Who the controller is
The data controller is [company name and registration to be defined]. Data protection officer contact: [contact email to be defined].
What data we process
- Account: name (optional), email, password (stored only as a hash), language, interface preferences and the date you accepted these documents.
- Content you save: the images you choose to capture and their source data (author, post link, position in the carousel, publication date, caption when available) and a public snapshot of the profile at capture time.
- Organization: Spaces, Boards, favorites and item order.
- Extension connection: access tokens (stored only as a hash on the server) and the date they were last used.
- Technical data: IP address and access logs, used for security, rate limiting and diagnosing errors.
What we use it for
- Providing the service: keeping your library, showing the source of each image and letting you organize it (performance of contract).
- Authenticating you and protecting the account: email confirmation, password recovery, sessions and attempt limits (contract and legitimate interest).
- Keeping the service running and secure: technical logs and bug fixing (legitimate interest).
- Meeting legal obligations, when they apply (legal obligation).
We don’t sell data, we don’t use your images to train artificial intelligence models and we don’t show ads.
Where and for how long
Data is stored on servers contracted by VORA in [server country to be defined]. We keep data while the account exists. When you delete the account, we delete the account, images, Spaces, Boards and source data; backups expire within [period to be defined]. Technical logs are kept for up to [period to be defined], unless the law requires otherwise.
The Chrome extension
The extension only acts when you ask: when you click save, it reads the image and the public post and profile data shown on screen and sends them to your account. It doesn’t record your browsing history or read pages outside Instagram. The access token is stored only in your browser.
Your rights
At any time you can confirm whether we process your data, access it, correct it, request portability or deletion, withdraw consent and learn about sharing (LGPD, art. 18). Much of this is in the account screen itself (edit profile, revoke extension connections and delete the account). For the rest, write to [contact email to be defined]. You can also complain to Brazil’s National Data Protection Authority (ANPD).
Security
Passwords and tokens are stored only as hashes; access to images requires your session; communication uses HTTPS in production. No system is infallible: if an incident could put you at risk, we will notify you and the ANPD as the law requires.
Minors
VORA is not intended for people under 18.
Changes to this policy
If this policy changes materially, we will let you know by email or in the library before the change takes effect.