Viora Privacy Policy

Version 1.2 · Effective date: 22 October 2026

1. Who is responsible for your information

Warif albariah Establishment (مؤسسة وريف البرية), a sole establishment registered in the Commercial Register of the Kingdom of Saudi Arabia under number 7055443712, is responsible for your information. Viora is a brand the establishment uses; in this policy, “Viora”, “we” and “us” mean the establishment. We provide software and related services. Contact support@v-ora.co about this policy, your information or a privacy complaint.

This policy covers our website, accounts and services, including Wasim. A product-specific notice explains any additional processing before it begins. It does not mean that every Viora product collects every category described below.

Agreeing to this policy. You agree to this policy when you create an account, when you accept an invitation, and when we ask you to accept a new version of it on our website or in our products. Agreeing confirms that you have been informed of how we handle personal data. It is not consent to marketing or to any other processing that needs your separate consent, which we ask for separately, and it does not change the grounds for processing explained in section 3.

Viora is the controller for account, billing, licensing, support and service-administration data. Where a customer determines the purposes and means of processing personal data in projects and we handle it on their behalf, that customer is the controller and Viora is its processor. For an organisation, this means the organisation, acting through its authorised team owner. The Wasim Terms describe that processing arrangement. We help the customer handle requests concerning its project data; our separate controller responsibilities remain ours.

2. Information we collect and why

We receive information through forms and messages you submit, your account and product use, authorised team owners and collaborators, payment and service providers, and automatic connections to our services.

If we need additional billing information for an invoice or another service, we identify the fields, purpose and requirement before collecting it. We do not collect extra profile details simply because they might be useful later.

3. Our grounds for processing

We use account, purchase, licence and necessary service records to implement our agreement with you. We process and retain records where Saudi law requires this, including applicable accounting, tax and authority requirements.

For security, fraud prevention, handling enquiries, administering invitations and limited analysis of subscription and payment performance where these are not already necessary under an agreement, we rely on legitimate interests only where the legal conditions are met, the processing is necessary and proportionate, and it does not prejudice your rights or interests. We do not rely on this ground to process sensitive personal data.

The appearance you pick on v-ora.co (light or dark) is saved in your browser when you pick it, so that the next page opens in it; the website's language is part of the page address and is not stored. Where such a preference is personal data, we process it only to provide the setting you requested, under our agreement or legitimate interests limited to remembering it. The shared-report site saves a language or appearance choice only when you make one there. None of this authorises unrelated tracking or unnecessary storage.

Marketing and other processing presented as optional consent choices require your separate consent. Accepting the terms or this policy is not that consent. A customer's agreement with Viora does not, by itself, authorise processing every other person's information in that customer's projects; the customer must establish the appropriate basis and notices for that processing.

We use information for the stated purposes. A new use requires its own lawful basis and any notice or consent required before it begins.

4. Wasim: local work, cloud copies and teams

Original photographs, videos, thumbnails and image crops stay on your computer for Wasim's cloud-copy and AI features. Detection, species classification and text recognition run locally. Absolute source paths are not automatically uploaded. If you deliberately send an image to support, we receive that separate submission.

Cloud projects contain project settings, exact camera coordinates, photograph names and relative paths, timestamps, labels, detection/classification results, notes, changes, contributor and operator details, session/activity records and information about photographs opened. Text you type is included as entered. These records can identify people or reveal confidential information even without images. Exact coordinates are not blurred; whether they are personal data depends on whether they relate to an identifiable person.

Uploads are on by default. An individual user's initial cloud choice allows local-only use; dismissing it leaves uploads on. Team members follow the owner's setting. These settings control the service and are not a substitute for consent where consent is legally required. Turning uploads off has the deletion effects in section 8.

After successful team-project uploads, Wasim records work totals by person, project and day, including sessions, time, progress, labels, and acceptance or correction of AI suggestions. Team managers can view these records for each member at any time in Wasim's team dashboard, and the team owner and managers can view them on our website; each member can view their own. Monthly reports, when we send them, go to the team owner and include member names and roles, actions, labels and active days, with team totals. These are identifiable work reports, not anonymous analytics. We process them to provide the customer's team service, not to build independent advertising profiles.

The owner sees members' names, emails, roles and membership status, and whether a computer is registered to each seat. Colleagues see team and colleague names and roles. Managers can view and export every team project, including projects a member has not shared with colleagues. Members can access their own and shared projects. Removing a member does not erase their past contributions from the team's records.

We store cloud records with access controls, but they are not encrypted with a key held only by you. Authorised Viora personnel and providers may access them to operate and support the service or comply with law. Do not upload Saudi government-agency data or other restricted data requiring hosting we have not agreed to provide; the Wasim Terms explain the required arrangements.

Shared reports. When you publish a report at report.v-ora.co, we host a frozen snapshot of its title, camera names, exact coordinates, species, dates and aggregate figures. It contains no photographs or member work-history records, but entered titles and names may identify people. Anyone with the link—and its passcode, if you set one—can view it without a Viora account and may forward or copy it. Check the contents and your authority to share them before publishing.

You choose an expiry of 1, 7 or 30 days. Updating a report replaces its snapshot and restarts the chosen period; you can end the link earlier. The sender sees a total of successful openings, including repeats, not a count of unique people. This application counter does not record reader identities; Cloudflare still handles connection and security information. The report site's selected language accompanies opening requests; its appearance preference stays on the visitor's device. Section 8 explains this service's separate deletion schedule.

5. Analytics, marketing and automated processing

Account, subscription and payment records let us administer the business and understand service totals such as subscriptions, renewals, failed payments and refunds. Analysis of identifiable records is limited to the legitimate interests described in section 3; those records remain protected under this policy. Team reporting has the specific purpose and audience described above. We do not reuse customer project records for independent product analytics, marketing or demographic profiling without a separate lawful arrangement and any required consent. AI-model training always requires a separate opt-in.

We do not require your numeric age or collect your date of birth for demographic analysis. Additional optional product analytics or research would be explained before collection, with the relevant fields, purpose, recipients, retention and choice. Information is anonymous only when people cannot be identified directly or indirectly; replacing a name with an account number or hash does not achieve that by itself.

Marketing is sent only with your prior consent. You can withdraw it at any time, free of charge, by emailing support@v-ora.co from your account's email address or by using the unsubscribe link in any marketing message. We stop the consent-based processing without undue delay; withdrawal does not affect processing lawfully carried out beforehand. Necessary account, security, billing and team messages continue when needed to provide the service.

Automatic checks determine whether a licence or account can access a service. If you believe a check has incorrectly blocked access, contact support for review. Wasim's local AI suggestions are for you to review; they are not decisions by Viora about people appearing in photographs.

6. Providers, sharing and overseas processing

We share the information needed for the functions below. Providers processing on our behalf act under appropriate written obligations. A provider may also be responsible for processing it determines for its own purposes, such as a payment provider's legal duties or Cloudflare's own bot-protection processing; its notice explains that processing.

When a Microsoft component used by Wasim connects directly to Microsoft, Microsoft's applicable privacy notice governs its own processing. The Cookie Policy explains browser storage and associated providers in more detail.

Some processing takes place outside Saudi Arabia. We transfer personal data outside the Kingdom only where Article 29 of the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom permit it, limited to the minimum data each function above needs, and subject to the safeguards that Regulation requires. Transfer permission depends on Saudi law and the applicable safeguards; accepting this policy does not waive those requirements. Contact us for information about the safeguards applicable to your data.

For project processing, the Cloudflare, Supabase and Resend entries above form the provider schedule under the Wasim Terms: Cloudflare stores cloud projects and team work records and hosts shared reports, Supabase relays team-dashboard data and prepares team reports, and Resend delivers team-report emails through Amazon SES. The schedule and retention periods supplied when those terms are accepted are part of that agreement. Additional or replacement project processors require the prior acceptance and notice described there.

We also disclose information to authorised team participants and people accessing shared-report links you publish as described above, professional advisers where necessary and lawfully justified, and competent authorities where law permits or requires it. We do not sell personal data or give it to other businesses for their own marketing.

7. Storage and protection

Information is stored electronically with the providers above and, where necessary, in restricted support and administrative records. We use access controls and organisational and technical safeguards appropriate to the information and risk, including protection during transmission. Staff access is limited to their duties. No service can guarantee absolute security.

We notify affected people and authorities of personal-data breaches when and as applicable law requires. Where we process project data for a customer, we notify that customer without undue delay in accordance with the Wasim Terms.

Your browser stores authentication sessions, navigation state, the record that you have seen the cookie notice, and the appearance you pick. The shared-report site stores its own language and appearance preferences. Cloudflare security services may also use cookies or other device storage. Wasim stores local settings and projects, and keeps your email address and a sign-in token in Windows Credential Manager, together with your password if you tick “Remember my password”. Local files and exports remain under your control; signing out removes the sign-in token but keeps the email address and any remembered password. See the Cookie Policy for the purposes, durations and controls. Optional browser analytics and tracking are not enabled under this version and require a separate opt-in before introduction; this does not turn off the service records and reporting described above.

8. Retention and deletion

We retain personal data only for its stated purpose or a lawful retention requirement, then securely delete it or irreversibly anonymise it. Account information is kept while the account is maintained. On closure, we delete information no longer needed; essential transaction, legal-obligation and unresolved judicial-case records may remain for the applicable requirement. We restrict such retained records to that purpose.

Support records are kept for resolving the request and any related complaint or dispute. Payment and invoice records follow applicable accounting and tax retention requirements. Security and operational logs are kept for the period needed to investigate faults or incidents and prevent abuse, with deletion when that need ends. Consent and withdrawal records are retained as necessary to demonstrate and honour your choices. These criteria do not authorise keeping entire accounts or support histories indefinitely.

For Wasim cloud projects:

An earlier deletion event still applies; subscription expiry does not extend it. Applicable legal preservation requirements may alter deletion. Project-linked progress records are deleted with their project; reports already delivered to the owner's mailbox are separate copies controlled by their recipient. Our retained delivery and support copies follow the relevant retention criteria above.

Shared reports have a separate lifecycle. A refund, deactivation or switching off team uploads does not automatically end existing report links. Switching off individual uploads ends links created by that individual. Otherwise, access ends when the sender ends the link or its selected expiry is reached. Ending a link removes its hosted figures immediately; expired figures are scheduled for removal by the cleanup process. Link-administration records, including sender/project references, security records and total openings, are scheduled for deletion 90 days after end or expiry for link administration and addressing misuse or security issues. Cleanup runs once a day, at 03:30 UTC: figures and records due for deletion are normally removed at the first run after they fall due, within one day, and when more than 40 links' figures fall due on the same day, the rest are removed at the following daily runs. These are Viora-hosted records, not merely copies held by recipients; applicable destruction duties, lawful customer instructions and privacy rights still apply. Contact support to request an authorised link's removal if you can no longer use the product.

Residual recovery copies, where providers hold them after active deletion, expire within these maximum periods: account/database copies: 7 days; cloud-project/shared-report copies: 7 days; email/support copies: 30 days. They are restricted from ordinary use and customer restoration. If recovery is necessary to operate the service, deletion instructions are reapplied.

Cloud deletion does not delete local photographs, projects or exports. Keep copies you need. The Wasim Terms explain free retrieval while cloud projects remain available; an immediate deletion leaves no later retrieval window.

9. Your rights and requests

Under Saudi personal-data protection law, subject to its applicable conditions, you can know how your information is processed, access it, obtain a readable copy, request correction or completion, request destruction when appropriate, and withdraw consent. You may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) and seek compensation through the competent court where available under law.

Email support@v-ora.co to exercise a right or raise a concern. We verify identity proportionately, normally through your account or email. We do not copy official identity documents unless a law requires it or a competent public authority requests it. We do not charge for these requests. We act on your rights request without delay and within 30 days, subject to applicable lawful restrictions. A further period of up to 30 days is used only where legally permitted, such as unexpected or unusual effort or multiple requests; we notify you of the reason before the original period expires.

Where a lawful restriction applies, we explain it and provide what we can without compromising others' rights. Copies are provided in a readable format suited to the records. For customer-controlled project data, we assist the responsible customer and explain the appropriate contact route.

To close your account, email support@v-ora.co from the account's email address with “Close my account” (or «إغلاق حسابي») in the subject. We verify the request, explain any effect on paid services or a team you own, and complete closure within 30 days under the Viora Terms. Records that the law requires us to keep are retained as described in section 8. You can also contact that address about any other privacy right if you cannot use your account.

We support Arabic and English and reply within two Saudi working days, normally Sunday to Thursday excluding public holidays. Complaints receive an acknowledgement and reference within two working days; we aim to give a full response within 30 days and explain any delay with an expected response date. These service targets do not extend statutory rights deadlines. You can contact SDAIA directly through the National Data Governance Platform; you do not have to complain to us first.

10. Age, changes and language

Our accounts and services are for people 18 or over who can legally enter the agreement. We use an age-eligibility confirmation, not a birth date. Contact us if you believe an ineligible person has created an account.

This page shows the policy's version, its effective date and a change log; we retain earlier versions and provide a copy on request. Editorial changes — corrections of typing or translation errors, formatting, clarifications that change no right or obligation, and updated contact or registration details — take effect when published and are recorded in the change log without a separate notice or acceptance. Any other change, including a new purpose, a new category of personal data or of recipient, a new country of processing, a longer retention period or reduced protection, is announced by email and on our website at least 30 days before it takes effect, unless the law requires it to take effect sooner, and you are asked to accept it in the same way as a material change to the Terms of Service (their section 11), including the 30 days to accept it after it takes effect. When we ask you to accept a material change to the Terms of Service, we also ask you to accept this policy. If it is unclear whether a change is editorial, we treat it as one that needs acceptance. Accepting a change is not consent to a new purpose that needs consent; where a change needs your consent, we ask for it separately. Changes to contractual project-processing arrangements follow the acceptance requirements in the Wasim Terms.

This policy is available in Arabic and English. The Arabic version prevails if they differ, subject always to applicable law.

Change log

• Version 1.2 — 22 October 2026: you agree to this policy when you create an account, accept an invitation, or are asked to accept a new version, together with the Terms of Service; changes other than editorial ones are asked for in the same way as material changes to the Terms.
• Version 1.1 — 22 October 2026: the appearance you pick on the website is saved when you pick it, without a separate cookie setting; the website no longer stores the language.
• Version 1.0 — 22 October 2026: first published version.