Privacy Notice

This notice explains how Vorexa Core, a Vorexa product, processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Vorexa Core is a private, single-owner platform: there is no public sign-up, and each deployment holds the records of one account holder.

Vorexa is a South African business. Its full registered legal name, entity status and verified CIPC registration details will be published here once finalised — they are not invented or estimated in this notice.

• Account information — your email address and authentication credentials (handled by Supabase Auth).
• Profile information — first name, surname, and your theme/privacy preferences.
• Records you choose to enter — Health (medicines, doses, appointments, weight), Notes & Lists, Calendar events and important dates, Money (accounts, transactions, budgets, debts), Vehicle & Travel (vehicles, fuel, trips, services), Home & Pets, and Vault documents, policies and credentials, including any files you attach.
• Google Calendar data — if you connect a Google account, we request the calendar, openid and email scopes to read your events for the next 90 days and mirror them into your Calendar module. This is one-way (Google → Vorexa Core); we do not write events back to your Google Calendar.
• Support tickets — the subject and message you submit when reporting a problem.

We process this information to operate the platform for you: authenticating your account, displaying and organising your records, computing the Today view and reminders, syncing your connected Google Calendar, and responding to support requests. We do not use your personal information for marketing, advertising or profiling, and we do not sell it.

We use a small number of infrastructure providers (operators, in POPIA terms) to run the platform:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and delivery.
• Google — only if and when you connect your Google Calendar account.

We do not share your records with any other third party.

We retain your records for as long as your account remains active, so the platform continues to work as your ongoing personal record. If you ask us to close your account, we delete your records within a reasonable period, other than information we are required to keep for legal or accounting reasons.

Under POPIA you have the right to request access to, correction of, or deletion of your personal information, to object to processing, and to lodge a complaint with the Information Regulator (inforegulator.org.za). To exercise any of these, contact us using the details below.

Every table in the database is scoped with row-level security so records are only readable by the account that owns them. The Health and Vault areas lock after 15 minutes of inactivity and require your account password to re-enter. A one-tap privacy blur hides sensitive values on screen. See the Security page for detail. We avoid claims we cannot evidence — for example, we do not describe Vault or Health fields as field-level encrypted unless that is independently verified.

No third-party analytics, advertising or tracking scripts are active on this platform. If that changes, this notice will be updated to disclose exactly what is in use.

We may update this notice as the platform changes. Material changes will be reflected in the "Last updated" date above.

For privacy requests, contact mornay@vorexa.co.za. Information Officer registration with the Information Regulator is in progress; formal Information Officer particulars will be published here once registered.