Who we are
Vora builds software and hardware that makes air conditioners you already own run on less electricity. We are registered in Qatar with the Ministry of Commerce and Industry under commercial registration number 240351.
We are the controller of the personal data described here. Contact us at info@vora.qa.
What this policy covers
This policy covers vora.qa, the Vora app for iPhone and Android, the dashboard at app.vora.qa, and the Vora controller and the service it connects to.
The sections below apply to all of them. Four annexes at the end cover what is specific to each.
We write "your home" throughout because that is what the product calls it. Where you use Vora for an organisation, the same terms apply.
What we collect
- Account details: your name, email address, password and the identifiers and verification information needed to secure your account. Passwords are stored as hashes.
- Your home's fixed location, captured during setup and when you reconfigure it, to obtain local weather forecasts. We do not continuously track your phone.
- The names you give your home, rooms and controllers, and the schedules and access you set.
- Readings from the controller: room temperature and humidity, the state of the air conditioner, the settings applied to it, and electricity readings where a meter is fitted.
- Technical information: device and app versions, account and controller identifiers, app activity, request performance, command outcomes and errors. Controller reports also include operating, model and maintenance diagnostics.
- Anything you send us, and the address or number you send it from.
We do not ask for payment card details, identity numbers or health information. Vora has no microphone, no camera in the controller and no motion sensor.
During setup, your phone sends your Wi-Fi name and password directly to the controller over Bluetooth. They are stored on the controller, not sent to our cloud service or included in app diagnostics.
We do not sell personal data or share it with advertisers or data brokers. The Vora app has no advertising. App diagnostics and Google scanner metrics are described in Annex B.
Why we use it
- To provide the service you asked for: your account, and the readings and commands needed to run your air conditioner. We also use technical information to diagnose faults and improve reliability.
- With your consent, which you may withdraw at any time: your home's location, and marketing email.
- To keep the service secure and available, and to prevent misuse.
- To meet a legal obligation, or to respond to a lawful request from a Qatari authority.
Automatic control
Vora can adjust air-conditioning settings automatically using your room's readings and local weather. The controller adapts its model of that room and air conditioner, and sends operating and model diagnostics to Vora.
You can change settings using the app or the air conditioner's own remote. App commands depend on the controller's connection and confirmation. We do not send customer data to external general-purpose AI models for training. Questions about automatic control go to info@vora.qa.
Sharing a home
Vora allows more than one person to manage the same home.
The owner of a home can see the name and email address of every member. Members can see the conditions, history and schedules of the rooms they have access to, and the changes made to them.
When you invite someone to a home, the invitation email includes your verified Vora account email address so they can identify who invited them.
If a Vora user invites you to a home, we receive the email address they provided in order to send the invitation, and we use it for that purpose only. To have it removed, write to info@vora.qa.
Where you invite someone on behalf of an organisation, you are responsible for informing them. We will not name you or your organisation as a Vora customer in public marketing without your written permission.
Who else handles your data
We use the providers below for the purposes described. Some, including Google for scanner metrics and app stores for distribution, also process information under their own terms and privacy policies.
- Microsoft Azure, which hosts the app's servers, database and stored files in its data centres in the Gulf region.
- Resend, which receives email addresses and message content to deliver verification, password reset, invitation and internship emails.
- Google ML Kit, which provides the Android QR scanner and receives the usage and performance metrics described in Annex B.
- Vercel, which serves this website and the dashboard, and stores CVs.
- Neon, which stores waitlist entries, pilot requests and internship applications made on this website.
- Hostinger, which operates our email, including the contact details and messages you send to support.
- The Qatar Civil Aviation Authority's public weather service, which receives installation coordinates when we request a forecast, without your account name or email.
- Apple and Google, which distribute the app.
- On this website only, and only after you accept: Google Analytics and Microsoft Clarity.
No advertising network, data broker, insurer or utility receives your data. We disclose data to a Qatari authority only where the law requires it.
If Vora is sold or merged, or transfers part of its business, this data may pass to the recipient under a policy no less protective than this one.
Where your data is held
The app's servers, database and stored files are hosted by Microsoft Azure in the Gulf region, currently in the United Arab Emirates and Qatar. We may move them between Microsoft data centres in the Gulf region without updating this policy. Email, support, website and Google scanner processing are separate flows and can involve processing outside the Gulf region.
For example, Resend stores email-related metadata, logs and API records in the United States. The providers listed above receive information for their stated roles; hosting in the Gulf region does not mean every copy or provider record stays there.
How long we keep it
- Account details and the names and settings attached to them: while your account is open.
- Controller readings: while the home remains registered, to provide its history and operate the service. When a sole-owner home is deleted, its detailed traces are removed after contributing to pooled technical statistics. These statistics contain no account, home, controller or location identifiers and are kept to improve control and maintenance reliability.
- Verification and password reset codes: they expire shortly after issue and are then deleted.
- Sessions: they expire on their own and are replaced as they are used.
- Routine database backups are scheduled for removal after 30 days, following a successful verified backup. A failed safety check can delay removal. Separate recovery copies are restricted to recovery and deletion handling. Server logs rotate according to size or time limits; their duration varies with activity.
Deleting your account
To request permanent deletion of your Vora account and its associated personal data, open Profile in the app and select Delete account, or email info@vora.qa. You can use email without installing the app or accessing a physical controller. Write from your registered address where possible and identify the account; do not send passwords or controller setup credentials.
If you cannot sign in or the app cannot complete deletion, contact info@vora.qa. We verify the request before acting. Resetting a physical controller is a separate operation and can remain pending until it reconnects; firmware or recovery operations can require additional handling.
Deletion removes your account details, sessions, account-linked diagnostics and invitation records, and the homes you alone own with their rooms, schedules and access. We remove personal links and detailed controller traces for those deleted homes. Controllers awaiting a confirmed reset remain protected against unauthorized reuse.
A home that still has another owner remains with its service history, because it is also theirs; your account and personal links are removed. We retain pooled technical statistics for improving control and maintenance, without a link to you or your controller. Minimal hardware-linked security records remain for as long as needed to protect ownership, resets and firmware updates; these are not anonymous research data. Copies in backups follow the retention process above, and relevant email or support records are handled as part of the deletion request.
We retain a restricted deletion record with a protected account reference, request status and time so that restoring an older backup does not silently reactivate a deleted account. It contains no account name, email or controller history and is used only for deletion and recovery safeguards. We keep it until recovery copies that could restore the account have expired and any related recovery has been resolved.
Your rights
Under Qatar's Personal Data Privacy Protection Law you may ask us to give you a copy of your personal data, correct it, delete it, restrict or stop our use of it, provide it in a portable form, or act on the withdrawal of your consent.
Write to info@vora.qa. We aim to respond within 30 days and will tell you if a request will take longer. We reply to the address the data is held under. We may retain a record that a request was made and answered, and data we need for a legal claim.
If you believe we have handled your data improperly, tell us first. You may also complain to the National Cyber Governance and Assurance Affairs at Qatar's National Cyber Security Agency. Nothing in this policy limits a right the Law gives you.
Security
The app connects to our internet service using HTTPS and secure WebSocket connections. Controller connections to our service are encrypted, and Google sends scanner metrics over HTTPS. Local Bluetooth setup protection depends on controller firmware. The Android app sends Wi-Fi details only through the controller's encrypted setup protocol; older firmware needs a service update first. Controller identifiers and setup authorization metadata are still transmitted without encryption over Bluetooth. Passwords and sign-in codes are stored as hashes, and access to our systems is restricted.
No system is completely secure. If a breach affects your personal data, we will notify affected users and the competent authority as required by applicable law.
Age
Vora is for adults. You must be 18 or over to hold an account. We do not verify age and do not knowingly collect personal data from anyone under 18. If you believe we hold a child's data, write to info@vora.qa.
Email from us
Verification codes, password resets and invitations are part of the service and cannot be switched off while you hold an account.
Marketing email is sent only to people who requested it on this website. Holding an account does not add you to that list. Every marketing email carries a way to stop it, or write to info@vora.qa.
Annex A - This website
We do not advertise on vora.qa and do not use it to track you across other sites.
If you join the waitlist we collect your email address and, optionally, your name, phone number and whether your interest is for a home or a business. If you request a pilot we collect your organisation, name, work email, phone number, the number of units and sites you operate, and your message. We use these to respond to you. To limit automated submissions we count recent requests against a one-way value derived from the connection; it is not stored with your entry and is cleared as the counting window passes.
If you apply for an internship, we collect your contact details, CV and answers to assess your application and contact you about it. Write to info@vora.qa to have yours removed.
If you contact us on WhatsApp from this site we receive your number, your profile name and your message.
- Google Analytics measures visits and pages read. It loads only if you accept.
- Microsoft Clarity records how pages are used, including clicks and scrolling, so we can identify faults. It loads only if you accept.
- Vercel Analytics and Speed Insights measure page views and loading speed. They run from the moment a page opens, set no cookies, and do not track you across other sites.
- A cookie named vora-exp records which version of a page you were shown, together with a random identifier that lets us count each visitor once. This site sets it, only this site receives it, and page scripts cannot read it. It expires 120 days after it is set.
Your answer to the banner is stored in your browser and is not sent to us. If you decline, neither Google Analytics nor Microsoft Clarity loads. To change an answer already given, clear this site's data in your browser.
The vora-exp cookie is set whether or not you accept the banner. It is our own measurement of our own pages and holds nothing that identifies you; we do not claim it is strictly necessary. It is set only while a comparison is running, and at other times there is none.
We use it to compare, in aggregate, which wording of a page readers find useful. It holds no name, email address, phone number or IP address, and nothing else that identifies you. It is not an advertising cookie, it is not used to track you across other sites, and it is not used to build a profile of you. It is not shared with advertisers, data brokers or any other company for that company's own purposes.
We keep waitlist entries and pilot requests for as long as we are still building and launching the product they relate to, so that we can contact you about it and keep a record of your enquiry. They are not deleted on a fixed schedule. Write to info@vora.qa and we will remove yours.
Annex B - The Vora app
The app requests location to save the installation's position during setup or reconfiguration, camera access to scan its setup code, and Bluetooth to set up the controller. Setting up a primary home requires location. QR images are processed on your phone and are not uploaded to Vora; the decoded controller identifier and setup credential are sent to our service to claim it.
The signed-in app sends Vora activity and diagnostic information to understand service use and investigate faults. The Android scanner uses Google ML Kit, which sends Google app and device metadata, installation identifiers, feature events, performance and error information, and technical image configuration. Google uses these metrics to maintain, improve and protect its APIs. Scanner images and results are processed on the phone. This release does not register for or send push notifications.
Session credentials, preferences and limited setup or retry information are stored on your phone. The Explore demo experience uses sample data locally and does not connect to a controller. Account deletion is available from Profile or by email as described above.
Annex C - The dashboard
app.vora.qa sets no cookies. Your session and display preferences are held in your browser and the session is cleared when you sign out. A photograph you add to a room is resized and kept in your browser and is not uploaded to us; it remains on that computer until you remove it or clear the site's data.
Annex D - The controller
The controller operates your air conditioner in the same way its remote does. It reports the readings described above to our service over an encrypted connection, and identifies itself so we know which controller is reporting. We record which software version it is running.
Your Wi-Fi details are held on the controller itself and are not sent to us. To obtain a forecast we send a location to the Qatar Civil Aviation Authority's public weather service; that request carries no name, account or identifier.
Changes to this policy
When this policy changes, the date at the top changes with it. Where a change materially affects how we use data you have already given us, we will say so on this page before it takes effect, and will ask for your consent again where the change goes beyond what you agreed to.
Governing law and language
This policy is governed by the laws of the State of Qatar. The English version is currently in force; an Arabic version will be published when available.
Contact us
Questions, requests and complaints go to info@vora.qa. We are based in Doha, Qatar.