Privacy policy

Who is responsible

The party responsible for handling your data is Hoomer S.A.S (NIT 901931848-1). Our address: Carrera 79A No. 51-41, Medellín, Antioquia, Colombia. You can write to us at info@voorder.com. You send your privacy inquiries and claims through the requests form and the Voorder privacy team handles them.

This policy follows Law 1581 of 2012 and the rules that regulate it, today gathered in Decree 1074 of 2015.

In short

• Your email is stored encrypted, but with a key that Voorder controls. Technically, Voorder can decrypt it.
• No one at Voorder reads the content of your email. The only exception is a valid order from an authority.
• There is no advertising, no selling of data, no profiles and no analytics.
• Your data is on Amazon Web Services servers in the United States.
• You can download your email and delete your account whenever you want, from your settings.

What data we handle

• Your account: first name, last name, username (your address), language, time zone and password. The password is stored in a way we cannot read. If you add them, also your country, your phone and a recovery email.
• Your email: the subject, body, sender, recipients and attachments of each message, and their technical data (dates, status, folder it is in, size and identifier). Also your contacts, your signature, your profile photo, the rules you set per sender and your follow-ups.
• Your billing: your plan, your payments and their status, and the document type and number you give when you pay. We do not keep your card number: ePayco processes it.
• Security: dates of sign-ins and of important changes to your account, your IP address (we only keep its network, not the full address) and the browser from which you accepted these texts.
• Requests and reports: what you write in the requests form (your first and last name, the email to answer you, your account and your message), what you write to us at abuse@voorder.com or security@voorder.com, and the messages you forward to us. This also applies if you write to us without having a Voorder account.

Other people's data in your email

Your email includes data of the people who write to you and the people you write to. We handle it only to store, deliver and protect your messages. We do not contact them, we do not build profiles with it and we do not use it for anything else.

What the system does with your email

Everything below is automatic. No person is involved.

• When you receive a message: it arrives through Amazon SES (part of AWS). Our server opens it in memory to verify the sender, run it through the spam filter and place it according to who sent it. Then it stores it encrypted. A copy of the original message, as it arrived, stays for 30 days in private AWS storage and is then deleted.
• When you send a message: our server prepares it in memory and hands it to Amazon SES, which takes it to the other person's server.
• When you search: the system decrypts your messages in memory to find matches.
• Follow-ups: they use the dates and status of your conversations.

What we encrypt and what we do not

• The connection between your device and Voorder is encrypted.
• In our database, the subject, body, sender and recipients are stored encrypted by our application. We use a single key for the whole system and Voorder controls it. It is not a key per person nor a key that only you have.
• Attachments and the original copy of each received message are stored in private AWS storage, encrypted by AWS.
• Database backups keep that data encrypted.
• We do not encrypt dates, status, the folder each conversation is in, sizes or message identifiers.

What this means: encryption protects you if someone gets a copy of the database without the key. It does not stop Voorder from decrypting your email, because Voorder has the key.

A limit worth knowing: your email is not encrypted in a way that only you and the other person can read it. When you write to someone who uses another provider, the message travels to that server and is stored there, with whatever protections that provider has. That does not depend on us.

Who can read your email

No one at Voorder reads the content of your email: not to give you support, not to improve the product, not to review an abuse report in your inbox. If you need help with a message, paste its text into the help form. That way you decide exactly what we see. The only exception is a valid order from an authority, as we explain in the section on requests from authorities.

We want to be clear: the people who run Voorder's servers have technical access to the encryption key and to the files, and could decrypt email. We prevent that like this:

• No Voorder feature lets our team see a customer's email. The admin panel does not show it, and signing in to an account from the panel only works with internal system accounts, leaving a record of each entry.
• We limit access to the servers, to the AWS files and to the encryption key to the people who need it to run the service.
• Our technical logs filter out subjects, bodies and addresses.

What we use your data for

We use your data to:

• Create your account, deliver and store your email and show you your conversations.
• Sort your email by who sends it, filter spam, let you search and remind you of follow-ups.
• Charge your subscription and keep billing records.
• Keep Voorder safe and prevent spam, fraud and abuse.
• Help you when you write to us and tell you about important changes.
• Meet legal obligations and answer competent authorities.

We do not sell your data, we do not use your email for advertising, we do not build profiles and we do not use analytics tools.

Your authorization

When you create your account you expressly accept this policy. We keep as proof the version you accepted, the date, your masked IP and your browser.

You can withdraw your authorization whenever you want. Completely, by deleting your account from your settings or by writing to us. Partially, by asking us to delete optional data such as your phone or your recovery email.

Some data we cannot delete while there is a legal or contractual duty to keep it. And while your account is open we need to keep your email, because that is the service.

Sensitive data

We do not ask you for sensitive data, such as health, sex life, ethnic origin, beliefs or political opinions, and you do not have to give it to us.

Your email may contain it, yours or other people's. It goes through the same automatic processes as the rest of the message. We do not extract it, we do not classify it and we do not use it for anything other than storing and delivering your email.

Minors

Voorder is only for people aged 18 or older and we do not collect minors' data on purpose. If we learn that an account belongs to a minor, we close it and delete its data. If you are a parent or representative of a minor and think they have an account, write to us.

Who helps us provide the service

These companies help us provide the service. Some may handle data outside Colombia. You can read each one's terms:

• Amazon Web Services (AWS): sending and receiving email, storing files, the database and backups. It handles the data on our behalf, under its data processing addendum.
• Cloudflare: telling people apart from automated programs when you sign up (Turnstile). It handles the data on our behalf, under its data processing addendum.
• ePayco: charging your subscription. It processes your payments as the party responsible for that data, under its data processing policy and its terms and conditions, both in Spanish.
• Have I Been Pwned: when you choose a password, we may check whether it appears in known leaks. We only send the first 5 characters of a fingerprint of the password, never the password, your username or your address. It is governed by its terms of use.

With AWS and Cloudflare, those terms require them to use the data only to provide us the service, to protect it and to keep it confidential.

Your data outside Colombia

Your data is stored on AWS servers in the United States. AWS handles it on behalf of Voorder and not for its own purposes. By accepting these texts you expressly authorize your data being sent and stored there.

Because it is in the United States, that country's authorities could ask AWS for information directly under their laws. That does not depend on us.

Requests from authorities

We only hand over data to an authority when all of these conditions are met:

• The request is in writing and comes from an authority with legal power to make it.
• We can verify that it is authentic and valid. If it is not, we reject or challenge it.
• For the content of your email we require an order from a judge or from the Attorney General's Office (Fiscalía).
• We hand over the minimum the request requires.
• When the law allows it, we tell you. If we cannot tell you beforehand, we do so when the restriction ends.

How we protect your data

Besides what we explain in the sections on encryption and on who can read your email, we limit access to our systems to the people who need it to work and we keep our technical logs free of email content.

No system is perfect. We ask you to use a password that is unique to Voorder.

If there is a security incident

If an incident affects your data, we tell you by email, without unjustified delay, what happened, which data was affected, what we did and what we recommend you do. We also report it to the Superintendence of Industry and Commerce within the deadlines the authority sets.

How long we keep your data

• While your account is open, we keep your data.
• When you delete it, we keep it for 30 days in case it was a mistake and then delete it for good. Backups can take up to 30 more days to disappear: up to 60 days in total.
• The original copy of a received message is removed from storage after 30 days.
• The security records of your account (sign-ins and important changes) are kept for 12 months or until your account is deleted, whichever comes first.
• Abuse reports and the requests sent through the form are kept for 12 months after the case is closed or they are answered.
• The application's technical logs rotate automatically and do not keep email content.
• Billing records are kept, without your personal data, for as long as the law requires.

Your rights

As the owner of the data, you have the right to:

• Know, update and correct your data.
• Ask for proof of the authorization you gave us.
• Know how we have used your data.
• Withdraw your authorization and ask us to delete your data, except when there is a legal or contractual duty to keep it.
• Access your data for free at least once a month and every time we change this policy in an important way.
• File complaints with the Superintendence of Industry and Commerce, after having made your inquiry or claim with us.

From your settings you can download your email and delete your account whenever you want.

How to exercise your rights

Send your request through the requests form, choosing "Question about my data" or "Claim about my data". We send you a receipt with your reference and the date we received it. If needed, we ask you to confirm it is you. Your heirs or your representative can also do it, proving that capacity.

• Inquiries: we answer them within 10 business days at most from receiving them. If we cannot make it, we tell you why and when we will answer, within 5 more business days at most.
• Claims (correction, update, deletion or a breach): include your identification, what happened, where we should answer you and any documents you want to add. If something is missing, we ask you for it within the next 5 days; if 2 months pass without you completing it, we understand you gave up. Within 2 business days at most we mark your claim as "claim in progress". We answer it within 15 business days at most from the day after we receive it. If we cannot make it, we tell you why and when, within 8 more business days at most.

Changes to this policy

If a change affects how we handle your data, we tell you by email at least 15 days before it applies and explain what changes. If the change touches what we use your data for, we ask you for a new authorization.

Before that date you can download your email and delete your account at no cost. Wording changes that alter nothing apply from the moment we publish them, with their new date.

Contact

Privacy questions: use the requests form. Company email: info@voorder.com. Our address: Carrera 79A No. 51-41, Medellín, Antioquia, Colombia.