Privacy Policy

Vayora is an AI companion app operated at vayora.com.au. We are based in Australia and subject to the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).

References to "Vayora", "we", "us" or "our" in this policy refer to the Vayora service and its operators. References to "you" or "your" refer to users of the Vayora app.

For privacy enquiries, contact us at: privacy@vayora.com.au

We collect only the information needed to provide and improve the Vayora service. Here is what we collect and when:

We collect your information for these specific purposes only:

• ·To provide the Vayora service — account creation, authentication, chat functionality
• ·To personalise your experience — using memory you have explicitly enabled
• ·To send transactional emails — account verification, password reset, welcome message
• ·To display accurate times and reminders in your timezone
• ·To improve the service — aggregated, anonymised usage patterns only
• ·To comply with legal obligations under Australian law

We do not use your data to train AI models, sell to third parties, or serve advertising. Vayora is funded by subscriptions, not by monetising your data.

Health information in Vayora includes anything you share about medical conditions, medications, symptoms, mental health, or physical wellbeing.

We only store health information if you explicitly enable "Health information" in Privacy settings. This toggle is off by default and requires you to first enable general memory.

Health data is:

• ·Stored in our secure Supabase database with row-level security
• ·Never shared with third parties for any purpose
• ·Never used to train AI models
• ·Never used for advertising or profiling
• ·Deletable at any time from your /memory page or Privacy settings

Vayora does not provide medical advice, diagnosis or treatment. Any health-related responses are for general informational purposes only. Always consult a qualified healthcare professional for medical decisions.

Your data is stored securely using industry-standard practices:

• ·All data is transmitted over HTTPS — encrypted in transit
• ·Database access is protected by Row Level Security (RLS) — only you can access your own data
• ·Passwords are never stored in plain text — hashed by Supabase's secure auth system
• ·API keys and secrets are stored as environment variables, never in code
• ·Regular automated backups are maintained

Our primary database is hosted by Supabase on infrastructure located in the United States (AWS). By using Vayora, you consent to your data being processed and stored in the US under Supabase's data processing agreement.

Vayora uses the following third-party services to operate. Each receives only the minimum data needed for their function:

We do not share your data with any other third parties. We do not use Google Analytics, Facebook Pixel, or any advertising networks.

Under the Australian Privacy Act and applicable law, you have the following rights:

• ·Access — view all data stored about you at any time via /memory and Privacy settings
• ·Correction — update your name, timezone and preferences via Account settings
• ·Deletion — delete individual memory items, clear all memory, or delete your entire account and all associated data
• ·Export — download all your data as a JSON file from Privacy settings
• ·Withdrawal of consent — turn off any memory feature at any time from Privacy settings
• ·Complaint — if you believe we have mishandled your data, contact us at privacy@vayora.com.au

If you are an EU resident, you also have rights under the GDPR including the right to data portability and the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, you can use the built-in controls in the app or email us at privacy@vayora.com.au. We will respond within 30 days.

We keep your data for as long as your account is active. Specifically:

• ·Account data — kept until you delete your account
• ·Chat history — kept until you delete individual sessions or your account
• ·Memory items — kept until you delete them individually or clear all memory
• ·Reminders and recovery timeline — kept until you delete them or your account
• ·Email logs — kept by Resend for up to 30 days for delivery tracking

When you delete your account, all of the above is permanently deleted from our database immediately. Backups are purged within 30 days.

Some anonymised, aggregated usage data (e.g. total number of active users) may be retained indefinitely as it cannot be linked back to any individual.

Vayora uses minimal cookies:

• ·Session cookies — used by Supabase to keep you logged in. These are essential for the app to function.
• ·No advertising cookies
• ·No third-party tracking cookies
• ·No analytics cookies

You can clear cookies at any time through your browser settings, which will sign you out of Vayora.

Vayora is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has created an account, please contact us at privacy@vayora.com.au and we will delete the account promptly.

We may update this Privacy Policy from time to time. When we make significant changes, we will:

• ·Update the 'Last updated' date at the top of this page
• ·Send an email notification to all registered users
• ·Display an in-app notice on your next login

Your continued use of Vayora after changes are notified constitutes acceptance of the updated policy. If you do not agree with changes, you can delete your account at any time.

For any privacy-related questions, requests or complaints:

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.