Privacy Policy and Personal Data Processing

Last updated: July 10, 2026

This policy describes how VORIA AI S.A.S. collects, uses, stores, shares and protects the personal data of those who visit wearevoria.com, contact us, or interact with the WhatsApp assistants we operate for client businesses, in compliance with Colombian Statutory Law 1581 of 2012, Regulatory Decree 1377 of 2013 and other applicable rules overseen by the Superintendence of Industry and Commerce (SIC), including the principle of demonstrated accountability. This English version is provided for convenience; in case of any discrepancy, the Spanish version prevails.

1Data controller

Legal name: VORIA AI S.A.S.
Domicile: Antioquia, Colombia
Contact email: ceo@wearevoria.io
Responsible area: Personal Data Processing / Privacy
Website: wearevoria.com
Affiliated entity (USA): VORIA AI LLC (Wyoming), operates the site's technical infrastructure.

2Personal data we collect

We only collect the data necessary for the purposes described in this policy:

Category	Data	How it is collected
Identification and contact	Name, business name, email address, phone number and country.	When you complete the site's contact form.
Conversation content	The messages you write to our AI assistants (Iris, ALMA and others) in the site chat.	When you interact with the chat.
Technical and usage data	IP address, browser and device type (user-agent), pages visited and interaction data.	Automatically, through server logs and local-storage technologies.
Scheduling	The data you enter when booking a meeting (name, email and time slot).	Through the Calendly widget.
Voice (when the voice assistant is active)	The audio of your voice conversation and its transcription.	When you speak with the site's voice assistant.

We do not collect sensitive data (health, political or religious views, biometric data, etc.). The site is not directed to minors.

3Purposes of processing

Handle your requests, contact you and provide commercial follow-up.
Provide, maintain and improve our services and the operation of the site.
Generate AI chat responses based on your messages.
Send you commercial communications about Voria, provided you have authorized it (you may object at any time).
Ensure the security of the site, prevent abuse and apply usage limits.
Comply with legal, accounting and tax obligations.

4Legal basis

Consent of the data owner (Law 1581 of 2012, Art. 9), granted when you submit your data through the site.
Performance of a contractual or pre-contractual relationship, where applicable.
Compliance with legal obligations of the controller.

5Processors and third parties with whom we share data

To operate the site and provide the service we use technology providers that act as data processors. They only receive the strictly necessary data:

Provider	Purpose
GoHighLevel / LeadConnector	CRM and management of contact-form data.
n8n (self-hosted)	Internal automation of received leads.
Supabase	Database: storage of chat conversations, leads and diagnostics.
Anthropic	Processing of chat (and voice) messages to generate AI responses.
Resend	Sending emails (confirmations, diagnostics and reports).
Calendly	Meeting scheduling.
Vercel	Website hosting and infrastructure.
Cloudflare	Security and anti-bot verification (Turnstile).
Google Fonts	Delivery of the site's typefaces (logs the IP).
LiveKit · voice	Real-time voice infrastructure (when the voice assistant is active).
Deepgram · voice	Speech-to-text transcription for the voice assistant (when active).
ElevenLabs · voice	Voice synthesis (text-to-speech) for the voice assistant (when active).

We do not sell or rent your personal data to third parties.

6International transfers

Some of our providers are located outside Colombia, mainly in the United States (Anthropic, Vercel, Supabase, Resend, LiveKit, Deepgram, ElevenLabs, Calendly, Google and Cloudflare), and our own affiliated entity VORIA AI LLC (Wyoming, USA) operates part of the infrastructure. As a result, your data may be transferred and processed abroad. These transfers are carried out under your consent and applying the security and confidentiality safeguards required by Law 1581 of 2012 and SIC Circular 001 of 2025.

7Rights of the data owner

As the owner of the data, at any time you may:

Know, update and rectify your personal data.
Access, free of charge, the data we hold about you.
Request proof of the authorization granted.
Revoke the authorization and/or request the deletion of your data, where there is no legal or contractual duty to retain it.
Object to processing for marketing purposes.
File complaints with the Superintendence of Industry and Commerce (SIC).

How to exercise your rights?

Write to ceo@wearevoria.io with the subject "Habeas Data". We will answer inquiries within a maximum of 10 business days (Art. 14, extendable by 5 days) and complaints within a maximum of 15 business days (Art. 15, extendable by 8 days), under Law 1581 of 2012.

8Cookies and local storage

This site uses browser local storage (localStorage) to remember your browsing preferences; these are not advertising tracking cookies. Additionally, some embedded third-party services (Calendly, LeadConnector forms and Cloudflare verification) may set their own cookies when you interact with them. You can manage or block cookies from your browser settings.

9Retention period

We retain your data according to its type:

Chats and leads that do not progress to a commercial relationship: automatically deleted after 90 days.
Data from an active commercial relationship: for the duration of the relationship and for the additional time needed to meet legal, accounting and tax obligations (generally, up to 5 years). After that period, the data is securely deleted or anonymized.

10Information security

We apply reasonable technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), access control, data minimization and usage limits to prevent abuse. No system is 100% infallible, but we work to maintain a level of protection appropriate to the nature of the data.

11AI assistants over WhatsApp (client businesses)

Voria designs and operates artificial-intelligence assistants on WhatsApp on behalf of client businesses (for example, to handle inquiries and take orders). When an end user writes to one of these assistants:

Roles: the client business is the controller of its end users' data; VORIA AI S.A.S. acts as data processor and technology provider that operates the assistant software under the business's instructions.
Data processed via WhatsApp: phone number (WhatsApp identifier), public profile name, the content of the messages and the order data (products, delivery address and indicated payment method). We never request or store full card numbers, passwords, PINs or OTP codes.
Purposes: handle inquiries, quote, take and confirm orders, coordinate delivery, send confirmations and follow up on the service.
AI processing: messages are processed via Anthropic (Claude) to generate the assistant's responses.
Channel (Meta / WhatsApp): messaging is transmitted through Meta's WhatsApp Business Platform, which processes data under its own terms and its Privacy Policy.
Legal basis and user control: processing relies on the interaction the user initiates and on their authorization (Law 1581 of 2012, cumulative with Meta's). The user may request to stop receiving messages or the deletion of their data by writing to the business or to ceo@wearevoria.io.
No sale of data: we do not sell or rent conversation data, nor use it for purposes other than operating the business's assistant.

12Supervisory authority and changes

The competent authority for data protection in Colombia is the Superintendence of Industry and Commerce (SIC), www.sic.gov.co. We may update this policy; any change will be published on this same page, indicating the date of the last update.