Privacy Policy

1. Operator and scope

Vora, also known as Vora Talk, is operated by AEVORA DIGITAL LIMITED. In this Policy, “Vora”, “we” and “us” refer to that company, which is the data controller responsible for the processing described here. Our privacy contact handles privacy enquiries, account deletion and information-rights requests at service@voratalk.com. Child-safety concerns sent to the same address are routed to the personnel responsible for safety.

Address: UNIT 11, 9/F, THE CLOUD, NO.111 TUNG CHAU STREET, TAI KOKTSUI, KOWLOON, HONG KONG. Email: service@voratalk.com.

This Policy covers the Vora app and our websites, agency application, management and settlement services that link to it. Vora provides voice rooms, messaging, profiles, ordinary virtual gifts and agency services, exclusively for people aged 18 or older.

An agency is an organisation within Vora that coordinates members’ voice activities, related cooperation and earnings settlements. Joining an agency does not change your personal information rights.

Independent websites or services you choose to visit may process information under their own policies. Those policies do not relieve Vora of responsibility for information we collect, use or disclose to them.

2. Initial use, notices and choices

Before the app’s main services start, we display the Terms and Privacy notice. You can read the bundled offline documents before deciding; opening them does not send a web request. Opening an online policy page separately involves the web-delivery and performance information described in Section 9. Reading either version does not itself authorise account sessions, messaging services, device status reporting or diagnostic uploads. Disagreeing or going back prevents entry into the main services.

After your affirmative confirmation, the app records the notice version, acceptance time and language on the device before starting services. Section 4 explains device, network and background processing. Having an existing account does not mean you have accepted a new notice. We seek renewed consent for material changes when required.

Confirming this Policy does not authorise unrelated processing or replace feature permissions or legally required separate consent. Before processing personal or sensitive information beyond your reasonable expectations, including relevant background processing, we prominently explain the information, purpose, sharing and circumstances in the app and obtain the required affirmative consent. Refusing, closing or leaving a notice is not consent.

The grounds for particular processing and your withdrawal and deletion rights are explained in Sections 7 and 12.

3. Information collected and feature purposes

3.1 Accounts, sign-in and profiles

We process the sign-in and profile information you provide, including account identifiers, email address, authentication information, display name, avatar, gender, date of birth, country or region, language and optional biography or other profile details, to register and manage accounts, display profiles and provide services.

Email sign-in, verification or recovery involves the password or email verification information submitted through the relevant verification screen. Do not send passwords or verification codes to support staff, other users or agency leaders.

If you choose Google Sign-In, we receive the account identifier, authentication tokens and profile information you authorise Google to provide to verify and link your Vora account. You may choose not to use this sign-in method. See Section 9.

Completing a profile requires an avatar, display name, gender selection, date of birth showing you are at least 18, and country or region. Without these, that step cannot be completed. An invitation code is optional. Your birth date is used to check the minimum age. The country or region you select is distinct from the approximate access region inferred from network signals.

3.2 Content and social activity

We process profiles, albums, room names, covers, topics and descriptions you create or change, and the text, images, voice messages and other selected attachments you send. Room participation, follows, friendships, block lists, ordinary gift interactions and moderation records support the corresponding features. Searching for users or rooms sends your search terms to our servers to return results. The app also keeps a recent-search list on your device, which you can clear in the search screen; clearing that local list does not erase server request records subject to Section 10.

Messages include delivery and issue-resolution metadata such as sender, recipient or room identifiers, message identifier, time and content type. Block records implement the relevant interaction restrictions; they do not automatically erase earlier messages or evidence.

Live room audio differs from saved voice messages; see Section 6. Section 8 explains content visibility.

3.3 Purchases, wallets and ordinary gifts

For purchases, we process the linked account, purchased item, order or purchase reference, amount and currency, time, transaction status and wallet changes. These support verification, delivery of virtual items, balances, reconciliation, refunds, support and disputes.

Google handles payment details for Google Play purchases. Vora does not receive your full payment-card number or card security code through Google Play Billing. Google’s purchase tokens, order and status information support verification and delivery and are not your full payment-account details. Purchases are optional; declining a purchase does not prevent features that do not require payment. Payment information is also covered by the Google Payments Privacy Notice at https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=privacynotice . For purchase issues, contact service@voratalk.com with your Vora ID and order reference, without passwords or payment credentials. Refunds follow applicable law and the Google Play refund rules at https://support.google.com/googleplay/answer/2479637 .

Ordinary gift records include gift type and quantity, sender and recipient account identifiers, time and relevant room. They support gift display and delivery, related earnings, applicable rankings, reconciliation and disputes. Prices, virtual-currency consumption and earnings rules are explained in the relevant feature or transaction terms; this Policy describes the information processing.

Purchases and cash payouts are distinct activities. Payout information, recipients and retention are explained below and in Section 10.

3.4 Agency applications and identity verification

An agency creation application involves your Vora ID, agency name, WhatsApp contact number, identity-document images submitted by the proposed leader, and optional agency logo, description or invitation information. We use these to review the application, verify the applicant, make contact and record the outcome.

The agency name, contact number and leader’s identity document are required for this application. Without them we cannot process it. Ordinary account registration and use do not therefore require identity documents.

Submit only the documents and verification information requested in the application notice. Unrelated fields not needed for verification may be obscured. Where a specific verification process legally or operationally requires a complete field, we explain the field and reason before collection. Receiving an identity-document image does not authorise unrelated uses.

Documents and non-public contact details are collected for verification, required compliance checks and specific disputes, rather than for public agency profiles. Our handling rules limit their use and disclosure to authorised personnel and necessary providers for those purposes. Under Section 10, we review the need for originals and delete them when no longer needed; an ongoing agency relationship alone does not justify indefinite retention of every original image.

3.5 Agency participation, earnings and cash payouts

Agency participation or management involves membership and roles, application or contract status, relevant microphone activity time, active days, gift-related earnings, salary, commission and settlement records. We use these to administer participation, calculate and reconcile earnings, settle payments and handle enquiries or disputes.

AEVORA DIGITAL LIMITED organises Vora earnings settlements. Payments are executed through the relevant bank or payment processor under the applicable settlement arrangement. Cash payout requests involve:

• Request and earnings information: Vora ID, agency and earnings period, amount, currency, request time and chosen payment method, to check payable earnings and process the request.
• Payee and account details: for payment to your own bank account, the account holder’s name, bank name and account number. Other offered methods require only the payee and account identifiers needed for that method.
• Necessary additional details: recipient country or region, routing codes, account or bank address, and legally required identity or tax details, only where the selected channel or a specific legal obligation requires them, with an explanation at collection.
• Verification and payment records: review and identity or account-verification results, payment status, failure reasons, transaction references and receipts, for payment, reconciliation, security and disputes.

The payment arrangement and collection notice identify the paying or collecting entity, channel, necessary information and recipients before you submit payout details. We disclose only the information needed for that payment, verification and reconciliation to the relevant banks, processors or collection providers. Before directing you to a provider that collects information itself, we identify it and provide its privacy notice. Vora support does not require your bank login password, card security code or SMS verification code for a payout.

Not providing information required for the chosen channel affects that payout, not unrelated privacy rights. Complete account details used for future payments are managed separately from completed financial records.

Personal collection and agency collection are separate. Only where Vora offers agency collection and you actively select and authorise it do we share the account identifier, agency relationship, settlement amount, period, status and other information needed for that settlement with the collecting agency. We explain the collecting party and arrangement before confirmation. Joining an agency alone is neither collection authorisation nor permission to access all your identity or personal payout-account information.

3.6 Support, reports and appeals

Support contacts, reports and appeals involve your account and contact details, the reported account or content identifier, reason, explanation, screenshots or other attachments you submit, necessary order or technical records, and investigation outcomes.

We use these to receive feedback, locate issues, assess violations, protect users, take action and review appeals. Reports about profiles, avatars, albums, room information or messages may require a copy of the relevant content as it appeared when evidence was collected. Message evidence can include text, images, saved voice messages and contextual information such as sending time.

Reports are associated with the reporting account for verification and follow-up; they are not public posts. We do not publicly disclose the reporter’s contact details, non-public evidence or identity information to the reported person. Where needed to explain an outcome or support an appeal, we may provide an appropriately redacted account of the facts. Legally justified disclosures follow Section 8.

Do not download, copy or redistribute suspected child sexual abuse material to make a report. Relevant account, room or message identifiers and a description help us locate the concern.

3.7 Technical information and other sources

Service operation generates or provides the device, network, usage and diagnostic information in Section 4, including IP addresses received by servers. We may also receive necessary information from your chosen sign-in or payment provider, parties involved in agency settlement, and reporters, for authentication, settlement or safety. This information remains subject to this Policy.

4. Devices, networks, usage and background processing

Where available, we process:

• Device and app: Android ID, or an app-generated random identifier if unavailable; model, operating system, app version, system languages and time zone.
• Network: the IP address received by our servers. Vora’s own reporting does not read your connection types, VPN status, local network addresses, DNS settings or proxy settings. SDKs listed in Section 9 may read network state for their connection and diagnostic functions, as described there.
• Carrier: available SIM and network operator codes (MCC/MNC), country codes, SIM-slot information and the default mobile-data slot. These carrier and slot signals are different from a SIM subscriber identifier or serial number; they do not mean that we collect your IMSI, ICCID or telephone number for this reporting.
• Usage and diagnostics: page, account and room activity; request results and timing; foreground/background status; startup and process-exit information; crashes, unresponsive-app reports (ANRs) and connection quality.

These support sessions, account security, fraud and abuse detection, approximate access-country assessment, regional availability and troubleshooting. IP-address, carrier, language and time-zone signals may be combined to identify inconsistent or misrepresented regions. This is an approximate assessment, not GPS positioning.

When dedicated troubleshooting is enabled, records may also contain the relevant operation’s requests, responses, business identifiers and error context. Collection is limited to what is needed for the particular issue and subject to the information’s access and retention limits. Enabling diagnostics does not authorise unrelated use of all account content.

Collection starts after your affirmative confirmation of the relevant in-app notice. Device and carrier information is collected, and the IP address is received, during session establishment and subsequent operation, including before sign-in. While the app process runs, status reports may be sent approximately once per minute, including in the background, subject to Android restrictions. Unchanged language, time-zone and carrier details may be omitted.

Vora’s own reports go to our servers; providers process their necessary information under Section 9. Background status reporting does not itself activate the microphone. See Sections 5 and 6 for microphone and room audio controls.

5. Permissions and effects of refusal

We request access when needed for a feature. You may refuse or revoke permissions in Android settings. Names, scope and system pickers depend on the Android version and your choices.

• Microphone: speaking in rooms and recording voice messages you choose to send. Refusal prevents those transmissions, but you can still listen.
• Photos and files: uploading images or files you choose through the Android photo or document picker, such as avatars, albums, room images, message attachments, report screenshots or application documents. We receive the selected items, not permission to upload your entire photo library. Declining a selection prevents that upload, not unrelated features.
• Local music or audio: finding and selecting music for rooms, using audio access or storage access on older Android versions; selected files may be copied into app storage for playback. Refusal affects that selection or playback.
• Notifications: messages, room-service and other service alerts. Refusal may prevent alerts, without deleting existing messages.

Selecting a file does not authorise uploading unrelated files. Online services require a connection; particular services need specific information, such as authentication, agency application or payout-account details, as explained in Section 3.

Network access, network-state checks, audio routing and foreground room services also support the app. Internet and network-state access do not have a separate Android runtime permission prompt. Revoking microphone or media access does not by itself stop the device and network reporting described in Section 4. Revocation stops access controlled by that permission. It does not automatically erase earlier information or end processing independently necessary for existing transactions or legal duties. Further requests can be made under Section 12.

6. Live audio, saved messages and others’ copies

Live room audio and chosen music are transmitted to listeners through our voice provider. This involves audio processing needed for transmission, user and room identifiers, connection and quality information. Recording and sending a voice message creates a saved file for delivery and message history.

Under this Policy, room audio is used for the live service and related connection-quality processing. This Policy does not authorise continuous recording of all rooms, transcription, voiceprint identification or model training using room audio. Before introducing additional recording or analysis, we separately explain its circumstances, purpose, recipients and retention and obtain the consent required by law and platform rules.

Safety investigations can use relevant content you submit or already saved in the service, and report evidence described in Section 3. Collection is limited to the specific concern; one report is not a reason to retain all account history.

An active room can continue in the background with an Android notification. If your microphone is on, your voice may continue to be transmitted. You can mute, leave the room or revoke microphone access. Moving the app to the background does not itself turn the microphone on.

Participants hear the audio you transmit. Recipients and others with access can independently save or forward content. We handle information under our and our processors’ control, but cannot ensure independently saved copies disappear with your request. Report abuse or contact us.

7. Purposes, grounds and automated processing

7.1 Purposes and grounds

The legal ground depends on applicable law and the activity. Acceptance of this Policy is not a universal ground for all processing.

• Registration, authentication, rooms, messages, purchases and gifts: relevant account, content and transaction information to perform our service contract or take pre-contract steps you request.
• Agency applications, membership, earnings and settlement: application, role, activity and necessary payee information to handle applications and perform cooperation, verification and settlement arrangements; particular statutory checks rely on the applicable legal duty.
• Optional uploads, device permissions and other consent-based activities: processing within your choices, notice and required consent, which you may withdraw.
• Security, moderation, anti-fraud, disputes and diagnostics: where permitted, legitimate interests in protecting users and the service, resolving disputes and maintaining reliability, after considering necessity and effects on your rights. Where law requires consent or another ground, those requirements apply.
• Financial, tax, valid legal requests and statutory child protection: information needed to meet a specific applicable legal obligation, rather than automatically classifying all historical data this way.
• Protection of life or serious emergencies: necessary information to protect vital interests, where law permits or requires it.

Information can serve multiple disclosed purposes, each with an applicable ground. “Improving services” does not authorise arbitrary new uses of documents, financial details or messages. We give further notice and establish the required ground before incompatible new processing.

7.2 Room ordering, rankings and risk decisions

Room lists may be ordered by your selected country or region, creation order and popularity. Gift rankings use relevant-period gift and activity statistics. These affect ordering and display; visibility follows Section 8.

Device, network, regional and account-activity signals also detect unusual connections, regional inconsistencies or risk automatically. These may affect access, require further verification or restrict features. If information or a decision is wrong, or a restriction affects your account or access to an earnings settlement, contact in-app support or service@voratalk.com. Identify the decision and relevant facts so authorised personnel can review the source information, correct errors and reconsider the result. A request for review is not itself a reason for a further restriction.

Where law protects you against solely automated decisions with legal or similarly significant effects, you may request the main reasoning, express your position, challenge the result and seek human intervention. Any lawful exception remains subject to its required safeguards.

8. Visibility and sharing

We do not sell personal information or share it for cross-context behavioural advertising. Disclosure is limited to the following purposes and necessary scope.

8.1 Other users and audiences

Displayed names, avatars, profiles, albums and room information are visible to the audience of the relevant feature. Room interactions, speaking and ordinary gift displays may be visible or audible to room participants or the relevant audience. Rankings display relevant account and ranking information. Private messages go to the recipients you select.

Public gift interactions do not make full payment details, payout accounts, private contact details or complete financial records public. Avoid posting identity documents, bank accounts or other sensitive information in public profiles or rooms.

8.2 Agencies and cooperation

Agency membership and relevant member profiles may be shown within an agency. Leaders and relevant managers may, within their authority, access necessary application or contract status, activity time, active days and earnings statistics for members they manage, for management and settlement.

Agency leadership does not authorise access to unrelated documents, personal payout accounts, private messages or full financial records. Agency collection follows the separate confirmation and minimum-data rules in Section 3.

8.3 Providers and payment recipients

We provide necessary information to authentication, messaging, voice, hosting, storage, content-delivery, diagnostics, support and payment providers. Processors act under the service arrangement and applicable protection requirements. Institutions independently performing legal payment-verification duties process relevant information under their own notices.

Section 9 identifies app and website services; Section 3 identifies payout information and recipient categories. We impose appropriate processing, access and security restrictions and remain responsible for our use of providers.

8.4 Law, safety and disputes

Where permitted or required, we may disclose necessary information to competent authorities, law enforcement, courts, professional advisers or other appropriate recipients for valid legal requirements, litigation and disputes, fraud or abuse investigations, personal safety and lawful rights, or child-safety matters. We assess the request and scope; general safety interests do not justify arbitrary public disclosure.

8.5 Transfers of business and your instructions

Necessary information may transfer in a merger, acquisition, restructuring or asset transfer. We require corresponding protection obligations and provide legally required notice. Changed purposes follow the notice and consent rules in this Policy.

We may also disclose information following your verified request to a specified recipient. Such instructions do not authorise disclosure of unrelated information.

9. Providers, websites and local storage

9.1 App services and SDKs

The following services process data only for the features and activation circumstances described here. SDKs can collect technical data directly from the device; data sent first to Vora and then to a provider is also covered. Provider notices give further information, but do not expand the permissions or purposes Vora has disclosed.

9.2 Hosting, files and web delivery

Cloudflare R2 stores uploaded files and media, including selected profile, room, message, report and agency-application files. It processes file content, object identifiers and the technical request information needed to store, retrieve and delete those files. R2 uses an S3-compatible interface; this does not make Amazon S3 the provider of that object storage.

Cloudflare also provides website and content delivery, caching and network protection. Requests involve IP addresses, requested URLs or object paths, timestamps, browser or app connection information and the content being delivered. These support delivery, security, availability and cache management. Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/ .

Our website also uses Cloudflare Web Analytics / Real User Monitoring (RUM) to understand page availability and performance. The browser sends information such as the page and referring URL, a page-load identifier, navigation and loading times, and available browser performance measurements to Cloudflare. This can also occur when a website page is opened in the app’s WebView; the bundled offline notice does not load this script. According to Cloudflare, its RUM script does not use cookies or browser storage to track visitors, and the source IP received with a RUM request is discarded at its edge rather than stored in the RUM databases or logs. These statements concern RUM, not the separate delivery and security processing above. We use these measurements for website reliability, not advertising profiles. Where applicable law requires consent for this processing, it must be obtained before collection. Cloudflare describes the measurements and processing at https://developers.cloudflare.com/speed/observatory/rum-beacon/ .

Amazon Web Services (AWS) provides backend hosting and database infrastructure for account and business operations. It processes the account, transaction, application and security data hosted there and necessary infrastructure logs under the service arrangement. This is separate from Cloudflare R2 file storage. AWS Privacy Notice: https://aws.amazon.com/privacy/ .

Resend (Plus Five Five, Inc.) delivers verification and account-service emails requested through Vora. We send the destination email address, sender, subject and message body, including a verification code when that is the purpose of the message. Resend also processes delivery identifiers, status, time and error information to deliver messages and investigate delivery failures. We do not need your mailbox password. Resend Privacy Policy: https://resend.com/legal/privacy-policy .

If you communicate with us through WhatsApp for an agency application or support, the WhatsApp service also handles that communication under its own privacy notice, including the phone number and account, delivery and device/connection information needed for its service. We handle the messages and contact details we receive for the application or support purpose. Providing a WhatsApp contact number does not give Vora access to your phone’s contact list. WhatsApp Privacy Policy: https://www.whatsapp.com/legal/privacy-policy .

Service-provider access is limited by the service purpose and applicable contractual and legal duties. Storage and delivery do not authorise a provider to use identity documents, payout details or private messages for unrelated advertising. Section 8 explains audiences and permitted disclosures; Sections 10 and 13 address retention and safeguards.

9.3 Cookies, caches and local storage

The app locally stores notice confirmations, language and other preferences, session data and media or music caches for features used. Sessions and caches expire or are cleared according to their purpose. Android settings let you clear app data; that or uninstalling does not delete the server account.

Web visits involve technical information necessary for delivery and security. Necessary cookies or similar storage used for sessions, remembering explicit choices or security remain only until the session ends, choice expires or security purpose ends. You can clear or restrict browser storage; restricting necessary technology may affect the relevant function.

Reading this Policy or continuing to visit is not consent to optional advertising, cross-site tracking or analytics that require consent. The website performance measurements described in Section 9.2 are separate from app status reporting. Additional analytics or tracking require an appropriate legal ground and clear information about purposes, recipients, retention and choices; where consent is required, collection begins only after that consent. We do not treat the absence of cookies as an exemption from applicable privacy requirements.

9.4 Supporting software libraries

Android uses OkHttp/Ktor for networking; Glide and WebP/AVIF decoders for images; uCrop/Luban for cropping and compressing selected images; and Tencent libpag/VAP, SVGAPlayer, Lottie, AndroidSVG and AndroidX Media3 for animations and media playback. Network requests and remote resources involve the servers/providers described above; image editing and rendering occur on-device. These functions remain subject to this Policy's permissions, purposes, recipients and retention rules.

10. Retention, cleanup and deletion scope

We retain personal information only as needed to provide services, complete your requests, meet specific legal duties or handle identified safety and dispute matters. When the ground ends, we delete it or effectively anonymise it so a person cannot reasonably be identified. Removing a name while retaining a linkable account identifier does not make data anonymous.

10.1 Category-specific rules

The following retention periods or end conditions apply to each category.

• Accounts, profiles and relationships: while the account and relevant features need them; content deletion and account closure trigger corresponding cleanup, subject to the limited exceptions below.
• Server operational logs: our retention limit for ordinary logs is 30 days on a rolling basis. A necessary extract for an identified investigation follows that case’s retention ground; ordinary logging is not a reason to keep all account information indefinitely.
• Dedicated device diagnostics: limited to troubleshooting needs, retained for seven days after the particular diagnostic run ends, then cleared. Ongoing diagnostics and necessary case evidence follow their specific purpose.
• Account-deletion request records: normally 30 days after completion to verify status and resolve related issues. Where the same record is still needed to enforce a specific, unexpired ban, the limited ban-related part follows the ban periods below. This does not extend retention of all account data.
• Ordinary reports: cleared seven days after closure; necessary material linked to unresolved investigations, appeals, legal preservation or child-safety cases follows that specific ground.
• Agency applications, verification outcomes and documents: while needed for review, relevant verification, necessary appeals or specific disputes. We review the need for original documents after approval, rejection, withdrawal or the end of the leader’s role, and delete original images when a verification record suffices and no specific ground requires the originals.
• Agency relationships, contracts and activity: while needed to administer cooperation, calculate/reconcile earnings and resolve disputes. We clear unnecessary detail after cooperation, settlement and relevant obligations end.
• Payout-account details for future payments: while the payment arrangement is used. We replace or remove unnecessary old details when the account changes, the arrangement ends or the account is deleted, except what is necessary to settle pending amounts or meet specific law.
• Completed purchases, ordinary gifts, earnings and payment records: through delivery, refunds, settlement, reconciliation and disputes. Necessary tax, accounting or audit records remain for the applicable statutory period, calculated by the obligation and starting event. Financial relevance does not justify indefinite retention of everything.
• Limited permanent-ban records: necessary security identifiers, device signals and email digests may remain for 365 days after deletion to prevent ban evasion, without unrelated promotion.
• Limited temporary-ban records: until the original restriction expires, then cleared unless a separate necessary ground exists.
• Investigation, appeal, legal and child-safety evidence: limited to a specific matter until its investigation, appeal, required reporting or valid preservation ends. Necessity is reviewed during continued retention and records are cleared when the ground ends.

10.2 Financial records and identity documents

Retaining accounting evidence does not justify retaining every original document, historical full bank account or chat. Future payment details, completed-transaction evidence and verification outcomes have separate purposes and end conditions.

Legally or dispute-related retained records may include a limited Vora ID, account creation time, transaction reference and amount. These remain protected personal information and are not anonymous merely because the nickname was removed. They cannot be repurposed for unrelated recommendations or marketing. Contact us about your retained categories, grounds and retention calculation.

10.3 Messages, uploads and provider copies

Account cleanup covers profile, authentication and session information, relationships, relevant rooms and uploads, and messages and attachments within the applicable control scope. For information entrusted to messaging, voice or storage providers, we issue corresponding deletion or processing-termination instructions and follow up unsuccessful items. Disabling a provider account alone is not proof that all messages and attachments were deleted.

You may request deletion even where coordination is needed. Our response explains completed scope, categories subject to a specific retention ground and subsequent arrangements. Technical difficulty is not an indefinite retention ground.

Sent content forming another user’s conversation may remain in that conversation or an independently saved copy; our obligations for copies we control remain. Where others’ rights or law apply, we use necessary redaction, disassociation or other appropriate measures.

10.4 Backups, caches and exceptions

Your deletion request also covers corresponding files, content-delivery caches and backup copies. Recovery copies remain subject to the same purpose limits and deletion obligations. Where an individual record cannot immediately be removed from a recovery copy, its retention is limited to the necessary recovery, security or specific legal purpose until the copy expires or is replaced. It is not available for unrelated ordinary use, and a backup is not a ground for indefinite retention. Information covered by an effective deletion request remains subject to deletion if a recovery copy is restored.

Cache expiry and provider processing can follow primary-system cleanup. We limit the delay and continue the deletion tasks. Contact us to ask about the scope and progress of your request.

Exceptions are limited to identified records, purposes and periods. We periodically review continuing preservation, record the conditions for ending it, and delete or effectively anonymise data once no ground remains. These rules also apply when we discontinue a service, with legally required notice.

11. Account deletion and requests outside the app

Request account deletion by email

11.1 In-app requests

Go to Settings → Account deletion, read the information, verify your identity and submit the request.

In the normal deletion process, the account is deactivated and signed out; deletion begins after a seven-day cooling-off period. Before deletion starts, you may sign in and explicitly cancel the request. Signing in alone does not cancel it. Once deletion begins it cannot be cancelled. Deactivation itself is not completed data deletion.

If you hold agency-management, settlement or other responsibilities requiring handover, or there are unsettled payments or valid legal preservation requirements, we still receive the request. We explain the specific issue, reason for any hold, required steps and contact channel, and assist with necessary handover or settlement. We limit only the affected information or steps, do not hold requests indefinitely merely because of membership or general safety, and resume when the reason ends.

11.2 Requests without the app

Email service@voratalk.com with your Vora ID, linked contact information and account-deletion request. We ask only for reasonably necessary ownership verification and protection of others. Do not send passwords, verification codes, complete payment-card details or unrelated documents.

Email requests do not require reinstalling or signing in. External instructions: https://www.voratalk.com/products/vora/delete-account/ .

11.3 Results and assistance

Section 10 explains deletion and necessary retention. Completed deletion removes account access and relevant virtual assets, profiles and entitlements. Outstanding payments and statutory refund rights follow applicable law and transaction arrangements; deletion does not avoid legally required settlement.

We can communicate outcomes through the contact channel you provide. For progress, holds or review, email service@voratalk.com. Uninstalling or clearing a cache is not an account-deletion request.

12. Your personal information rights

You can use available profile editing, blocking and reporting features and manage Android permissions. You can request an export, correction or deletion by email without reinstalling the app; an automated download button is not required to make a request. Subject to applicable law, you can also request:

• Information and access: whether and how information is processed, access and a copy.
• Correction: rectification of inaccurate or incomplete information.
• Deletion: erasure of unnecessary or unlawfully processed information or where another legal condition applies; account deletion follows Section 11.
• Restriction and objection: limit processing or object to processing on relevant interest-based grounds and direct marketing where provided by law.
• Portability and exports: request an electronic copy of eligible account and transaction data in CSV or JSON, and copies of eligible media in the original format or through secure download links where available. Where the law provides portability, this covers the qualifying data you provided that is processed automatically on consent or contract grounds, and direct transfer to another controller where technically feasible. We protect other people’s information and explain any legally justified limitation.
• Withdrawal: revoke consent-based processing, without affecting earlier lawfulness or independent necessary legal processing.
• Automated-decision review: understand significant automated decisions, express your position and seek human intervention or review as provided by law.
• Complaints and appeals: challenge outcomes and complain to the competent data-protection or other supervisory authority.

Contact in-app support or service@voratalk.com, identifying the account and requested right. Email remains available without account access. We require only reasonable identity verification; a representative must show appropriate authorisation or legal grounds.

We aim to provide a substantive response within 15 working days of receiving your request. This service target never replaces a shorter applicable legal deadline. The statutory time limits in Section 13 run from receipt as required by law; we request any necessary verification promptly and do not automatically restart the clock after verification. If a lawful extension is necessary, we notify you within the initial applicable period, explain the reason and give the expected response date. Acknowledging receipt alone is not completion of the request. We explain reasons, scope and complaint or appeal options for any lawful limitation or refusal.

Requests are generally free. Reasonable fees or restrictions for manifestly unfounded or excessive requests apply only where law expressly allows and with an explanation. We do not unreasonably reduce service treatment merely for exercising rights. Withdrawing information essential to a feature may prevent that feature.

Stronger protections and additional regional rights continue to apply, including applicable limits on sensitive information, sale or cross-context advertising sharing. This Policy does not waive statutory rights. Particular legally required notices, representatives or supplementary disclosures are provided for the relevant processing.

13. Security and international processing

13.1 Security

We apply technical, organisational and management measures appropriate to the information and risk, including encrypted transmission such as HTTPS, identity and access controls, restricted access to non-public information, anomaly monitoring and relevant confidentiality/security obligations for personnel and providers.

Identity documents, payout accounts and non-public report evidence are for the limited responsibilities disclosed here, not for publication in profiles or rankings. The same confidentiality and retention rules apply to the stored files and the associated account records. No internet system is absolutely secure. If a personal-data incident occurs, we contain, investigate and remediate it and notify affected users and authorities as required by law.

Protect your credentials and report suspicious access or information exposure to service@voratalk.com.

13.2 International processing and safeguards

The operator is located in Hong Kong. Providing services and support and using the providers in Section 9 can involve access, transfers or processing outside your country or region.

Account operations, media storage, messaging, voice transmission, payments and diagnostics use different services, whose locations depend on their lawful service arrangements. Ask service@voratalk.com about processing regions, recipients and transfer safeguards relevant to your information.

Cross-border processing does not reduce our legal obligations. Where safeguards are required, we use applicable adequacy decisions, recognised contractual clauses or other lawful mechanisms and necessary access and security measures. Exceptions apply only where lawful and their conditions are met. We obtain separate consent before a transfer where required. You may request an explanation or legally available copy of safeguards, with necessary redaction for others’ rights or confidential business information.

13.3 European Economic Area

Where the General Data Protection Regulation (GDPR) applies, the purposes and grounds in Section 7 apply to the corresponding processing. You have the rights to access, rectification, erasure, restriction and portability, and to withdraw consent, subject to their legal conditions. You may object to legitimate-interest processing on grounds relating to your situation, and to direct marketing at any time. You may complain to a competent supervisory authority, including in your habitual residence, workplace or where an alleged infringement occurred.

We respond without undue delay and normally within one month of receipt. Where the number or complexity of requests justifies it, the period may be extended by up to two further months; we explain the extension within the first month. Solely automated decisions with legal or similarly significant effects are subject to the restrictions and safeguards described in Section 7 and applicable law. For transfers outside the EEA, the applicable mechanism must meet GDPR Chapter V, such as an adequacy decision or appropriate contractual safeguards with any necessary supplementary measures. You may request information about the safeguard relevant to your data.

13.4 Saudi Arabia

Where Saudi Arabia’s Personal Data Protection Law (PDPL) and its Implementing Regulation apply, you may request information about processing, access and a readable copy, correction, completion or updating, and destruction when the applicable conditions are met. You may withdraw consent for processing based on it and submit a complaint to the competent authority, the Saudi Data and Artificial Intelligence Authority (SDAIA).

We act on rights requests without delay and within 30 days of receipt. A permitted extension is limited to an additional 30 days, with advance notice and reasons. Consent and exceptions must meet the PDPL’s conditions; we do not treat legitimate interests as permission to process sensitive data. Transfers outside Saudi Arabia must meet applicable transfer rules, necessary safeguards and assessments. This notice does not itself constitute consent to every transfer or sensitive-data use.

13.5 Türkiye

Where Law No. 6698 on the Protection of Personal Data (KVKK) applies, AEVORA DIGITAL LIMITED is the controller. Information is collected electronically through the app, linked web forms, devices, providers and support interactions described in Sections 3, 4, 8 and 9. The purposes, recipient categories and legal grounds are described in those sections and Section 7; processing must satisfy Article 5 or, for special categories, Article 6. Overseas transfers must satisfy Article 9, including any required safeguards or other lawful conditions.

You may ask whether your data is processed, obtain information, learn the purpose and whether use matches it, and learn the recipients in Türkiye or abroad. You may request correction or deletion when legally due and notification of those actions to recipients, object to an adverse result produced exclusively by automated analysis, and seek compensation for damage caused by unlawful processing. Send a request to our email or registered address. We respond as soon as possible and within 30 days. After first applying to us, you may complain to the Personal Data Protection Board within the statutory periods: generally within 30 days of learning our response and in any event within 60 days of your application, as Article 14 provides.

13.6 United Arab Emirates

Where the UAE’s Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data applies, you may exercise its rights to information, access and transfer of eligible data, correction, erasure, restriction or cessation of processing, and objection to qualifying automated decisions, subject to the law’s conditions and exceptions. You may withdraw consent for consent-based processing and complain to the competent UAE data-protection authority. We handle requests within the applicable statutory requirements and the service target in Section 12.

Processing without consent requires an applicable statutory exception; overseas transfers require a lawful route and safeguards under the applicable UAE rules. Separate free-zone regimes, including DIFC or ADGM rules, apply only where their own scope is met. Residence in the UAE alone does not make the DIFC regime apply to every user.

13.7 Hong Kong

Where Hong Kong’s Personal Data (Privacy) Ordinance (PDPO) applies, you may request confirmation of whether we hold your personal data, access to that data and correction of inaccurate data, subject to the Ordinance’s conditions and exemptions. Send requests to service@voratalk.com or our registered address; we may seek proportionate information to verify your identity and locate the records. A data access request may attract a fee that is not excessive, where the Ordinance permits it; we explain any such fee before proceeding.

We handle data access and correction requests within the applicable PDPO requirements, normally within 40 calendar days of receipt. Where the Ordinance permits a different procedure, a refusal or delayed compliance, we give the required notice and reasons within the statutory period and comply as required. Our 15-working-day service target in Section 12 remains a target and does not replace these legal rules. You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD): https://www.pcpd.org.hk/ . Other rights provided in this Policy remain available on the grounds stated for them; we do not describe all GDPR rights as identical statutory rights under the PDPO.

14. Age, children’s information and child-safety standards

14.1 Adults only and improperly collected information

Vora is only for people aged 18 or older, even where a parent or guardian would consent. We use the provided birth date to check age and investigate indications of ineligible accounts.

If we learn that someone under 18 uses Vora or their information was collected contrary to this rule, we investigate, restrict or terminate access and delete relevant information as appropriate. Limited evidence required or permitted for a specific legal or child-safety purpose follows Section 10, with restricted use, access and duration, not unrelated promotion or profiling.

Parents, guardians and other users can report age or children’s-data concerns through in-app reporting, support or service@voratalk.com. We request only what is needed to locate and verify the concern.

14.2 Vora’s public child-safety standards

Vora prohibits child sexual abuse and exploitation (CSAE), including creating, uploading, distributing or soliciting child sexual abuse material (CSAM), sexualised contact with minors, grooming, sextortion, solicitation or facilitation of sexual exploitation, and related harm to children. This applies to accounts, profiles, avatars, albums, room information, voice interactions, messages and other user content.

Report through the relevant in-app reporting or support feature or service@voratalk.com. Where possible, provide the account, room or message identifier, time and brief description. Reporters are not required to download, save or forward suspected illegal material.

Personnel responsible for safety prioritise these concerns, take appropriate content removal or restriction and account limitation or termination measures, preserve limited evidence as legally required, and report to competent authorities or appropriate child-protection reporting organisations under applicable law. Contact local emergency services for imminent personal danger.

Evidence is not publicly distributed and is accessible only to people who need to handle it. Retention and lawful disclosure follow Sections 8 and 10. Incorrect decisions can be appealed through support or the email above. Age restrictions, public standards, report handling and content action are applied as separate requirements.

15. Changes and contact

We change the update date when revising this Policy. Important changes to information, purposes, recipients, rights or other matters are communicated through in-app notices or other appropriate means, with required advance notice. Separate or renewed consent is obtained before new processing where required; silence or continued use alone is not that consent.

AEVORA DIGITAL LIMITED handles privacy enquiries, account deletion, information-rights requests, children’s-information and child-safety matters through service@voratalk.com.

Address: UNIT 11, 9/F, THE CLOUD, NO.111 TUNG CHAU STREET, TAI KOKTSUI, KOWLOON, HONG KONG.

You may also use relevant in-app support or reporting. Email remains available when signed out or after uninstalling. Provide the account identifier and explanation needed to locate the issue, without passwords, verification codes or unrelated identity or payment information.