Privacy Policy

Who we are

Vordran ("Vordran," "we," "us") is transaction-coordination software for real estate professionals — transaction coordinators and agents — across the United States. The service is offered to users in the United States, for business use. You can reach us about anything in this policy at emppenterprises@gmail.com.

Our two roles

We handle data in two different capacities, and your rights run differently through each. For your account — your email, name, billing records, and how you use our website and app — Vordran decides how the data is used, and this policy is the full story. For your workspace's content— the contracts you upload, the data extracted from them, deal-address mail, and your communication log — Vordran is your service provider: we process that content to run your workspace and on your instructions, and we don't use it for anything else. Much of that content is about people who are not Vordran users; the section People named in your documents covers them.

What we collect

We collect what the product needs to coordinate your transactions, and nothing aimed at advertising:

• Account data — your email, name, workspace membership, and role (agent or TC).
• Contracts and transaction documents — PDFs you upload or direct into Vordran. These contain what real estate contracts contain: property addresses, prices, party names, loan details.
• Extracted deal data — the fields our AI reads out of those documents (deadlines, parties, financial terms, risk flags), plus your confirmations and corrections.
• Connected Google data, if you connect Google — three narrow permissions, each tied to one feature. Drive: Vordran creates deal folders in your Drive, uploads copies of the documents you give it, and can move, trash, or (when you delete your account) permanently delete the folders it created. This permission reaches only files and folders Vordran itself created — it cannot see the rest of your Drive. Vordran also shares deal folders with your workspace teammates on your behalf: automatically for coordinator-role members on new deals, and explicitly when you assign someone to a deal. We remove that access when you remove or unassign them. These grants live in your own Google account and remain there if you disconnect Vordran. Gmail: send-only — Vordran holds no permission to read, search, or label mail. Your email address: identifies which Google account is connected. What we store on our side: the authorization you granted, the address of the connected account, references to the folders and files Vordran created, and the draft and sent-mail records you already see in the app.
• Mail sent to your workspace deal address— the sender's name and address, recipients, subject, timestamps, and attachment details for mail people send, CC, or forward to the address Vordran gives your workspace (see below).
• Communication records — deal-matched emails, drafts Vordran sent from your connected account, and call notes you add.
• Billing records— your plan, billing period, renewal status, deal usage counts, and a billing account identifier from our payment processor. Payments are processed by Lemon Squeezy as merchant of record; your card details go to Lemon Squeezy and are never stored on Vordran's servers.
• Operational records — an immutable audit log of who changed what in your workspace (your accountability trail, not third-party tracking), and per-workspace AI usage counts.
• Analytics — we use Vercel Web Analytics for aggregate page-view counts across our site and app. We do not run ad-tech trackers.

Connected Google: Vordran never reads your inbox

Vordran does not connect to, monitor, or read your mailbox. If you connect Google, the access Vordran requests is deliberately narrow: permission to create and write the deal folders it organizes in your own Drive, and permission to send— so a message goes out from the workspace's connected account. Vordran holds no permission to read or label mail in your account. Most messages send only after you review and approve them; some follow-up message types can be turned on in Settings to send automatically, after a delay you choose. Automatic sending is off unless you enable it.

This is separate from your workspace deal address, described below. That address is how mail reaches Vordran — because a person deliberately sent it there. Your Google connection remains send-only either way, and reading it is not something Vordran can do.

Earlier versions of Vordran could watch a connected mailbox and file the mail that matched a deal. That capability was removed: Vordran gave up the broader mail permission it required, and the feature is switched off. Any labels it created in your Google account before that change remain there — they are yours — but Vordran creates no new ones and reads no mail. If you connected Google before July 2026, your earlier grant may still list the old mail permission: reconnect Vordran, or revoke the grant from your Google Account's Third-party apps & services page, and it is gone — either way, the mail-reading features are switched off for everyone.

Google API Limited Use

Vordran's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Vordran does not retain or use data obtained through Google Workspace APIs to develop, improve, or train generalized (non-personalized) AI or machine-learning models, and does not transfer that data to third-party AI tools. The documents our AI extraction processes are the files you upload or that arrive at your workspace deal address. Vordran holds no permission to read your mailbox at all, and it does not send content obtained through the Drive API to any AI model.

Your workspace deal address

Vordran gives your workspace an email address. Mail reaches Vordran only because a person deliberately sent, CC'd, or forwarded it there — separately from your Google connection, which is send-only and does not let Vordran read your mailbox.

We store what arrives: the sender's name and address, recipients, subject, timestamps, and attachment details. Mail sent to this address is held for your review rather than filed automatically, and we do not download its attachments until you accept it. Mail you accept is filed to the deal, and its attachments are uploaded to your own Google Drive and stored as deal documents. Un-filed mail ages out at our email provider after about 30 days and cannot be retrieved after that. Everyone in your workspace can see a deal's communication log. Vordran never sends mail from this address — no auto-replies, no bounces — so a sender receives no confirmation either way. We limit how much mail we accept from any one unknown sender or domain.

Mail Vordran sends for you is also CC'd to this address so replies come back to the deal — and, when a teammate other than the workspace owner sends a message, to the workspace owner as well; recipients can see these addresses in the CC line. Vordran recognizes its own copies on arrival, marks them discarded, and does not fetch their contents or file them to the deal.

People named in your documents

Real estate contracts and deal mail name people who are not Vordran users — buyers, sellers, lenders, attorneys, inspectors, title officers. Vordran processes their information as a service provider, on the instructions of the real estate professional whose workspace it is, for one purpose: coordinating that transaction. We do not use it for anything else, we do not sell it, and we never contact those people for our own purposes — mail they receive through Vordran is sent on the professional's instruction, from the professional's own connected account.

If your information appears in a Vordran workspace and you are not a Vordran user, the professional handling your transaction is the right first contact — they control the workspace, and we will assist them in responding. You can also reach us directly at emppenterprises@gmail.com with the subject "Privacy request"; we may need to route your request through the workspace owner where we cannot verify your connection to a transaction.

Sensitive details

Vordran does not ask for or need Social Security numbers, government ID numbers, or bank account credentials. Closing packages sometimes contain such details; when they arrive inside a document, the document is stored as your workspace's content and those details are not used for any separate purpose. Where you have the choice, we encourage uploading documents without them.

How AI processing works

Uploaded contracts (or their text) are sent to Google's Gemini API to extract structured fields — Google processes that content on our behalf as a subprocessor under its Gemini API terms. Google's handling of content sent to its API, including how long it holds that content, is governed by those terms rather than restated here. The in-app assistant sends only a retrieval-scoped slice of your own deal data to answer your question, and it never changes your data without an explicit approval click from you.

Your contracts are used to run your workspace, not to train AI models, and are never sold. Our AI provider processes your content to produce the extraction or draft you asked for — not to build models. When Vordran learns your recurring contract forms and your writing voice, that learning is workspace-scoped configuration built from your own corrections; it stays inside your workspace and trains no shared model. If we ever build cross-customer extraction improvements, they would use de-identified structural patterns only and require your explicit opt-in first.

Who processes data for us

• Google (Gemini API) — contract field extraction and the deal assistant.
• Google (Drive and Gmail APIs)— connected by your own OAuth grant, to your own Google account. You can revoke Vordran's access at any time from your Google Account's Third-party apps & services page; revoking there immediately ends Vordran's ability to file documents or send mail on your behalf.
• Supabase — our database and authentication provider. Your workspace's data is separated from every other customer's, enforced at the database layer by row-level security; our own background jobs (deadline reminders, billing, email intake) run with elevated database access and process each workspace's data separately.
• Resend — sends our transactional email (deadline reminders, summaries, invites) and receives mail sent to your workspace deal address, including mail from people who are not Vordran users. Received messages and their attachments are held by Resend for up to 30 days.
• Vercel — application hosting and site analytics.
• Lemon Squeezy — payment processing as merchant of record; card details go to Lemon Squeezy, not to Vordran's servers.
• Slack (only if you configure it) — if you paste your own Slack webhook URL, notification text is sent to your Slack workspace via that URL you control.

We do not sell your data

We do not sell, license, rent, or trade personal data — including sensitive data — and we do not share it for targeted or cross-context behavioral advertising. There is no ad-tech or data-broker integration anywhere in the product. Because there is no sale, sharing, or targeted advertising, opt-out preference signals such as Global Privacy Control have nothing here to switch off; if our practices ever change, we will honor such signals as applicable law requires.

Security and breach notice

Vordran's design keeps its own footprint small: your workspace's data is separated from other customers' at the database layer, and the Google access we hold cannot read your mailbox or your wider Drive. When you upload a contract, the file is placed in private storage on our own infrastructure so that it can be read and processed; that staged copy is isolated to your workspace and is not readable by other customers, and the filed copy lives in your own Google Drive. Automatic clearing of staged uploads is built but is not yet switched on, so a staged copy may remain on our infrastructure until it is. No system is immune, so we make the commitment that matters: if a security breach affects your personal information, we will notify you and the applicable regulators as required by law.

Retention and deletion

We retain your workspace data for as long as your account is active. The workspace owner can request deletion at any time from Settings. We send a confirmation email and hold the account for 30 days, during which the request can be cancelled. After that window we permanently delete the workspace data — deals, deadlines, extracted fields, communications — and begin permanently deleting the folder Vordran created in your Google Drive and everything inside it, including anything you added to it yourself. This cannot be undone, and the files are not recoverable from Google's trash. We keep a minimal log recording that a deletion occurred. You can also email us at emppenterprises@gmail.com with the subject "Privacy request" for any deletion or access request you would rather not make in-app.

Cancelling your subscription or disconnecting Google is different: neither deletes anything in your own Google Drive. Those files stay in your Google account — we organize your Drive, we don't own it. Account deletion is the one path that removes them.

Vordran is a coordination tool, not your system of record. Real estate transaction records are subject to state record-keeping requirements that apply to you and your broker — keep independent copies of anything you are required to retain, and export or relocate anything you need before a deletion grace period ends.

If you connect Google, the Google-derived records we hold are: references to the folders and files Vordran created in your Drive, the email address of the connected Google account, and the authorization you granted. Deleting your account deletes those records along with the rest of your workspace data, and Vordran gives up its access to your Google account — except in the rare case where the same Google connection is still in use by another live workspace of yours; if so, the deletion confirmation email says so. To end that access at any time, revoke it from your Google Account's Third-party apps & services page.

Your rights

US state privacy laws give residents of a growing list of states the right to know what a business holds about them, to correct it, to delete it, and to opt out of sale, sharing, or targeted advertising — the opt-outs are moot here, because we don't sell or share data or run targeted advertising. We honor these rights for all US users regardless of which state you are in.

To exercise any of them, email emppenterprises@gmail.com with the subject "Privacy request" and tell us what you want. We may need to verify that the request comes from you or someone you authorized. We respond as promptly as practicable and in any event within the timeframe required by applicable law. If we decline a request, we will say why, and you can appeal by replying to that message — if we deny the appeal, you may raise it with your state attorney general. We will never treat you differently for exercising any of these rights. The service is offered to US users; we will address other jurisdictions if and when we offer the service there.

Children's data

Vordran is a professional tool for real estate practitioners. It is not directed to children, and we do not knowingly collect personal information directly from anyone under 18. Transaction documents can name minors — a child on a deed, an estate matter, a family circumstance — and where that happens we handle those details as we handle every other detail in a contract, and we do not seek them out separately or use them for any purpose beyond coordinating the transaction. If you believe a child's information reached us and should be removed, email emppenterprises@gmail.com and we will remove it.

Changes to this policy

When this policy changes, we will update the date at the top and, for material changes, notify account holders by email before the change takes effect.