Privacy statement

Who we are and what this covers

This statement explains how Vorda Labs handles personal information in the Vorda application and authorised Microsoft 365 permissions assessments, including development trials. For privacy questions, access requests or complaints, contact our Privacy Officer at [email protected]. Our website privacy notice separately covers the public website, waitlist and survey.

Information we collect

• Account and sign in information supplied by Microsoft, including your account and tenant identifiers, name and sign in address where available.
• Administrator consent, selected sites, account permissions and records of actions taken in the application.
• Metadata from authorised SharePoint sites, including site, file and folder names, identifiers, paths, permissions and sharing links. Relevant user and group information can include names, identifiers, email addresses and group membership.
• Assessment findings and reports derived from that metadata, and information you send us when you ask for support.

Permissions assessments do not collect file contents. Metadata can still contain personal or confidential information. Information about people who have access to a resource comes from your organisation through Microsoft 365, rather than from each person directly.

Why we use it

We use this information to sign you in, check your authority, assess the selected sites, prepare and provide reports, support your organisation and investigate security or service problems. Consent and access records help us enforce your choices and prevent unauthorised access.

Information supplied by your organisation

For assessment information processed on your organisation's behalf, your organisation determines the authorised purpose and scope. We use it to deliver that assessment. Your organisation is responsible for giving its people the relevant privacy information. We remain responsible for our own handling of account, support and security information. If you are unsure who should handle a privacy request, contact our Privacy Officer and we will help direct it.

Your choice

You choose whether to use Vorda. Your organisation chooses whether to authorise an assessment and which sites to include. Without the necessary sign in information, consent or access, we cannot provide the affected service. Your administrator can revoke application permissions in Microsoft 365. Contact us to disconnect a tenant or request deletion of information already collected.

Who can receive the information

Reports are for users authorised to receive them. Vorda personnel may access assessment information to operate the service, review reports, provide support and investigate incidents. Microsoft supplies sign in and the Microsoft 365 APIs used for collection. Service providers may process information on our behalf where needed to host, protect or deliver the agreed service. We may disclose information where the law requires it.

Before an assessment, we will confirm with your organisation the hosting location and any additional providers that will receive assessment data. Any external AI processing of assessment metadata requires that provider and its data handling to be agreed before information is sent. Microsoft may process sign in and service information outside New Zealand under its Privacy Statement.

How long we keep it

Our assessment retention policy is seven days after collection ends, including incomplete assessments. An authorised administrator may explicitly extend a completed assessment by seven days at a time, up to four extensions and 35 days in total. Waiting for a report to be released does not restart that period.

Deletion removes access before stored assessment data is cleaned up. Backup copies have a separate maximum retention of 30 days, so a deletion request does not immediately erase every backup copy. Deleted or expired assessment data must remain unavailable if a backup is restored.

Account, consent, security, deletion and any billing records have separate purposes and may need to be kept beyond an assessment. We retain those records only as needed to operate your account, enforce access and deletion decisions, resolve disputes or meet legal obligations. Contact us for the retention arrangements that apply to your organisation.

Cookies and analytics

The application uses a session cookie to keep you signed in. Blocking it prevents sign in from working. The application does not include the public website analytics in authenticated reports or consent flows. The separate website privacy notice explains the public site.

Access, correction and complaints

You can ask for access to personal information we hold about you, ask us to correct it, or request deletion by emailing [email protected]. We may need to verify your identity and authority before releasing or changing information. If your organisation supplied the information, we may work with its administrator to address your request.

If you are not satisfied with our response, you can complain to the New Zealand Privacy Commissioner.

Changes to this statement

We will update this page when our handling of personal information changes and revise the date above. We will tell affected organisations before using assessment information for a new purpose.