Privacy Policy
How Vora collects, uses, shares and protects personal information on our website, in the Vora CRM, and in our own insurance agency.
Last updated November 4, 2026
Draft for counsel review
In short
- Insurance agencies use the Vora CRM to manage their own clients. For that client data, the agency is in charge and Vora processes it on the agency's instructions. The agency's own privacy notice applies.
- Vora is in charge of the data it collects for itself: website visitors, demo requests, job applicants, the accounts of people who log in to the CRM, and the clients of Vora's own insurance agency.
- Calls placed through the Vora dialer are recorded, with a spoken disclosure. Recordings are kept for 730 days by default.
- AI features are opt-in. AI providers process data under zero data retention and do not train on it.
- We do not sell personal information, and we do not share it for cross-context behavioral advertising.
- You can ask to access, correct, delete or export your information. Reply STOP to any text to stop texts and calls from that agency.
This summary is for convenience. The full text below governs.
1. Who we are and what this policy covers
Vora Financial LLC, a Florida limited liability company ("Vora", "we", "us"), operates the website at vorafinancial.io, the Vora CRM platform at https://app.vorafinancial.io, and a licensed insurance agency.
In this policy, the Service means the Vora CRM platform: the web app, the mobile web app, the client portal, the power dialer, texting, AI features and APIs. A Customer (or Agency) is an insurance agency or IMO that subscribes to the Service. An Authorized User is an owner, admin, manager, agent, producer or sub-agency member the Customer gives access. A Client is a consumer (a prospect, lead, policyholder or beneficiary) whose information a Customer puts in the Service. Client Data is the personal information about Clients inside the data Customers submit (Customer Data).
This policy covers personal information about people in the United States. It does not cover the websites or practices of the Customers who use the Service, of insurance carriers, or of other third parties.
2. Our two roles
How we handle your information depends on our relationship with you.
When Vora decides how your information is used (controller)
Vora is the controller (the "business" under California law) for:
- visitors to our website and people who contact us or request a demo;
- job applicants;
- Authorized Users, for their account, login, security, billing and usage information;
- the clients and prospects of Vora's own insurance agency, where Vora is the agency of record. Section 13 gives the privacy notice for those clients.
When Vora processes information for an agency (service provider)
Vora is a service provider (a "processor") for Client Data that a Customer puts in the Service. The Customer decides what it collects about its Clients and why. We process Client Data only to provide the Service to that Customer, under our contract and our Data Processing Addendum. We do not use Client Data for our own marketing, and we do not sell it.
[DECISION: whether each Customer must publish its own privacy notice and SMS terms (on its own website or on a Vora-hosted page for that agency), or may link to this policy. We recommend each agency publish its own. The agency is the financial institution with its own GLBA notice duty, and its 10DLC text campaign needs a privacy policy in its own name.]
3. Information we collect
The tables below list what we collect, grouped by where it comes from.
From website visitors, demo requests and job applicants
| Source | Information |
|---|---|
| Demo and contact forms | Name, email, phone, agency name, role, team size and your message. The form is delivered to us by email. |
| Job applications | Name, email, phone, years of experience and anything else you choose to tell us. |
| Your device | IP address, browser and device type, pages viewed and referring page, collected automatically. See section 4 for cookies and analytics. |
From Authorized Users
| Category | Information |
|---|---|
| Account | Name, email, phone, role, agency and sub-agency membership, profile photo, settings. |
| Security | Password hash, multi-factor authentication factors, login times, IP address and user agent. |
| Licensing and contracting | Producer licences, states, appointments and carrier contracting requests. If you upload your NIPR licence PDF, we read it to set your licensed states and delete the PDF after 1 hour. |
| Commissions | Commission levels, splits, advances and chargebacks your agency records. |
| Billing | Plan, seats, invoices and payment status. Our payment processor holds your card details; we do not store full card numbers. |
| Terms acceptance | When you accept our terms: the document version, a hash of its text, the time, a hash of your email, your IP address and your user agent. |
| Usage | Features used, texts sent and AI requests made (counted for capacity planning), error reports and audit logs of actions in the Service. |
Client Data (put in the Service by a Customer)
A Customer and its Authorized Users decide what Client Data to enter. The Service is built to hold:
| Category | Information |
|---|---|
| Identity and contact | Name, date of birth, email, phone, mailing address, county and map location, time zone. |
| Government identifiers | Last 4 digits of the Social Security number only, and last 4 digits of the Medicare number only. The Service does not store full numbers. |
| Policies and applications | Carrier, product, application and policy numbers, premium, face amount, rate class, status, underwriting status and billing details such as a Social Security benefit draft flag. |
| Beneficiaries | Name, relationship, date of birth and share. |
| Leads from lead vendors | Name, phone, email, address, date of birth and other fields the vendor sends (which may include age, coverage interest or health answers), plus consent certificates (for example TrustedForm, Jornaya or comply.support IDs). |
| Consent and opt-out records | Type of consent, the seller named, the consent text and version, source page, certificate ID, time, IP address, user agent, and any revocation, Do Not Call or STOP request. |
| Calls | Call time, duration, numbers, outcome, the call recording, and, if the agency turns it on, a transcript and summary (section 5). |
| Messages | Texts and emails sent to and from the Client, delivery status and timestamps. |
| Notes and tasks | Free-form notes an agent writes. Notes may contain health or other sensitive details if the agent enters them. |
| Client portal | If a Client logs in to the portal: login details and the policies they view. Clients see only their own policies. |
The Service is not designed to store full Social Security numbers, bank account numbers or card numbers. Quote inputs such as height, weight and tobacco use are used to run a quote and are not written to logs.
5. Call recordings
- Why: quality review, compliance (for example, proving what consent was given and what was disclosed), dispute resolution and agent training.
- All-party consent states: some states, including Florida, California, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington, require every party's consent to record. The Service flags these states and the disclosure is given on every recorded call. If you do not want to be recorded, you may end the call or ask the agent to continue another way.
- Who can listen: the agent on the call and Authorized Users of that agency whose role allows it. Vora support staff access recordings only to provide support the agency asked for, and that access is logged.
- Retention: recordings are deleted after 730 days by default. Each agency can set a period from 30 to 3,650 days. When a recording is deleted, its transcript, summary and any cleaned copy are deleted with it.
- We do not use recordings to create voiceprints or to identify people by their voice.
[COUNSEL: confirm that a disclosure at the bridge, rather than before the call is connected, satisfies all-party consent states (Fla. Stat. 934.03, Cal. Penal Code 632), and confirm the 730-day default.]
6. AI processing
Some features of the Service use AI models. Each is listed below with the data it receives.
| Feature | Data sent | Provider | On by default? |
|---|---|---|---|
| Call transcription | The call recording audio | OpenAI, through Vercel AI Gateway | No. Each agency opts in. |
| Call summary | The transcript. The model is instructed to leave out contact details, Social Security numbers, policy numbers, payment details and health details. | Anthropic, through Vercel AI Gateway | No. Each agency opts in. |
| Data Assistant (admins only) | Read-only, masked results: names shown as first name and last initial, with no IDs or contact details. Questions are scrubbed of Social Security numbers, dates of birth, emails and phone numbers. Nothing is stored. | Anthropic, through Vercel AI Gateway | Admins choose to use it. |
| Carrier report mapping | Only spreadsheet column headers and the masked shape of sample cells, never the underlying values | Anthropic, through Vercel AI Gateway | No. Opt-in. |
| Recording audio cleanup | The call recording audio, to reduce background noise | ElevenLabs, directly | No. Each agency opts in. |
| Generated voice audio | Text an agency writes for voice prompts, such as a voicemail or disclosure message | ElevenLabs, directly | Used only if the agency creates one. |
- No training, no retention: requests through Vercel AI Gateway are sent with zero data retention, and the model providers do not use them to train models. ElevenLabs is called directly, not through the Gateway, under its own terms. [DECISION: confirm the Vercel plan enforces request-level zero data retention for OpenAI transcription, and enable ElevenLabs zero-retention mode or sign its DPA before cleanup is offered to outside agencies.]
- Lead files never reach AI. Uploaded lead files and PDFs are not sent to any AI model.
- No automated decisions. AI output is shown to people as a suggestion or summary. The Service does not use AI to make decisions that produce legal or similarly significant effects about you, such as whether you are offered insurance or at what price. Insurance carriers make underwriting decisions.
- AI-generated replies to texts and AI help answers are turned off.
7. How we use information
We use information we control to:
- provide, secure and support the Service, and keep accounts safe (including multi-factor authentication and fraud prevention);
- respond to demo requests, questions and job applications;
- bill for subscriptions and keep financial records;
- send service messages, such as security alerts, notifications and product announcements (Authorized Users can turn off announcements);
- for Vora's own agency, quote, apply for and service insurance for our clients;
- enforce calling, texting and recording rules, honor opt-outs and keep evidence of consent;
- improve the Service, using aggregated or de-identified data;
- comply with law, respond to lawful requests, and establish or defend legal claims.
We use Client Data only to provide the Service to the Customer that entered it, to keep the Service secure, to meet our legal obligations, and as the Customer instructs. We may create de-identified, aggregated statistics (for example, average connection rates) that do not identify any person or agency.
9. Mobile messaging (SMS)
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service and message delivery, is permitted. All other use-case categories exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.
When you give your mobile number to an insurance agency that uses Vora (or to Vora's own agency) and agree to receive texts, we collect your number, your consent record and the content and metadata of the messages. We use your number only to send the messages you agreed to and to answer your HELP and STOP requests. Each agency texts under its own registered name.
Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT) to any message to stop texts from that agency. A STOP also adds your number to that agency's Do Not Call list, so its dialer will not call you either. Reply HELP or INFO for help, and START to receive texts again. Message frequency varies. Message and data rates may apply. Consent is not a condition of purchase. See our SMS Terms.
10. How long we keep information
We keep information only as long as we need it for the purposes in this policy, or as long as the law requires. For Client Data, the Customer can set or shorten some periods and can ask us to delete data sooner, except where we must keep it (see the exceptions below).
| Information | How long |
|---|---|
| Consent records, opt-outs and Do Not Call entries | At least 5 years. These records cannot be edited. |
| Call recordings, transcripts, summaries and cleaned audio | 730 days by default. Each agency can set 30 to 3,650 days. |
| Uploaded lead files | Deleted 30 days after the import ends. |
| NIPR licence PDFs | Deleted 1 hour after upload. |
| Raw text message payloads from the carrier | 30 days. The message itself stays in the conversation. |
| Notifications | Read notifications: 90 days. All notifications: 180 days. |
| Underwriting log | 13 months. |
| Carrier report files | 2 years. |
| Account and Client Data | For the life of the Customer's subscription, then through the offboarding window: the Customer can export its data, and we delete it after the deletion period agreed with the Customer (30 days unless agreed otherwise). |
| Billing and tax records | 7 years, as tax and accounting rules require. [COUNSEL: confirm 7 years.] |
| Record of support staff access to personal information | 6 years. [COUNSEL: confirm; recommended to match our security program evidence.] |
| IP address and user agent recorded with a terms acceptance | 24 months. The acceptance record itself is kept. |
| Website form emails and job applications | Up to 2 years, unless you ask us to delete them sooner or we hire you. |
| Database backups | Roll off automatically, within about 7 days today. |
| Evidence kept after an agency is deleted (consent, Do Not Call, opt-outs, billing and access logs; never audio or transcripts) | 7 years after the deletion. |
While an agency is active, deleting a Client in the Service archives the Client rather than erasing the record, so that history, commissions and compliance evidence stay intact. Erasure is handled on request (section 12).
11. Security
We protect personal information with administrative, technical and physical safeguards, including:
- encryption in transit (TLS, with HSTS) and at rest by our hosting providers; encrypted exports;
- row-level security that keeps each agency's data separate;
- multi-factor authentication, and a fresh second factor for sensitive actions such as exports and Do Not Call removals;
- masking of sensitive fields, storing only the last 4 digits of Social Security and Medicare numbers;
- logging of every support staff read of sensitive fields;
- error monitoring with personal data scrubbed, rate limits, and regular security reviews.
No system is completely secure. If we learn of a security incident affecting your information, we will notify the affected Customer, and you or regulators where the law requires. See our Security overview.
12. Your privacy rights
Wherever you live in the United States, you can ask us to:
- Access: confirm whether we process your personal information and give you a copy.
- Correct: fix inaccurate information.
- Delete: delete your information, subject to the exceptions below.
- Portability: give you your information in a common, machine-readable format.
- Opt out: of the sale of personal information, targeted advertising and profiling with legal or similarly significant effects. We do none of these, but you may still ask. You can also opt out of texts (reply STOP), calls (ask to be put on the Do Not Call list) and marketing email (use the unsubscribe link).
- Appeal: if we deny your request, ask us to reconsider.
We will not discriminate against you for using these rights. We will not deny you service, charge a different price or give a different quality of service because you made a request.
Exceptions
We may keep information when the law requires it or allows us to, for example: consent and Do Not Call records that prove compliance with telemarketing law; records of transactions and billing; information under a legal hold; and information needed to complete a transaction you asked for, secure the Service or defend legal claims. We will tell you what we kept and why.
California residents
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives California residents the rights above, plus the right to know the categories of personal information we collected, the sources, the purposes and the categories of recipients in the past 12 months. Sections 3, 7 and 8 give that information. Using the CCPA's categories, we collect identifiers, customer records, commercial information, internet activity, audio information (call recordings), professional information (licences) and sensitive personal information (partial government ID numbers, account logins, and health information if entered). We use sensitive personal information only to provide the services requested and as the CCPA otherwise permits, and not to infer characteristics about you.
Information collected under the federal Gramm-Leach-Bliley Act (GLBA) and the California Financial Information Privacy Act, such as information about insurance applicants and policyholders, is exempt from most of the CCPA. Those people are protected by the insurance privacy notice in section 13 and by insurance privacy law.
Other states
Virginia, Colorado, Connecticut, Texas, Oregon, Florida and other states have comprehensive privacy laws. Many of them apply only to businesses above a size threshold, and many exempt financial institutions or data covered by the GLBA. Vora may currently fall below these thresholds or within these exemptions. We still honor the requests in this section for everyone, and we will meet each law's deadlines and appeal rules where it applies. [COUNSEL: confirm which state laws apply to Vora today, given its size and its status as a licensed agency; see the internal applicability analysis.]
If your agency uses Vora
If your information is in the Service because an insurance agency put it there, your agency decides your request. Contact your agency directly. If you contact us, we will forward your request to your agency within 5 business days and tell you we did.
How to make a request
To make a request, email info@vorafinancial.io or call 786-654-1233. Tell us your name, the email or phone number we would know you by, your state, and what you are asking for. You may also write to us at Vora Financial LLC, 400 Sunny Isles Blvd, Sunny Isles Beach, FL 33160.
- Verification: we will confirm your identity by matching information you give with information we hold, for example by sending a code to your email or phone. For copies or deletion of sensitive information we may ask for more. We use the information you give only to verify you.
- Authorized agents: someone may make a request for you if you give them signed, written permission. We may still ask you to confirm your identity with us directly, unless the agent holds a power of attorney.
- Timing: we confirm receipt within 10 business days and respond within 45 days. If we need more time, we will tell you why, and we may take up to 45 more days.
- Appeals: if we deny your request in whole or in part, we will explain why. You can appeal by replying to our decision or by writing to us with "Appeal" in the subject. We will decide within 60 days and tell you how to contact your state attorney general if you disagree.
- Cost: requests are free. We may decline or charge a reasonable fee for requests that are clearly unfounded or excessive, as the law allows.
13. Privacy notice for clients of Vora's own insurance agency
This section applies only if Vora's own licensed agency (not another agency that uses our software) helps you buy or keep insurance. It is our privacy notice under the Gramm-Leach-Bliley Act and state insurance privacy rules.
What we collect
Nonpublic personal information, which includes: information from your applications and conversations with us (name, address, date of birth, phone, email, income, beneficiaries, health and lifestyle answers needed for underwriting); information about your policies and premiums; information from insurance carriers about your application and policy status; and information from lead vendors when you asked to be contacted about coverage.
What we share
- With insurance carriers, to apply for and service your coverage.
- With service providers who help us operate (such as our hosting, telephone and texting providers), under contracts that keep the information confidential.
- As the law permits or requires: for example, to prevent fraud, to regulators, or in response to legal process.
We do not share nonpublic personal information with nonaffiliated third parties for their own marketing. We do not share it with other companies for joint marketing. [DECISION: confirm Vora has no joint marketing agreements and no affiliates that receive client information; if either changes, this notice and an opt-out are needed.] We do not disclose health information except to underwrite, service or administer your insurance, or as the law permits.
Because we share only as described above, the law does not require us to offer you an opt-out. If that ever changes, we will give you a new notice and a way to opt out before we share.
How we protect it
Access is limited to people who need it to serve you. We maintain the safeguards in section 11 under a written information security program.
Former clients
We treat information about former clients the same way.
Questions: email info@vorafinancial.io or call 786-654-1233.
[COUNSEL: confirm the notice content and delivery method under Fla. Admin. Code ch. 69O-128 and 16 C.F.R. Part 313/12 C.F.R. Part 1016 (for example, whether a standalone notice must be given at application, and the annual-notice exception).]
14. Children
Our website and the Service are for adults. They are not directed to children, and we do not knowingly collect personal information from children under 13 through them. A Customer may record information about a minor who is named as a beneficiary or insured on a policy; that information is Client Data and is handled under the agency's instructions. If you believe a child gave us information through our website, contact us and we will delete it.
15. United States only
Vora serves agencies and consumers in the United States. We store and process information in the United States. The website and Service are not intended for people outside the United States.
16. Global Privacy Control and Do Not Track
We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising, for that browser. Because we do not sell or share personal information, there is nothing further to opt out of today, but we will keep honoring the signal if our practices change. On our website we also treat GPC as rejecting the optional analytics and marketing categories in the cookie banner, so Vercel Web Analytics does not load in that browser.
There is no common standard for "Do Not Track" browser signals, so we do not respond to them. GPC is the signal we honor.
17. Changes to this policy
We may update this policy. We will post the new version here with a new "last updated" date. If a change is material, we will tell Authorized Users in the Service or by email before it takes effect. We will not use personal information in a materially different way than we described when it was collected without giving notice and, where the law requires, getting consent.
18. Contact us
Vora Financial LLC, 400 Sunny Isles Blvd, Sunny Isles Beach, FL 33160. To reach us about privacy, email info@vorafinancial.io or call 786-654-1233.
Version 2026-11-04