Privacy Policy

Effective 28 October 2026

Vyora (vyora.fluxonai.io) is a project management platform operated by Fluxon AI ("we", "us"). This policy explains what we collect when you use Vyora, why, and what control you have over it.

What we collect

Your account: your name, email address and, if you sign in with a password, a securely hashed password. If you sign in with Google or Microsoft, we receive your name and email address from that provider.
Two-step sign-in: if you turn it on, your authenticator app is registered with our authentication provider, and your recovery codes are stored only as one-way hashes.
Your work: the projects, tasks, comments, documents, whiteboards, files, time entries and other content you and your organisation put into Vyora.
Activity records: an audit log of important actions in your organisation (for example who changed a setting or removed a member), and technical logs such as sign-in times and IP addresses, used to keep the service secure.

We don't use advertising or third-party analytics trackers, and we don't sell your data.

Google Calendar

If you choose to connect Google Calendar (Account settings → Google Calendar), Vyora asks for one permission: to create and manage calendars it creates itself (calendar.app.created). Vyora makes a "PM Platform" calendar in your Google account and keeps it in step with the dated tasks assigned to you. It cannot see or change any of your other calendars or events.

We store an encrypted refresh token, the id of that calendar, and the event ids and dates needed to keep it in sync.
Only the dates of events in that calendar are read back, so that moving an event in Google moves the task in Vyora.
Disconnecting deletes the calendar from your Google account, revokes our access and deletes what we stored. You can also revoke access at any time from your Google Account permissions.

Vyora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the calendar sync you turned on. It is not used for advertising, not sold, not used to train AI models, and not read by people except where you ask us to for support, where it's needed for security, or where the law requires it.

How we use your data

To run Vyora for you and your organisation: show your work, sync your calendar, and send the emails you've chosen to receive.
To keep accounts secure: sign-in checks, security notices (for example a new sign-in or a password change), and abuse prevention.
To support you when you contact us.

Who can see your data

Content in an organisation is visible to its members according to their role and to each project's privacy settings. Organisation owners and admins can manage members and see the organisation's audit log. A small number of our staff can access organisations through Vyora's back-office to provide support and run the service; that access is logged.

Service providers

We use these providers to run Vyora. Each processes data only on our behalf:

Supabase: database, file storage and authentication (data stored in London, UK).
Google Cloud: the server that runs the application.
Resend: sending account and notification emails.
Google and Microsoft: only if you choose to sign in with them or connect Google Calendar.

How long we keep it

We keep your data while your account or organisation is active. Organisation backups are taken about daily, and the newest 20 are kept. When you delete your account (Account settings → Delete my account), your sign-in, calendar connection and personal settings are deleted; content you created inside an organisation stays with that organisation. Deleted data can remain in backups until they roll over.

Your rights

You can see and change your name and email in Account settings, export your organisation's data, and delete your account. You can also ask us for a copy of your personal data, or to correct or delete it, by emailing us. Depending on where you live, you may have further rights under laws such as the UK and EU GDPR, including the right to complain to your data protection authority.

Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Calendar tokens are additionally encrypted by us. Vyora supports two-step sign-in, and we recommend turning it on.

Changes

If we change this policy, we'll update the date above, and for significant changes we'll tell you in the app or by email.

Contact

Questions or requests: clayton@fluxonai.io