Migrating production infrastructure? Get up to ₹10,000 in migration credits. Apply now
voroa

Privacy Policy

Effective date: 9 November 2026

Business information

Legal entity
Web Tech Digital Work (a sole proprietorship)
Trade name
Voroa
GSTIN
27ATFPT3932L1Z6
Registered office
Commercial Office No. 605, Freedom Towers, CTS No. 15184, Near Akashwani, Chhatrapati Sambhajinagar, Maharashtra 431001
Contact / Grievance Officer
legal@getvoroa.com

1. Who we are

Voroa is operated by Web Tech Digital Work, registered at Commercial Office No. 605, Freedom Towers, CTS No. 15184, Near Akashwani, Chhatrapati Sambhajinagar, Maharashtra 431001. This policy explains how we handle data collected through the Voroa platform and the getvoroa.com website. We are committed to handling personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian law.

2. What we collect

Account data: your email address, and the password you set (stored only as a secure hash).

How you found us: if you reach Voroa through a link that carries campaign tags - for example an advertisement or an email of ours, whose link includes utm_source or utm_campaign - and you create an account within the same visit, we store those tags on your account. At most six short labels are kept: utm_source, utm_medium, utm_campaign, utm_content, utm_term and campaign. We store them once, only when the account is new, and never change them afterwards, so clicking an advertisement later does not alter them. We use them to learn which of our campaigns bring people who go on to use Voroa. They are not shared with anyone, and they are deleted or anonymised together with your other account data (Section 8).

Deployment and configuration data: the repositories, branches, and build settings you connect, along with your application's logs and deploy history, so we can build and run your app and show you its status.

Workspace audit log: when you or a member of your workspace changes something - deploys a service, edits its settings, invites a teammate, creates an API token and so on - we record who did it, when, whether it was done from the dashboard, with an API token or by an AI agent, and whether it succeeded. We record the names of the things involved (for example a service name or the names of environment variables), never secret values. Workspace admins on plans with team members can view and export this record. Each entry is kept for 90 days and then deleted. If an account is deleted, its entries keep only an internal user id, not the email address.

Environment variables: we store the values of environment variables, secret files and object storage access keys encrypted at rest. They can be replaced but are never displayed back to you (exceptions: your managed database password, which you can reveal, and an object storage secret, which is shown once when it is created or regenerated). If you use Connect to a service, we write the bucket's key into that service's environment variables, stored encrypted.

Payment data: if you subscribe to a paid plan, your payment is handled by our payment provider. We receive confirmation of payment and subscription status. For each payment method you register for automatic renewal we also store a reference issued by our payment provider, the method type (UPI, card or bank mandate) and the maximum amount you approved, so that we can collect your renewals and show you which methods are on your account. We also store your mobile number - either the one you enter under Billing, or the one you confirm with the payment provider when you approve automatic renewal, which the provider passes back to us. It is kept because a renewal charge cannot be raised without it, and it is not printed on your invoice. We do not store raw card or UPI credentials.

Billing name and address: before you buy anything, we ask for the name and postal address the invoice should carry, and your state. These are required particulars of a tax invoice under Rule 46 of the CGST Rules, so we cannot raise one without them and we do not complete a purchase until they are on file. They are printed on every invoice we issue to you, and you can change them at any time under Billing - a change applies to invoices issued after it, because an invoice already issued is a statutory record and is never edited. Until 26 September 2026 we asked for the address only from customers who gave us a GSTIN; we now ask every customer, which is why you may be asked for it before your next purchase even if you have bought from us before. Alongside them we keep three optional details if you choose to give them: your PIN code (which we already asked for as part of the address, and now store separately so we can check the state your invoice is taxed in), the type of entity you are - an individual, a company and so on - which decides how the invoice describes you, and an email address for invoices if you would rather they went somewhere other than your account email. Leaving any of the three empty changes nothing about your account. We do not ask for your PAN, and we do not store it.

Migration credit application data: if you apply for a migration credit using the form on our public website, we collect your first and last name, your work email address, your company, the hosting provider you use today, the range your monthly spend there falls into, and — if you choose to give them — what you are moving, how many services, and any further details you type. We also store a one-way hash of the IP address the application was sent from, never the address itself; it cannot be turned back into an address and we use it only to spot repeated automated submissions. You do not need a Voroa account to apply, so for many applicants this is the only data we hold.

Usage, logs, and diagnostics: technical data such as IP address, browser and device type, timestamps, server access logs, and error reports, used for security, debugging, and reliability, and retained for a limited period.

3. Your data and your application's data

There are two different kinds of data on Voroa, and our role differs for each:

  • Your account data — the information you give us to open and run your Voroa account (above). For this data, Voroa is the entity that decides how and why it is processed.
  • The data your deployed application processes — the information your own application collects from its end users. For this data, you decide how and why it is processed, and Voroa only stores, runs and carries it (through the service providers in Section 6) on your instructions as part of hosting your application. You are responsible for providing notice to, and obtaining any required consent from, your application's end users, and for complying with the law that applies to that data.

4. How we use your data

To provide, operate, and maintain the platform; to build, deploy, and run your applications; to authenticate you and protect your account and the platform; to send service-related communications such as billing, support, and critical updates; to comply with legal and tax obligations; and to improve the platform based on usage patterns and error reports.

If you have applied for a migration credit, we also use the details in that application to review it, to decide whether to grant a credit, and to write back to you about it — including where the answer is no. We may reply by email to ask a question about your move. We do not use an application to send you unrelated marketing, and we do not sell it or share it for advertising.

5. Legal basis and consent (DPDP Act)

We process your personal data on these grounds:

  • Consent — you agree to this policy and our Terms when you create an account. You can withdraw consent at any time by closing your account or by contacting us (see Section 12). Withdrawing consent may mean we can no longer provide the service.
  • Consent, given by sending us a form — if you apply for a migration credit, you give us those details so that we can review the application and reply to you. That is the only thing we use them for. You can withdraw that consent at any time by writing to legal@getvoroa.com, and we will delete the application unless we are required to keep it as the record behind a credit already granted (see Section 8).
  • Performance of the contract — to deliver the service you have signed up for.
  • Legal obligation — for example, retaining tax and GST records.

If you only browse our public website or documentation, never create an account, and never send us a form, the website analytics and advertising measurement described in Section 14 are the only data we collect about you, and you can prevent both by blocking cookies in your browser. Nothing on the public site needs them to work.

There is one thing on the public site you can choose to hand us: the migration credit application form. If you fill it in and send it, we collect and use what you typed, as described in Sections 2 and 4. If you do not, the paragraph above is the whole position — a form you never send collects nothing.

6. Data sharing

We do not sell or rent your data. We share it only with the service providers needed to run the platform, each operating under its own privacy and data-processing terms:

  • Cloud hosting — our cloud infrastructure provider, in India, where your data is stored and your applications run.
  • Build capacity — DigitalOcean, in India (Bangalore). When our own build servers are busy, a build may run on a short-lived DigitalOcean machine. For that build it receives your source code and the environment variables and secret files your build needs. The machine is destroyed after use and the build's working files are deleted when each build ends.
  • Backup storage — Amazon Web Services (S3), where encrypted backup copies are kept.
  • Payment processing — our payment provider, used only if you subscribe to a paid plan, to take payment and issue receipts.
  • Transactional email and error monitoring — used to send service emails and to detect and fix faults.
  • AI assistant — NVIDIA, whose hosted language models power the in-app assistant. When you use it, the question you type is sent to NVIDIA so an answer can be generated. Nothing else is sent: not your code, not your application data, not your service or database names, and not your account details. If you do not use the assistant, nothing is sent at all.
  • Website analytics — Google LLC (Google Analytics). Its tag runs only on our public website and documentation pages, to measure traffic. There is no Google Analytics tag inside the Voroa application. Separately, our SERVER tells Google Analytics when one of five things happens in your account: you create an account, you create a database, you deploy your first service, you start a checkout, or you complete a payment. Exactly these leave: the name of the event and its time; the amount and currency (for a checkout or payment only); our own order reference (for a payment only); and the Google Analytics visitor identifier from the _ga cookie described in Section 14. Nothing else is sent: not your email address in any form, not your name, not your IP address, not your plan, and not the name or address of anything you build. If your browser has no _ga cookie, nothing is sent at all. This is how we tell which of our public pages and campaigns bring people who go on to use Voroa.
  • Advertising measurement — Meta Platforms, Inc. (Facebook and Instagram). We run the Meta Pixel on our public website and documentation pages so we can measure which advertisements bring people to us and show advertisements to people who have visited. When a page loads, Meta receives your IP address, the page address, your browser details, and an identifier stored in a cookie. Meta also receives three on-page signals: that you opened the pricing page, that you scrolled at least halfway down a page and stayed 30 seconds, and that you clicked a link to sign up or sign in. Meta may match that identifier to an account you hold with them. It is not used inside the Voroa application at app.getvoroa.com, so it never sees your services, databases, code, or account contents. Section 14 explains how to prevent it. Separately, our SERVER tells Meta when one of five things happens in your account: you create an account, you create a database, you deploy your first service, you start a checkout, or you complete a payment. Only the FACT that it happened is sent, with four things at most: the amount (for a checkout or payment only — the other three carry no amount), our own reference for the event, your email address as a one-way hash (we send a fingerprint, not the address, and it cannot be turned back into your email), and the advertising-cookie identifiers described in Section 14 if your browser has them. We never send the name or address of anything you build — not a service name, not a database name, not a workspace, not a repository, not a page address. "A database was created" carries nothing about which database it was. This is how we tell which advertisements bring people who actually use Voroa rather than only sign up. It is sent from our servers rather than from your browser precisely so that no page address of yours has to leave the application, and you can stop the cookie part of it entirely by blocking the advertising cookies described in Section 14 before you visit.
  • Network security and content delivery — Cloudflare, Inc., whose network sits in front of parts of our website and platform to absorb attacks, block malicious traffic, and serve pages faster. When your request passes through it, Cloudflare processes your IP address and request details for those purposes. Where edge protection is turned on for a customer's service, Cloudflare also carries that service's web requests and responses - including their content - between the visitor and our servers; the customer can turn it off for their service. It does not receive your databases or your account contents.
  • Build cache storage — Cloudflare, Inc. (R2 storage), where we keep a reusable copy of the compiled layers of a service's most recent build, so the next build of that service is faster. These layers come from your code, and if your build writes a build-time variable or secret value into its output, that value is in the cached layers too, just as it is in the deployed service. The copy is encrypted at rest. Only builds of that service can read it, plus our own maintenance process that removes old and oversized copies. Each service's copy is kept separately, is deleted within a day of the service being deleted, and expires on its own after 14 days without a build.
  • Object storage — Cloudflare, Inc. (R2 storage), where the files you upload to a Voroa Object Storage bucket are stored, in the Asia-Pacific region on a best-effort basis. These files are not backed up.
  • Log storage — Cloudflare, Inc. (R2 storage), where we store the logs your services print while they run and the logs of your builds, in the Asia-Pacific region on a best-effort basis. Logs can contain whatever your application prints, including details of your own users if your code writes them. The stored logs are encrypted at rest, are used only to run the service, to show them to you, and to help you when you ask for support, and are deleted after 30 days.

We can provide our current list of these service providers on request. We also disclose data to government or regulatory authorities only when required by law.

7. Data residency and cross-border processing

Your data is hosted in India, except objects you store in Voroa Object Storage and the logs of your services and builds, which are stored in the Asia-Pacific region on a best-effort basis and may be stored outside India (see the Object Storage policy and Section 6). Some service providers listed above may process limited data (such as email delivery, error reports, website analytics, advertising measurement through the Meta Pixel, a question you type into the in-app assistant, the build cache described above, or the routing of your web requests through Cloudflare's network, which may pass through servers outside India) outside India in order to deliver the service. In every such case, data is encrypted in transit. Where Cloudflare carries a service's traffic, it decrypts and re-encrypts that traffic at its edge so it can filter attacks, and does not keep the content beyond what is needed for that purpose. Data is shared only to the extent needed to operate the platform, in accordance with the DPDP Act.

8. Data retention and deletion

We retain your account and application data for as long as your account is active. After you close your account or request deletion, we delete or anonymise your personal data within a reasonable period (ordinarily within 30 days), except where we are required to keep certain records — such as GST and tax invoices — for the period mandated by applicable tax law. You may request an export or deletion of your data at any time by contacting legal@getvoroa.com.

Migration credit applications are kept on their own schedule, because most applicants have no account for the rule above to attach to:

  • An application that does not result in a credit is deleted 12 months after we last acted on it. We keep it that long so that if you apply again we can recognise it and answer you consistently rather than starting from nothing.
  • An application that does result in a credit is kept for as long as the billing records of the credit it produced, because it is the record of why that credit was granted, and those records fall under the tax-law retention period above.
  • The IP hash described in Section 2 is deleted together with the application in both cases.

You can ask us to delete an application sooner, at any time, by writing to legal@getvoroa.com.

9. Security

We use reasonable security safeguards to protect your data, including encryption in transit (HTTPS), hashed passwords, token-based authentication, isolation of each tenant's account and resources, access controls on our systems, and regular backups (not of objects in Voroa Object Storage, which are not backed up). No system is completely secure, so we encourage you to use a strong, unique password and to keep your credentials confidential.

10. Your rights (DPDP Act, 2023)

Under the Digital Personal Data Protection Act, 2023 you have the right to:

  • access the personal data we hold about you;
  • correct inaccurate or incomplete data;
  • erase your data, subject to legal retention requirements;
  • withdraw consent at any time;
  • nominate another person to exercise your rights on your behalf; and
  • grievance redressal — raise a concern with our Grievance Officer (Section 12).

To exercise any of these rights, contact legal@getvoroa.com.

11. Data breach notification

In the event of a personal data breach affecting your data, we will, in line with the Digital Personal Data Protection Act, 2023, notify the Data Protection Board of India and each affected user without undue delay — describing the nature of the breach, the data affected, the likely consequences, and the steps we are taking to address it and mitigate harm.

12. Grievance Officer and how to reach us

In compliance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is:

Name
Sagar Tayde
Designation
Proprietor / Authorised Representative
Entity
Web Tech Digital Work (trade name: Voroa)
Email
legal@getvoroa.com

For any privacy-related concern or to exercise your rights, write to legal@getvoroa.com with the subject "Grievance — Privacy". We will acknowledge your request within 24 hours and aim to resolve it within 15 days.

13. Children

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 18.

14. Cookies and local storage

The public getvoroa.com website and our documentation pages set two kinds of cookies.

Analytics cookies. We use Google Analytics to measure traffic. These cookies record how the site is used, such as pages viewed, the source of a visit, and actions taken on a page — for example, the fact that a form on the site was submitted, never what was typed into it. We do not enable advertising or audience-targeting features in Google Analytics. You can block them with your browser's cookie settings or Google's opt-out browser add-on.

Advertising cookies. From 2026-09-09 these pages also run the Meta Pixel, which sets and reads cookies used for advertising — principally _fbp, and _fbc if you arrived from a Meta advertisement. We use it to measure which advertisements bring people to Voroa and to show advertisements to people who have visited our site. Meta may connect this to an account you hold with them. Besides page loads, the pixel reports the three on-page signals listed in Section 6 (pricing page opened, halfway scroll with 30 seconds on the page, sign-up or sign-in link clicked). with them. These two cookies are also read once at each of the five moments listed in Section 6, so that the server-sent report can be attributed to the advertisement that brought you; if they are absent, those reports are sent without them or not at all. At a checkout we also STORE the two identifiers on that payment's own record, because the payment is confirmed later by our payment provider, on a request that has no browser attached and so cannot read a cookie; they are kept with that payment record, are used for nothing except the report in Section 6, and are never attached to your services or databases. This is a change from our previous policy, which stated that no advertising cookies were set; it now describes what we actually do.

You can prevent it in any of these ways: block third-party cookies or use your browser's tracking protection; use a content blocker; or change your advertising preferences in your Meta account settings. Nothing on our public site or documentation requires either kind of cookie to work.

The _ga analytics cookie is also read once at each of the five moments listed in Section 6 and sent to Google Analytics by our server, so the report can be joined to your earlier visit to our public site. At a checkout we also store that one identifier on the payment's own record, for the same reason given above for the advertising cookies, and use it for nothing else. Blocking analytics cookies stops this entirely.

The Voroa application at app.getvoroa.com carries neither tag. It runs no Google Analytics tag and no Meta Pixel; the only thing it does with those cookies is pass the identifiers described above to our server at the five moments in Section 6. It stores an authentication token in your browser to keep you signed in, and nothing else. This boundary is deliberate: the application's addresses contain your service, database, and workspace names, and we do not hand those to an analytics or advertising network.

15. Changes to this policy

We may update this policy. The effective date above is updated when changes are made, and material changes will be communicated by email at least 7 days before they take effect. Continued use of the platform constitutes acceptance of the revised policy.