Privacy policy
Adopted 13 September 2026.
VallorisAI Ltd provides this platform. This policy says what the platform holds about you and your firm, where that information goes, and how long it is kept. It covers the platform and nothing else.
The account
An account is created in one of two ways. You sign up and prove your work email address with a six digit code the platform sends to it, or a colleague invites you into a workspace they already hold. At launch, an invitation is the usual route.
The account holds your name, your work email address, your organization, your job title, the account type you chose, and the mobile number you gave if you gave one. It holds a hash of your password rather than the password, which cannot be read back from the hash. It records the moment you proved your address and the moments you accepted the declarations and this policy, and the non-disclosure agreement, where one was accepted.
What a workspace holds
Your work sits in a workspace. A workspace holds its members and the role each of them has, its projects, the documents dropped on those projects, the record written from them, and the ledger of what each run of the platform cost. Every member of a workspace can read everything in it. Nobody outside it can.
Where the information goes
The platform sends material to five other companies, each for one purpose:
- Anthropic reads the documents and the record, and writes the analysis and the documents the platform produces.
- OpenAI transcribes the dictation you record in the chat composer.
- Firecrawl reads the public web pages the platform cites.
- Mailgun carries the mail the platform sends: verification codes, invitations and links to set a password.
- The hosting provider runs the servers and holds the database and the files.
No other company receives anything.
Your material is not used to train a model
The documents you drop on a project, the record written from them and everything you type into the platform remain your firm’s. None of it is used to train any model.
How long it is kept
A project deleted from the register is not destroyed at once. It goes to the workspace’s trash and is kept for the period the workspace sets, which is thirty days unless an owner changes it. After that the project is destroyed with its documents, its exports and the record written from it. An owner can restore it or destroy it sooner from the deleted projects record.
An account and the workspaces it belongs to are kept while the account is in use. Write to info@valloris.ai to ask for an account or a workspace to be removed.
Cookies
The platform sets two cookies and both are sealed. One carries your session after you sign in. The other carries an unfinished sign-up, so that you can leave the flow and come back to it. There are no advertising cookies and no analytics.
How the platform protects it
Every screen behind the sign page requires a session, and a session names one account and one workspace. Passwords are stored as hashes. Verification codes and invitation links are stored as hashes too, and each one expires.
Asking what we hold
Write to info@valloris.ai to ask what the platform holds about you, to have it corrected, or to ask for it to be removed. We answer in writing.
Changes to this policy
The date under the title is the date of this text. A change to it carries a new date in the same place.