Privacy Policy

Last updated: March 2026

1. Introduction

Vorion Technologies Limited ("Vorion", "we", "us", or "our") operates a group payment coordination platform that enables merchants to generate payment links and QR codes for group bills, allowing customers to split and pay simultaneously. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the New Zealand Privacy Act 2020.

By using the Vorion platform, whether as a merchant or a bill participant, you agree to the collection and use of information as described in this policy.

2. Information We Collect

2.1 Merchant Information

When you register as a merchant on Vorion, we collect:

• Email address (used for account authentication)
• Business name
• Stripe account connection status and Stripe account identifier
• Account creation and last login timestamps

2.2 Bill Participant Information

When you join a bill as a participant, we collect:

• Your first name (entered when joining a bill)
• Payment amount and split preferences
• Bill participation status (e.g., waiting, accepted, payment ready, completed)

2.3 Transaction Data

For each bill created on the platform, we store:

• Bill identifier and total amount
• Merchant identifier and business name
• Split type (even or custom)
• Member names, individual amounts, and payment status
• Stripe payment intent identifiers
• Bill creation timestamps

2.4 Automatically Collected Information

When you access the Vorion platform, the following information may be collected automatically:

• IP address (anonymised by Google Analytics)
• Browser type and version
• Device type and operating system
• Pages visited and actions taken (e.g., bill created, payment authorised)
• Approximate geographic location (city-level, derived from IP address)
• Session duration and referral source

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and operate the Vorion payment coordination platform
• To authenticate merchant accounts and manage access to the merchant dashboard
• To facilitate group bill splitting and payment processing
• To display real-time bill and payment status to merchants and participants
• To improve our platform through analytics and usage data
• To communicate with merchants about their accounts (e.g., service updates)
• To comply with legal obligations under New Zealand law

4. Third-Party Service Providers

Vorion relies on the following third-party services to operate. Each has its own privacy policy governing its handling of data:

4.1 Stripe

Stripe processes all payments on the Vorion platform. When a bill participant enters their card details, this information is captured directly by Stripe Elements on the client side and transmitted to Stripe's servers. Vorion never receives, processes, or stores credit card numbers, expiry dates, or security codes (CVCs). Stripe is PCI DSS Level 1 certified, the highest level of payment security certification.

We receive from Stripe only a payment intent identifier and payment status, which we use to track bill completion.

Stripe's privacy policy: stripe.com/privacy

4.2 Firebase (Google Cloud)

We use Google Firebase for the following services:

• Firebase Authentication: Stores merchant email addresses, hashed passwords (Vorion never has access to plaintext passwords), user identifiers, and login metadata.
• Firebase Realtime Database: Stores bill data, merchant profiles, and member participation records as described in Section 2.
• Firebase Hosting: Hosts the Vorion web application. Standard web server logs (IP addresses, request paths, user agents, timestamps) may be collected.
• Firebase Cloud Functions: Processes server-side operations including payment creation and capture requests.

Firebase's privacy policy: firebase.google.com/support/privacy

4.3 Google Analytics 4

We use Google Analytics 4 to understand how people use the Vorion platform. Analytics data is used to improve the product and monitor platform health. IP addresses are anonymised by default. We track page views and custom events (such as bill creation, payment authorisation, and payment completion) along with device and browser information.

Google Analytics data retention is set to the default period and does not include any personally identifiable payment or financial information.

Google's privacy policy: policies.google.com/privacy

5. Data Storage and Security

All Vorion data is stored on Google Cloud infrastructure (Firebase) and Stripe's secure servers. Data may be stored in data centres outside of New Zealand, including in the United States and other jurisdictions where Google and Stripe operate.

We implement the following security measures:

• All data transmission occurs over HTTPS (TLS encryption)
• Merchant passwords are hashed by Firebase Authentication and never stored in plaintext
• Payment card data is handled exclusively by Stripe and never touches Vorion's servers
• Database access is restricted through Firebase security rules
• Merchant dashboard access requires authentication

6. Data Retention

• Merchant account data: Retained for as long as the merchant account is active. Upon account deletion, merchant profile data, bill history, and authentication records are permanently removed.
• Bill and transaction data: Retained for the duration required to complete the transaction and for a reasonable period thereafter for dispute resolution and record-keeping purposes.
• Analytics data: Retained according to Google Analytics 4's default retention settings.

7. Your Rights Under the Privacy Act 2020

Under the New Zealand Privacy Act 2020, you have the right to:

• Request access to the personal information we hold about you
• Request correction of any inaccurate personal information
• Request deletion of your personal information

Merchants can delete their accounts directly through the merchant dashboard, which permanently removes their profile data, bill history, and authentication credentials from our systems.

Bill participants who wish to access, correct, or delete their information can contact us at the details provided in Section 11.

We will respond to privacy requests within 20 working days as required by the Privacy Act 2020.

8. Children's Privacy

Vorion is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information promptly.

9. Cookies and Tracking Technologies

Vorion uses cookies and similar technologies through Google Analytics 4 to collect usage data as described in Section 2.4. These are used solely for analytics and platform improvement purposes. Vorion does not use advertising cookies or tracking technologies, and does not serve advertisements on the platform.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. For material changes, we will notify merchants via their registered email address. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at: