Clear rules. Clear responsibility.

Terms of Service

These Terms govern access to and use of VOREN, including its website, applications, AI features, integrations and related services. VOREN is operated by [LEGAL ENTITY TO CONFIRM], company number [TO CONFIRM], registered office [TO CONFIRM].

1. Business use and authority

VOREN is provided for business and professional use. A person creating an account on behalf of an organisation confirms that they are at least 18 and have authority to bind that organisation.

2. The Service

VOREN is an AI-enabled business operating platform. Available functionality depends on plan, configuration, industry profile, connected services and enabled modules. Beta, preview, planned or setup-dependent functionality may change or be unavailable and must not be presented as generally live.

3. Accounts and security

Customers must protect credentials, maintain accurate account information, remove access when no longer required and notify VOREN promptly of suspected unauthorised access. Customers remain responsible for permissions granted within their workspaces.

4. Subscription and billing

Paid access is governed by the applicable plan, checkout or order. Unless stated otherwise, subscriptions renew for successive billing periods; fees are payable in advance; applicable taxes may be added; and non-payment may result in restriction or suspension. Pricing changes require reasonable advance notice and normally apply at renewal.

5. Customer Data

The Customer retains ownership of information, files, records, messages, documents and other content submitted to, imported into or connected to its workspace. The Customer grants VOREN only the rights reasonably necessary to provide, secure and support the Service, perform authorised actions, comply with law and operate under the Data Processing Agreement.

6. Customer responsibility

The Customer must have a lawful right and appropriate legal basis for information it directs VOREN to process. Where the Customer determines the purposes of processing relating to employees, customers, patients, residents, pupils, contractors, suppliers or other individuals, the Customer remains responsible for its obligations as controller.

7. AI

AI output can be incomplete, inaccurate or unsuitable. Customers must apply appropriate human judgement before relying on AI output for material decisions. VOREN does not replace legal, accounting, tax, medical, clinical, safeguarding, financial, employment, engineering or other regulated professional advice.

8. Actions and automation

Where VOREN prepares an action for approval, the approving user is responsible for reviewing it. Customers must configure suitable permissions and approval rules. VOREN must not be used to make unlawful solely automated significant decisions about individuals.

9. Payroll and regulated use

Unless expressly identified otherwise, payroll functionality is payroll preparation rather than PAYE filing, wage transfer or tax advice. Industry profiles do not certify regulatory compliance. Clinical, safeguarding, statutory certification and other protected professional decisions remain with appropriately authorised people.

10. Integrations

Connecting a third-party service authorises VOREN to access and process the information reasonably necessary for the selected functionality. Third-party services remain subject to their own terms, availability and security practices.

11. Intellectual property

VOREN and its licensors retain intellectual-property rights in the Service. Subject to fees and these Terms, Customers receive a non-exclusive right to use the Service for internal business purposes during the subscription term.

12. Confidentiality

Each party must protect confidential information with reasonable care and use it only for purposes connected with the Service, subject to lawful disclosure requirements.

13. Data protection and security

The Data Processing Agreement applies when VOREN acts as processor. VOREN acts as controller for limited purposes such as account administration, billing, security, legal compliance and its own permitted business communications. No internet service can guarantee absolute security.

14. AI model training

VOREN will not use Customer Data to train a shared or general-purpose model for unrelated customers unless the Customer has expressly opted in. This promise must remain aligned with every production AI-provider configuration.

15. Suspension and termination

VOREN may proportionately suspend access for non-payment, security threats, suspected unlawful activity, material breach or legal requirements. On termination, outstanding fees remain payable and Customer Data is handled under the DPA and published retention schedule.

16. Availability and liability

Unless a separate SLA applies, uninterrupted availability is not guaranteed. Nothing excludes liability that cannot lawfully be excluded. Subject to final legal review, VOREN's aggregate contractual liability is intended to be capped at fees paid or payable for the Service during the preceding 12 months, with appropriate exclusions for indirect loss. This clause requires adviser and insurance review before launch.

17. Governing law

The Terms are intended to be governed by the laws of England and Wales with the courts of England and Wales having jurisdiction, subject to final adviser review.

Privacy Notice

This notice explains how VOREN handles personal information where VOREN determines the purpose and means of processing. VOREN generally acts as controller for account registration, subscription administration, billing, security, fraud prevention, support, service analytics, legal compliance and its own business communications. Where a business customer supplies personal information and determines its purpose, VOREN generally acts as processor under the DPA.

Information we may process

• account and business identity information;
• workspace and configuration information;
• Customer Data such as contacts, staff, work, bookings, documents, wages, invoices and operational records;
• AI prompts, responses, proposed actions and approval history;
• integration data;
• billing and transaction status;
• technical, session, security and diagnostic data;
• support and permitted marketing information.

Purposes and lawful bases

Depending on the activity, VOREN may rely on contract, legitimate interests, legal obligation or consent. Legitimate interests may include proportionate security, fraud prevention, service administration, product reliability, support and permitted B2B communications where individuals' rights do not override those interests.

Special-category data

Customers may use supported features in contexts involving health, care or other protected information. Where VOREN acts as processor, the Customer is responsible for determining the Article 6 basis and any required Article 9 condition. Customers should not upload special-category information unless genuinely required.

AI processing

VOREN may use AI systems to provide requested functionality. Customer Data will not be used to train shared or general-purpose models for unrelated customers unless the Customer expressly opts in. VOREN may use genuinely de-identified or aggregated information for service performance and improvement.

Recipients and international transfers

Information may be processed by verified infrastructure, database, AI, payment, email, communications, authentication, security, monitoring, support and analytics providers. Current processors must be listed in the Subprocessor section below. Restricted transfers must use a lawful UK mechanism such as adequacy regulations, the UK IDTA, the UK Addendum or another recognised mechanism, with the applicable data protection test where required.

Retention

Final production retention periods are pending adviser and infrastructure verification. The intended baseline is: active account data for the account lifetime; Customer Data during the subscription plus a short export/deletion window; controlled backup rotation; security logs for a proportionate period; support records for a defined support-history period; and accounting records for the legally required period.

Rights and complaints

Depending on the circumstances, individuals may have rights of access, correction, deletion, restriction, objection, portability, withdrawal of consent and safeguards concerning certain automated decisions. Where VOREN acts only as processor, requests should normally be directed to the relevant Customer. Concerns may also be raised with the UK Information Commissioner's Office.

Cookie Policy

VOREN uses necessary browser storage and similar technologies for functions such as authentication, security, session continuity and essential preferences. Optional analytics or marketing technologies must not be enabled before valid consent where consent is legally required.

The final production cookie inventory must identify each technology, provider, purpose, category and duration from the systems actually deployed. VOREN must not invent a cookie list before those technologies exist.

Change cookie preferences

Acceptable Use Policy

Customers and Authorised Users must use VOREN lawfully and must not use it to compromise systems, evade access controls, distribute malicious code, obtain unauthorised credentials, falsify business records, unlawfully process personal data, send unlawful spam or phishing, impersonate people without authority, infringe intellectual property or conduct unlawful surveillance.

VOREN must not be treated as the final decision-maker for clinical, safeguarding, statutory certification, regulated advice or other decisions that law or professional standards require a qualified person to make. Customers must maintain meaningful human oversight where required.

VOREN may proportionately restrict functionality, suspend access, preserve necessary evidence, require remediation or terminate serious misuse.

Data Processing Agreement

This DPA forms part of the agreement between the subscribing business as Controller and VOREN as Processor where VOREN processes Customer Personal Data on the Customer's behalf.

Documented instructions

VOREN processes Customer Personal Data only on documented Customer instructions, as necessary to provide configured functionality, as documented in the agreement or where required by law. Use and configuration of the Service form part of those instructions. VOREN will notify the Customer if an instruction appears to infringe applicable data-protection law.

Confidentiality and security

Authorised personnel must be bound by confidentiality. VOREN will maintain appropriate technical and organisational measures taking account of processing risks, including access control, tenant isolation, secure credential handling, audit/event logging, backup and recovery, incident response and secure software-development practices as actually implemented.

Subprocessors

The Customer grants general authorisation for verified subprocessors. VOREN must place appropriate contractual obligations on them and remain responsible to the extent required by law. Material new subprocessors should be notified in advance with a reasonable objection process.

Rights and compliance assistance

Taking account of the nature of processing, VOREN will provide reasonable assistance with data-subject rights, security obligations, breach assessment, DPIAs and regulator consultation where applicable.

Personal Data Breaches

VOREN will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, providing available information about the incident, affected data and people, likely consequences and mitigation as the investigation develops.

Return and deletion

At termination, VOREN will provide a reasonable opportunity to export Customer Data and then delete or return Customer Personal Data according to the verified retention schedule, subject to lawful retention and controlled backup rotation.

Audit

VOREN will make reasonably necessary compliance information available. A proportionate audit mechanism should apply where documentation is insufficient, protecting service security and other customers' confidentiality.

Processing details

Processing may include collection, storage, organisation, retrieval, analysis, AI processing, generation of requested outputs, transmission, workflow execution, backup, export and deletion. Data subjects may include Customer personnel, workers, contractors, customers, prospects, suppliers, guests, members, tenants, pupils/guardians, patients/residents and other people lawfully processed by the Customer. The exact categories depend on enabled functionality.

Subprocessor List

VOREN will publish only processors actually used in production. The current repository indicates integrations with services in categories including hosting/deployment, database/authentication, payments and transactional email, but the final legal inventory must be checked against production accounts, regions, contracts and AI routing.

Security & Data Handling

VOREN's architecture is designed around workspace separation, server-enforced access, human approval for consequential AI actions and evidence/audit records. Security claims below must remain tied to controls that actually exist in production.

• authenticated workspace access and role-based permissions;
• database row-level security for tenant-scoped production records where implemented;
• server-side storage of protected connector credentials;
• human approval gates for supported consequential AI actions;
• event, action and audit evidence for relevant workflows;
• safe error handling and degraded-mode behaviour;
• backup/recovery and incident-response controls as verified before launch;
• dependency and release controls as the production pipeline matures.

VOREN does not claim a certification, guaranteed uptime level or security accreditation unless it has actually obtained it and the claim is published here.