and web application. OneSignal is not used on the public vorahhq.com website and does not collect data from Website Visitors or Buyers.
12.1 What OneSignal Collects on Our Behalf
Through our use of OneSignal, the following information is collected from Brokers and Agents who have notifications enabled:
Device identifiers and push notification tokens necessary to deliver push notifications to specific devices.
Email addresses used to deliver email notifications.
Notification delivery data including whether a notification was delivered, opened, or resulted in any in-app action.
Device type, operating system, and application version for notification compatibility purposes.
12.2 How to Manage Notification Preferences
Brokers and Agents can manage push notification preferences through their device settings (iOS or Android) by disabling push notifications for the Vorah application. Email notification preferences can be managed within the Vorah application account settings or by contacting privacy@vorahhq.com. Disabling notifications does not affect Platform access or subscription status.
12.3 OneSignal's Privacy Practices
OneSignal's collection and use of data processed on our behalf is governed by our data processing agreement with OneSignal and by OneSignal's Privacy Policy available at onesignal.com/privacy. OneSignal does not use data processed on Vorah's behalf for OneSignal's own marketing or advertising purposes.
13. THIRD-PARTY LINKS AND SERVICES
The Platform and website may contain links to third-party websites, services, or resources. Vorah is not responsible for the privacy practices, content, or security of any third-party website or service. This Privacy Policy applies only to information collected by Vorah through the Platform and website. We encourage you to review the privacy policies of any third-party service you access through the Platform or website.
Third-party services integrated into the Platform or website and their respective privacy policies:
Stripe — stripe.com/privacy
Google Analytics / Google Cloud — policies.google.com/privacy
Google Maps — policies.google.com/privacy
OneSignal — onesignal.com/privacy
Firebase (Google) — firebase.google.com/support/privacy
14. CHILDREN'S PRIVACY
The Platform and website are not directed at individuals under the age of eighteen (18). Vorah does not knowingly collect personal information from anyone under the age of eighteen. If we become aware that we have inadvertently collected personal information from a person under eighteen, we will delete that information promptly. If you believe we have collected information from a minor, please contact privacy@vorahhq.com immediately.
15. FAIR HOUSING AND PROTECTED CHARACTERISTICS
Vorah is designed from the ground up to be a fair housing compliant platform. This Section explains specifically what we do and do not collect with respect to Protected Characteristics.
15.1 What Vorah Does Not Collect
The Platform has no mechanism to collect, infer, or store any information about any Buyer's race, color, religion, national origin, sex, disability, familial status, sexual orientation, gender identity, marital status, age, ancestry, source of income, or any other Protected Characteristic under applicable federal, state, or local law. The Buyer Consent Notice explicitly discloses this to Buyers. Vorah's data collection is limited strictly to observable viewing behavior — which rooms were watched, for how long, which were replayed, and which were skipped.
15.2 Broker and Agent Responsibilities
While Vorah does not collect Protected Characteristic information, Brokers and Agents may independently possess information about Buyers' Protected Characteristics through their normal course of business. Brokers and Agents are solely responsible for ensuring that Intelligence Reports and Buyer Engagement Data are never used in combination with Protected Characteristic information to make discriminatory decisions. This obligation is set out in detail in Vorah's Terms of Service Section 14 and in each Broker's executed subscription agreement.
15.3 Vorah's Platform Design Commitment
Vorah actively designs the Platform to minimize fair housing risk. Intelligence Reports present only behavioral engagement data with no demographic labels, no Protected Characteristic fields, and no design elements that could facilitate discriminatory use. Any future Platform feature that could create fair housing risk will be reviewed by qualified legal counsel before deployment.
16. DATA PROCESSING ROLES — BROKER AS DATA CONTROLLER
Vorah operates in different data processing roles depending on the type of data involved:
16.1 Vorah as Data Controller
Vorah acts as the Data Controller for: Broker and Agent account information collected during registration and subscription; Website Visitor data collected through Google Analytics and Google Maps; payment metadata collected through Stripe; and marketing communications sent to prospective customers. As Data Controller for this data, Vorah determines the purposes and means of processing and is directly responsible for compliance with applicable privacy law.
16.2 Broker as Data Controller for Buyer Engagement Data
The Broker is the Data Controller for all Buyer Engagement Data collected under the Broker's account. The Broker determines which listings have Smart Links, which Buyers receive Smart Links, and how Intelligence Reports are used. Vorah acts as a data processor for Buyer Engagement Data, collecting and processing it on the Broker's behalf and delivering it to the Broker in the form of an Intelligence Report. Brokers are solely responsible for ensuring their use of Buyer Engagement Data complies with all applicable privacy laws in their operating jurisdiction, including jurisdiction-specific obligations that may exceed what Vorah's Buyer Consent Notice alone satisfies.
16.3 Implications for Buyers
Because the Broker is the Data Controller for Buyer Engagement Data, Buyers with data rights requests related to their Smart Link session data should contact Vorah at privacy@vorahhq.com and Vorah will forward the request to the relevant Broker within five (5) business days per Section 10.4. Vorah will also delete the identifiable session data from Vorah's systems where technically feasible.
17. PENNSYLVANIA BREACH NOTIFICATION
In the event of a security breach that compromises the personal information of Pennsylvania residents, Vorah will provide notification within thirty (30) days of discovery of the breach in accordance with the Pennsylvania Breach of Personal Information Notification Act. Notification will be provided to:
Affected Pennsylvania residents via email to the address on file.
The Pennsylvania Attorney General's Office if the breach affects more than five hundred (500) Pennsylvania residents.
Major credit reporting agencies if more than one thousand (1,000) Pennsylvania residents are affected.
For breaches affecting residents of other states, Vorah will provide notification within the timeframe required by applicable state law. Virginia residents: sixty (60) days. California residents: most expedient time possible without unreasonable delay. All other states: per applicable state law.
18. CHANGES TO THIS PRIVACY POLICY
Vorah may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. We distinguish between material and non-material changes:
18.1 Material Changes
A material change is any update that: expands the categories of personal information we collect; adds new third-party sharing relationships; changes the purposes for which we use personal information; reduces the rights available to users; or materially alters our data retention practices. For material changes, we will: provide written notice to all active Brokers and Agents at the email address on file at least thirty (30) days before the change takes effect; post the updated Privacy Policy at www.vorahhq.com/privacy with the new effective date; and increment the version number of this Privacy Policy. Continued use of the Platform after the effective date of a material change constitutes acceptance of the updated Privacy Policy.
18.2 Non-Material Changes
Non-material changes include clarifications, typographical corrections, formatting updates, and changes that do not alter users' substantive rights or Vorah's data practices. Non-material changes may be made without prior notice. The updated Privacy Policy will be posted at www.vorahhq.com/privacy with the updated date.
18.3 Version Archive
Vorah maintains an archive of all prior versions of this Privacy Policy. Prior versions are available upon request by contacting privacy@vorahhq.com. Each version is identified by its effective date and version number.
19. CONTACT US — PRIVACY REQUESTS AND COMPLAINTS
For all privacy-related matters including data access requests, correction requests, deletion requests, opt-out requests, complaints, and questions about this Privacy Policy, contact us at:
Privacy Email
privacy@vorahhq.com
Subject Line Format
"Privacy Request — [Your Name] — [Type of Request]"
Mailing Address
Vorah LLC, Attn: Privacy, 4203 Union Deposit Rd #1210, Harrisburg, PA 17111
Response Time
30 days for general requests; 45 days for California CCPA/CPRA requests
Extension
We may extend by up to 45 additional days where reasonably necessary with prior notice
If you are not satisfied with our response to a privacy request or complaint, you have the right to file a complaint with the applicable state attorney general or data protection authority in your jurisdiction. California residents may contact the California Privacy Protection Agency at cppa.ca.gov. Pennsylvania residents may contact the Pennsylvania Attorney General's Office at attorneygeneral.gov.
END OF PRIVACY POLICY
Version 1.0 | Effective Date: April 17, 2026 | www.vorahhq.com/privacy
Vorah LLC | 4203 Union Deposit Rd #1210, Harrisburg, PA 17111 | privacy@vorahhq.com | Confidential