Privacy Policy

1. Who the controller is

The controller is Nydrok LLC, 1209 Mountain Road Pl NE, Ste R, 87110 Albuquerque, New Mexico, United States of America, EIN 36-5152970. For data protection matters write to info@vorda.studio.

This document describes how we handle personal data when running the vorda.studio website and the application behind the login.

2. Two different roles, two different regimes

For data about your account (email, company name, billing, what you did in the application) we are the controller. We decide why and how it is processed and we are responsible for that.

For data from your advertising and analytics accounts, including data about clients you manage in the tool, we are a processor. We process it on your instruction and you decide what happens to it. If you need to conclude a data processing agreement, get in touch.

3. What data we process

Account and billing data

• Email address and login credentials. The email lives in the authentication service; we do not duplicate it into our own database.
• Company and brand names, the name of the third level, roles and memberships.
• Billing details and payment history. Your card number never reaches us; Stripe processes it.

Data from connected accounts

• Campaign performance data from Google Ads and Meta, traffic from Google Analytics 4, queries from Search Console, the product feed from Merchant Center.
• The email address of the connected Google account, so you can see which account is connected.
• Store orders, if you enable that option.
• Access tokens for those accounts. We store them encrypted (AES-256-GCM), never in readable form.

Content created in the tool

• Conversations with VIA, campaign proposals, copy and generated creative.
• A record of changes made in your advertising accounts.

Technical data

• Operational and error logs needed to run and secure the service.

4. Why we process it and on what basis

• To make the service work (performance of a contract): account, connections, overviews, monitoring, campaigns, creative, support.
• To be able to invoice (performance of a contract and legal obligation): payments, invoices, accounting.
• To keep the service secure and improve it (legitimate interest): operational logs, detecting misuse, fixing errors.
• To be able to inform you (performance of a contract for operational messages, consent for commercial messages, which you can withdraw at any time).

5. Data from Google accounts

When you connect a Google account, Vorda uses Google’s official APIs to access only the services it needs to work with your advertising. You grant this access on Google’s consent screen and you can revoke it at any time.

• Google Ads: campaigns, budgets, keywords, search terms, conversions and performance metrics. Changes to campaigns, such as adjusting a budget or adding a negative keyword, are made only after you approve them or within the level of autonomy you have set yourself.
• Google Analytics 4: traffic, traffic sources, conversions and purchases. Changes to property settings (key events, audiences, custom dimensions, the link to Google Ads) only after you approve them.
• Search Console: search queries, impressions and clicks from search, sitemap status. Submitting or removing a sitemap only after you approve it.
• Merchant Center: products, their status and feed diagnostics. Changes to product labels and data sources only after you approve them.
• Google account email address: so that you can see in Integrations which account is connected.

We use data from Google solely to provide the features you see in Vorda: overviews, account monitoring, findings quantified in euros, proposed changes, VIA’s answers and carrying out the changes you approved. In addition:

• we do not sell it and we do not use it for advertising, retargeting or building advertising profiles,
• we do not use it to develop, improve or train generalized artificial intelligence or machine learning models,
• we do not use it to determine creditworthiness or for lending purposes,
• we share it only with the suppliers listed below and only to provide Vorda’s features, for example part of the data goes to the language model when you ask VIA about your numbers,
• people on our side do not read it, except when you explicitly ask us to (for example in support), when it is necessary for the security of the service, when the law requires it, or when it is aggregated and anonymized for internal operations.

Vorda.studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke access in Vorda under Settings, Integrations, Disconnect, or directly at Google on myaccount.google.com/permissions. When you disconnect in Vorda, we delete the access token immediately.

6. Data from Meta accounts

You connect Meta ad accounts (advertising on Facebook and Instagram) by logging in with Facebook. Vorda requests only the ads_read permission, that is, read access to the ad accounts you have access to. It does not write to your Meta ad accounts.

• ad account name, currency and ID,
• campaign names, budgets and performance metrics (impressions, clicks, spend, purchases and their value).

We use it in the same way as data from Google, solely for Vorda’s features: overviews, monitoring, findings and VIA’s answers. We do not sell it and we do not use it for advertising or to train artificial intelligence models.

You can revoke access in Vorda (Settings, Integrations, Disconnect) or on Facebook under Settings & privacy, Settings, Business integrations, where you remove Vorda.studio. The access token then stops working.

7. What happens to data when VIA answers

VIA is a language model. To answer a question about your numbers, the part of your data the question concerns is sent to the model. The model is operated by Anthropic.

We do not use your data to train models, and that includes data from Google and Meta. Under its contractual terms the model provider does not use it for training and keeps it only temporarily for safety purposes. Vorda keeps the conversation history in its own database so that it does not sit in two places at once.

8. Where the data sits and how it is protected

Both the database and the file storage are in the European Union, Frankfurt region.

• Access tokens for advertising accounts are encrypted (AES-256-GCM).
• Access to database rows is restricted at the database level, not only in the application.
• Transfers take place over an encrypted connection.
• We do not see passwords; the authentication service handles them.

9. Who we share data with

We do not sell data. We share it only with suppliers without which the service would not work, and only to the extent they need for their task:

We may also disclose data to public authorities where the law requires it.

10. Transfers outside the European Economic Area

The operator is established in the United States and some of the suppliers listed above process data in the USA. Such transfers are covered by the European Commission’s standard contractual clauses and by supplementary measures including encryption. We will provide a copy of the transfer documentation on request.

11. How long we keep it

• Account data: for as long as the account exists.
• After the account is closed: deleted within 30 days, except what we must retain by law.
• Billing documents: for the period required by tax rules.
• Access tokens: deleted immediately once an account is disconnected.
• Data loaded from connected accounts: for as long as your Vorda account exists, or until you ask us to delete it.
• Operational logs: as a rule within 90 days.

12. How to request deletion of your data

You can have data from connected accounts and data about your account deleted like this:

• Disconnect the account in Vorda: Settings, Integrations, Disconnect. We delete the access token immediately and Vorda loses access to the account.
• Send a request to info@vorda.studio from the email address you use to log in to Vorda. Say whether you want the data from a specific connection (Google or Meta) deleted, or your whole account. We delete the data within 30 days and confirm the deletion by email. We keep only what the law requires us to keep, such as invoices.

If you remove Vorda in your Facebook or Google account settings, the access token stops working immediately. To have data we loaded earlier deleted, send an email as described above.

13. Your rights

If the GDPR applies to you, you have the right to:

• know what data we process about you and obtain access to it,
• have incorrect data corrected,
• request erasure,
• request restriction of processing,
• receive your data in a machine-readable form and transfer it elsewhere,
• object to processing based on legitimate interest,
• withdraw consent at any time where we asked for it.

Write to info@vorda.studio and we will reply within one month at the latest. If you are not satisfied with how we handled it, you can turn to the supervisory authority in your country. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic.

14. Cookies

We use strictly necessary cookies only, without which logging in and staying logged in would not work. They maintain the session, provide security, remember the selected context (which brand and client you have open) and remember the language you pick on the website. The language is stored only once you choose it yourself, not on arrival.

We do not use advertising or third-party tracking cookies and we do not link your behaviour on our website to advertising profiles. That is why we do not ask you for cookie consent; it is not required for strictly necessary cookies.

You can delete cookies in your browser settings. Once deleted, the service will log you out.

15. Changes to this document

We will update this document when what it describes changes, for example when a supplier is added. We will notify you of a material change by email or in the application. The version with the effective date shown above is always the one that applies.

· Contact

Nydrok LLC
1209 Mountain Road Pl NE, Ste R
87110 Albuquerque, New Mexico
United States of America
EIN: 36-5152970

info@vorda.studio · +1 505 348 6365