Privacy Policy

1. Introduction

Welcome to Valori ("we," "our," or "us"). Valori App, LLC is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our employee recognition platform, mobile application, and website (collectively, the "Service").

By accessing or using our Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us, including:

• Account information: name, email address, company name, job title, and profile photo
• Photos and media: profile photos you upload, images attached to recognitions, and any media content you share through the Service
• Payment information: billing address and payment card details (processed securely through Stripe—we do not store full payment card numbers on Valori servers)
• Recognition content: recognitions you give and receive, messages, achievements, certificates, and Valori portfolio data
• Communications: messages, feedback, and support requests you send to us

2.2 Automatically Collected Information

When you use our Service, we automatically collect:

• Device information: device type, operating system, unique device identifiers
• Log information: access times, pages viewed, IP address, and referring URL
• Usage data: features used, interactions with the platform, and performance metrics

2.3 Information from Third Parties

We may receive information about you from third-party services you connect to Valori, such as Slack, and from your employer if they administer your Valori account.

3. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your use of our Service. These technologies help us with:

• Session management: Keeping you logged in and maintaining your preferences
• Authentication: Verifying your identity and securing your account
• Analytics: Understanding how users interact with our Service to improve functionality
• Performance monitoring: Ensuring the Service operates efficiently
• Advertising: On our marketing website only, measuring our ads and showing Valori ads to past visitors (see Section 7)

You can control cookie settings through your browser preferences. However, disabling certain cookies may limit your ability to use some features of the Service.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process transactions and send related information
• Create and manage your account and Valori portfolio
• Generate certificates and achievement records
• Enable recognition sharing to LinkedIn and other platforms
• Send you technical notices, updates, security alerts, and support messages
• Respond to your comments, questions, and customer service requests
• Analyze usage patterns to improve user experience
• Detect, investigate, and prevent fraudulent transactions and abuse
• Comply with legal obligations

5. Data Processing

Valori acts as a data processor for recognition and portfolio data created by users. We process personal data on behalf of the organization administering the workspace.

For organizations subject to GDPR, CCPA, or other data protection regulations, we provide appropriate data processing agreements and comply with applicable data subject rights requests.

6. Information Sharing and Disclosure

We may share your information in the following circumstances:

• With your organization: Your employer or organization administrator can view recognition activity, achievements, and analytics for their team
• With your consent: When you choose to share achievements on LinkedIn or other platforms
• Service providers: With vendors who perform services on our behalf (hosting, payment processing, analytics)
• Legal requirements: When required by law or to protect our rights and safety
• Business transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information for money. The advertising pixels on our marketing website (see Meta Pixel, X (Twitter) pixel and LinkedIn Insight Tag in Section 7) may count as "sharing" personal information for cross-context behavioral advertising under California law. We honor Global Privacy Control: if your browser sends it, those pixels are not loaded. To opt out of this sharing, contact privacy@valoriapp.io.

7. Third-Party Services

We use the following third-party services to operate our platform:

• Supabase: We use Supabase for database hosting, user authentication, and file storage. Your account information, recognition data, profile photos, and Valori portfolio content are stored securely on Supabase's infrastructure. Supabase complies with SOC 2 Type II standards and encrypts data at rest and in transit.
• Stripe: All payment transactions are processed securely through Stripe, a PCI-DSS compliant payment processor. We do not store full payment card numbers, CVV codes, or other sensitive payment information on Valori servers. Stripe handles all payment data in accordance with industry security standards.
• PostHog: We use PostHog for product analytics in the Valori app to understand how the Service is used, improve the experience, and find errors. PostHog receives usage events, feature interactions, and performance data associated with your account identifier and display name. We do not send your email address, and session recording is turned off. The marketing website (valoriapp.io) also uses PostHog to count visits, see which pages and links are used, measure page speed, and find errors. It records pages viewed, clicks, the referring site and approximate location derived from your IP address, and stores a cookie to recognize return visits; it does not record what you type into forms. If you start a trial, your earlier website visits may be linked to your account. To ask us to stop analytics for your account, contact privacy@valoriapp.io.
• Resend: We use Resend to deliver account, billing, invitation, and notification emails. Resend receives your email address and the content of those messages.
• Vercel: Our website and web app are hosted on Vercel, which processes standard request data (such as IP address and browser information) to serve and secure the Service.
• Google: If you choose to sign in with Google, Google shares your name, email address, and profile photo with us to create and authenticate your account.
• Cloudflare Turnstile: We use Cloudflare Turnstile to protect sign-up and login from bots and abuse. Turnstile processes limited technical signals (such as your IP address and browser characteristics) to confirm that you are a human. It does not track you across websites or serve advertising.
• Anthropic (optional AI assist): If a company admin turns on Lori AI assist, a person can ask Lori for tips on making a recognition specific or for value suggestions. Only then, Valori sends Anthropic the text of that message (which can mention people by name) and, for value suggestions, the company's value names and descriptions. We don't send names, email addresses, or account identifiers of the sender or recipient. Anthropic processes this text to return Lori's reply, doesn't use it to train its models, and keeps it only as long as its commercial terms allow. Valori doesn't store the text sent or Lori's replies; we keep only a record that the feature was used, for rate limits. AI assist is off unless an admin turns it on, and Lori never writes or sends recognition for anyone.
• Meta Pixel, X (Twitter) pixel and LinkedIn Insight Tag: The marketing website (valoriapp.io) uses the Meta Pixel, the X pixel and the LinkedIn Insight Tag to measure how our ads perform and to show Valori ads to people who have visited the website. They record pages viewed and a few website actions, such as requesting a guide, starting checkout, or starting a trial, along with your IP address, browser information, and cookies that Meta, X and LinkedIn use to recognize your browser; we do not send them your name, email address, or what you type into forms. Meta, X and LinkedIn also use this information under their own privacy policies. These pixels are not used in the Valori app, and they are not loaded when your browser sends Global Privacy Control.

Each of these services has its own privacy policy and data handling practices, and processes data for us under its data processing terms.

7.1 Slack integration

If a company admin connects Slack, Valori receives and stores only what the integration needs:

• Workspace details: the Slack workspace ID and name, the access token Slack issues to the Valori app, and the channel your admin chooses for recognition posts.
• People details: Slack user IDs, names, and email addresses, used to match the person using /valori to their Valori account and to name people in posts.
• Recognition content: recognitions, reactions, and comments created through Slack are saved in Valori like any other recognition, and we keep a reference to the Slack message we posted so it isn’t posted twice.

Valori does not read your channel messages or direct messages. We use Slack data only to provide the integration, never for advertising, and we don’t sell it.

When an admin disconnects Slack, Valori stops posting and stops using the connection. Removing the Valori app from your Slack workspace revokes its access token. Stored Slack connection details are deleted when your company’s Valori account is deleted, or sooner on request to privacy@valoriapp.io. Recognitions created through Slack follow the retention terms in Section 9.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Database access rules that keep each company’s data separate
• Access controls and authentication mechanisms
• Hosting with infrastructure providers that maintain SOC 2 compliance
• Regular review of our security configuration

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Your Valori portfolio and achievement records are designed to be portable and long-lasting, supporting your career development. You may request deletion of your account and associated data at any time, subject to legal retention requirements.

10. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information and account
• Portability: Export your Valori portfolio and achievement data
• Opt-out: Unsubscribe from marketing communications
• Withdraw consent: Where processing is based on consent

10.1 How to Delete Your Account

You have the right to delete your Valori account and all associated personal data at any time. To delete your account:

• In the mobile app: Go to Settings → Account → Delete Account. Follow the prompts to confirm deletion.
• On the web: Go to your Account Settings page and select "Delete Account" at the bottom of the page.
• By email: Send a request to privacy@valoriapp.io with the subject line "Account Deletion Request" and we will process your request within 30 days.

When you delete your account, we will permanently remove your personal information, profile data, and recognition history from our systems. Some information may be retained in anonymized form for analytics purposes, and certain data may be retained as required by law or for legitimate business purposes (such as fraud prevention).

11. Children's Privacy

Our Service is not intended for individuals under the age of 16, or the minimum age of digital consent in your jurisdiction. We do not knowingly collect personal information from children. If we learn we have collected personal information from a child under the applicable age, we will delete that information promptly.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and compliance with applicable data protection laws.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes your acceptance of the new Privacy Policy.