PrivacyPolicy.

To provide our email automation and AI copywriting services, we collect information you provide directly, as well as data gathered automatically during your interactions with Vallvora.

A. User Account Information

• Contact info: Name, email address, password hash, and organization details.
• Billing data: Connected payment processor info (Stripe metadata). We do not store raw credit card numbers.

B. Connected Mailbox & Platform Integration Data

• SMTP/IMAP credentials, OAuth tokens, and server configuration necessary to send emails and monitor replies on your behalf.
• Email metadata (sender, recipient, subject line, timestamps) and delivery statuses to compute your analytics dashboard.

C. Campaign Lead Data

• CSV imports or manual lead lists containing names, email addresses, and custom merge fields used for personalizing outbound campaigns.

We process your data strictly to fulfill our service commitments, secure our infrastructure, and improve product performance. Specific uses include:

• Orchestrating, scheduling, and sending email campaigns via your rotated mailboxes.
• Generating customized copy and subject lines using LLM interfaces (e.g., OpenAI-powered completions).
• Aggregating metrics (open rates, click rates, reply rates) for your operator dashboard.
• Enforcing security controls, detecting fraudulent use, and complying with anti-abuse and anti-spam protocols.

We do not sell your personal data. We disclose data to trusted service providers only to the extent necessary to deliver Vallvora:

• AI Providers: Anonymized text prompts are processed via third-party LLMs (e.g., OpenAI API) to draft email content. We do not allow these providers to train model weights on your proprietary lead data.
• Hosting & Infrastructure: Database and cloud hosting services (e.g., AWS, Supabase, Vercel) secure your data under strict confidentiality terms.
• Analytics: Internal usage tracking tools to monitor platform health, latency, and system performance.

Security is core to Vallvora's design. We implement advanced technical and organizational measures to safeguard your credentials and campaign history:

• Encryption of sensitive database columns, including SMTP/IMAP credentials, using AES-256 standards.
• JWT-based authorization, role-based access control (RBAC), and session timeouts to lock down workspaces.
• Sanitized inputs and parameter queries to block injection vectors.

We retain your account and lead information for as long as your workspace remains active. If you close your account, we will purge database records within 30 days, unless longer retention is required to comply with financial auditing or statutory mandates.

Depending on your location (e.g., the EEA under GDPR or California under CCPA), you may have the right to access, rectify, or erase the personal data we hold about you. To execute these rights, please contact us at support@vallvora.com.

Vallvora requires all users to comply with relevant email marketing regulations, including the CAN-SPAM Act, CASL, and GDPR. Users are solely responsible for ensuring that they have obtained consent or possess a lawful basis before importing or contacting leads through our network. We terminate accounts flagged for excessive bounce rates or spam complaints.

Vallvora integrates with Google API services to allow you to securely connect your Gmail or Google Workspace accounts to send emails and track replies. This section describes our specific compliance with the Google API Services User Data Policy.

A. Data Access & Scopes Requested

Depending on the features you configure, Vallvora requests access to the following Google API scopes:

• https://www.googleapis.com/auth/userinfo.email: Accessed to identify and associate your Google account with your Vallvora profile.
• https://www.googleapis.com/auth/gmail.send: Accessed to send transactional emails and automated outreach campaigns on your behalf.

Vallvora does not request any restricted Gmail read scope (such as gmail.readonly or https://mail.google.com/). Reply and bounce tracking is handled through email-provider delivery webhooks and, where you supply them, standard IMAP credentials (app passwords) — never through Google-granted read access to your mailbox.

B. How We Use Google User Data (Data Use)

Any data accessed via Google APIs is used strictly to provide, improve, and execute user-facing email automation features:

• Authorizing and establishing SMTP/IMAP or REST-based email sending pipelines.
• Processing campaign recipients, merging personalized contact fields, and dispatching messages.
• Analyzing delivery events, bounces, and incoming replies to update campaign statistics, classify lead intent, and handle opt-outs.

C. Data Sharing & Third-Party Transfer (Data Transfer)

We do not sell your Google user data. We do not share or transfer your Google user data to third parties, except in the following limited circumstances necessary to operate our service:

• Infrastructure Providers: We transmit data to secure cloud hosting services (e.g., database hosts) who are bound by strict confidentiality terms.
• Transient AI Processing: Email copy drafts and incoming campaign replies may be parsed using OpenAI API completions for personalization or intent categorization. This processing is transient, and OpenAI is contractually prohibited from using this data to train their models.

We strictly prohibit the transfer or sale of Google user data to data brokers, advertising networks, or any third party for the purpose of personalized advertising, tracking, or user profiling.

D. AI/ML Model Training Restrictions

Vallvora does not use raw or derived Google Workspace or Gmail user data to develop, improve, or train any artificial intelligence (AI) or machine learning (ML) models. No Google user data is shared with third-party services that utilize such data for AI/ML model training.

E. Data Protection & Retention

Your Google OAuth tokens and configuration are encrypted using AES-256 standards before being stored in our secure database. Access tokens are kept only as long as your mailbox connection remains active. Upon deleting a connected mailbox or closing your Vallvora account, all associated Google OAuth tokens, credentials, and cached email metadata are permanently purged from our servers within 30 days.

F. Prohibited Use Cases

Vallvora requires all users to comply with Google Developer Policies. The platform must not be used to send unsolicited commercial emails (spam) without recipient consent, or to participate in automated email reputation manipulation (commonly referred to as inbox warming).

G. Limited Use Compliance Statement

Vallvora's use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We may update our Privacy Policy periodically. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date above. We recommend reviewing this policy regularly for updates.