VORKO
LEGAL

VORKO — Privacy Policy

Effective date: 2 October 2026Document version: 6Applies to: the VORKO application for iOS, Android and Windows, including the versions distributed through the Apple App Store and TestFlight, and the servers that support it.

This Policy explains what personal data VORKO ("VORKO", "the app", "we", "us") processes, why, who it is shared with, how long it is kept and how you can control it. It is the document that sets out the operator's policy on the processing of personal data (Article 18.1 of Russian Federal Law No. 152-FZ "On Personal Data").

VORKO is a service for companies working in foreign trade and logistics: importers, exporters, customs brokers, carriers and laboratories. It is not intended for consumers or children.

If you do not agree with this Policy, do not use the app.

1. Operator

The operator of personal data is Nikita Noritsyn, Russian Federation ("the operator", "we", "us"). For questions about personal data, access requests, account deletion and complaints, write to the address in Section 13.

Messages in VORKO are delivered through Telegram. Telegram is an independent service with its own Privacy Policy (https://telegram.org/privacy), and we do not control it.

2. What data we process

We process only what is needed to run your company's workspace. VORKO has no advertising, third-party analytics or tracking tools; we do not collect the advertising identifier (IDFA) and do not ask for the App Tracking Transparency permission, because we do not track you across other companies' apps and websites.

DataExamplesPurposeOn VORKO servers
AccountTelegram ID and the phone number of your Telegram account, access key, company, owner or employee status, access permissions and teamSign-in and access rightsYes (identifiers, status, access permissions and team)
Work dataRequests, deals, amounts, statuses, invoices, receipts, documents, transaction historyWorking with deals and record-keepingYes
MessagesMessages, photos and files in work chatsCommunication between deal participantsDelivered through Telegram; VORKO keeps which deal a message belongs to, and machine translation (up to 7 days)
VORKO AssistantQuestions, conversation history, attached images, answers and their sourcesAnswering questions about working in VORKOYes
Company CRMClient and deal cards, contacts and notes, client inquiries from channels the company has connectedRunning the company's CRM on its behalfYes, if the company uses the CRM
Technical dataApp and OS version, language, connection and delivery logs, push-notification tokenRunning the service and notificationsYes
OptionalAddress-book contacts; chats for Employee Control; the company's WhatsApp channelOnly if you or your company turned the feature onContacts — no; the rest — within Sections 2.4–2.6

2.1 Account

Sign-in uses your Telegram ID and the phone number linked to your Telegram account (the Telegram sign-in takes place on your device), together with your company's access key, your company, your owner or employee status, assigned access permissions and position in the team hierarchy. A company has an owner and employees; authority is set by access permissions, and reporting relationships by the team hierarchy.

2.2 Work data and messages

Messages, photos and files in work chats are delivered through Telegram and are subject to its rules. VORKO servers keep information about deals — for example, which deal a message belongs to — so that the right people in your company see the right information. They also keep the documents attached to deals.

The app shows amounts, statuses, invoices, receipts and the transaction history of deals, and lets you send payment details to a deal participant and attach a receipt. This is an exchange of documents and a status mark, not a bank transfer. The owner of an importer company can allocate an internal accounting balance between balance sections and pay the subscription from it. The app does not request or store bank-card details and does not make transfers: goods and services are paid for outside the app through ordinary banking channels.

If deal participants write in different languages, VORKO shows each of them a translation into their own language. For this, the text of messages in deal topics and the values of fields that users fill in (for example, a city, a comment, or the description of an offer or a company profile) are sent to a machine-translation provider (Section 4). A finished translation is kept on VORKO servers for up to 7 days so that the same text is not translated again.

2.3 VORKO Assistant

When you ask VORKO Assistant a question, we process the question text, the earlier messages of that conversation and any attached images. The server selects information you already have access to — about the company, requests, deals, purchases, files and CRM — and, at your request, can open a page from a link or search the internet.

The answer is prepared by a language model of a third-party provider (Section 4). The provider receives the question, the conversation history, the images and the information the server selected for the answer within your access rights. Client details from deal paperwork (full name, taxpayer number (INN), insurance number (SNILS), address) and the phone numbers of CRM clients are not sent to the provider. The question text, the history and the images are sent as they are, so do not add personal data to a question that the answer does not need.

Before your first question, the app shows what data is sent and to whom, and asks for your permission; without it, the question is not sent. If the terms of the transfer change, the app will ask for permission again. You can revoke the permission at any time in the assistant menu; after that, the assistant sends no questions until you allow it again. Revoking does not delete the conversation journal already stored; it can be deleted on request (Section 13).

Questions, answers and their sources are kept in a conversation journal so that you can see the history and we can look into support requests. The assistant can prepare a plan to change CRM settings but changes nothing by itself: changes are made only after you review the plan and tap Apply. The assistant works separately from Employee Control and does not require it to be turned on.

2.4 Contacts (only if you turn it on)

Contact synchronisation is off by default. If you turn it on and allow access to your contacts, the names and phone numbers in your address book are sent to Telegram so that it can show which of your contacts use Telegram. This includes information about people who do not use VORKO. VORKO does not store your address book on its servers. You can turn synchronisation off at any time and revoke access to contacts in your device settings.

2.5 Employee Control (only with the employee's consent)

This is an additional feature for companies: a daily assessment of an employee's work correspondence. It is turned on for an employee only after that employee's personal consent and works only with the one-to-one Telegram chats that the employee has chosen. VORKO receives the message text, time, direction (incoming or outgoing), edit or deletion marks and the attachment type; photos, videos, documents and other attachments are not downloaded.

The text is kept on VORKO servers for no more than 30 days. To prepare the assessment, it is sent to the language-model provider (Section 4), with the direct identifiers of the company, the employee and the chat replaced by codes. The correspondence may contain information about the people the employee corresponds with; it is used only to prepare the assessment.

The owner receives finished reports for the whole company, while supervisors with access to Control receive reports only about employees in their own team, including nested teams. Reports contain scores, findings and recommendations; these recipients get no access to the correspondence itself. The Sees the whole company permission does not expand the set of employees covered by Control reports. The employee can change the list of chats or withdraw consent at any time; after consent is withdrawn, new messages are not collected.

2.6 Company WhatsApp channel (only if the company connects it)

A company can connect its WhatsApp number to VORKO as a linked device. The VORKO server then processes the messages, statuses, reactions, history and attachments of that number so that the company's employees can work with them in the app. Messages of this channel are delivered through WhatsApp and are subject to its rules. Connection data is stored on the server in encrypted form; the QR code or pairing code is valid only during linking. This is the connected company's data, not the user's personal Telegram session.

2.7 Company CRM (only if the company uses it)

A company can run a CRM in VORKO — client and deal cards with contacts and notes — and receive client inquiries from channels it has connected itself: its own Telegram bot, a WhatsApp number (Section 2.6), a mailbox, a website form or telephony. This is data about the company's clients: VORKO processes it on the company's behalf and only to run its CRM (Terms of Use, Section 3).

If the company has turned on AI-assistant replies in its Telegram bot, a client's message, together with the information the company prepared for replies (the company description, its contacts, documents, questionnaire questions), is sent to the language-model provider (Section 4) to prepare a reply; the client's name and Telegram ID are not sent to the provider. If the company has turned on mail parsing, the subject, text and attachment names of incoming e-mails are sent to the same provider to determine whether an e-mail is a client inquiry and to fill in card fields; the sender's address is not sent to the provider. Informing its clients about this processing is the company's responsibility.

2.8 Technical data and device permissions

To run the service we process the app and OS version, language, connection and delivery logs, and the push-notification token if you allowed notifications; it is used only for the app's notifications. Notifications are delivered through the Apple notification service (on iPhone) or the Google notification service (on Android).

The app asks for permissions only when you use the related feature; each can be revoked in your device settings:

  • Camera — photos for chats and documents.
  • Microphone — voice messages.
  • Photos — attaching and saving images.
  • Contacts — only for the synchronisation in Section 2.4 (off by default).
  • Notifications — about deals, messages and approvals.

3. Purposes and legal grounds

We process data to: create the company's workspace and manage access to it; deliver and synchronise messages and deal events to the right participants; show messages and deal fields in each participant's language; show trade and settlement records and keep them consistent between the company's employees; answer questions through VORKO Assistant, keep a journal of these conversations and prepare CRM change plans; on the company's behalf, run its CRM, including preparing replies of its Telegram bot and parsing incoming e-mails if the company has turned these features on; with the employee's consent, prepare Employee Control reports; send notifications about events that concern you; keep the service secure, prevent abuse and comply with the law.

Legal grounds: performance of the agreement to which you are a party (the Terms of Use); your consent for features that are turned on by choice (contact synchronisation, Employee Control, sending VORKO Assistant questions to the language-model provider); the company's instruction for its clients' data in the CRM; compliance with obligations established by law; protection of the rights and legitimate interests of users and the operator.

We do not sell data, do not use it for advertising and do not build marketing profiles.

4. Who data is shared with

Each recipient receives only what the relevant feature needs:

  • Telegram — messages, attachments and (if you turned on synchronisation) contacts are processed by Telegram under its rules.
  • Hosting providers — provide the servers and storage on which VORKO runs.
  • Provider of artificial-intelligence language models — a third-party language-model provider (USA). It receives the data described in Sections 2.3, 2.5 and 2.7 to prepare VORKO Assistant answers, Employee Control assessments, replies of the company's Telegram bot and CRM mail parsing. Requests are sent on the condition that they are processed only by model providers that, under their own rules, do not use request data to train models or for other purposes of their own. We give the provider's name and address on request at support@vorko.io.
  • Machine-translation provider (European Union) — receives the texts described in Section 2.2 to translate them into the recipient's language.
  • Apple and Google notification services — receive the notification text and the device token to deliver a notification to an iPhone or an Android phone.
  • WhatsApp — if the company has connected its number (Section 2.6), messages of this channel are delivered through WhatsApp under its rules.
  • Your company's owner and supervisors with access to Control — the owner receives reports for the whole company, and supervisors only about employees in their own team, including nested teams; the Sees the whole company permission does not expand this set. The original correspondence is not shared with them.
  • When required by law — we may disclose data in response to a lawful request, and to protect the rights, safety and property of users and the operator.

Telegram, Apple, Google, WhatsApp, the language-model provider and the machine-translation provider are independent companies: they also process the data they receive under their own rules. We do not share data with advertising networks, data brokers or analytics companies.

5. Where data is processed

VORKO servers and the services we use may be located outside the country you are in. The language-model provider is located in the USA and, to prepare an answer, may route a request to a model that runs in another country; the machine-translation provider is located in the European Union; Telegram, Apple, Google and WhatsApp process data in their own infrastructure. Data is transferred only to the extent the relevant feature needs, with the protection measures in Section 8.

6. Retention and deletion

We keep data while it is needed for the purposes in Section 3 and then delete it, unless the law requires us to keep it longer.

DataRetention
Account and accessWhile the account is active. Revoking access ends active sessions; the company's data is kept if it is needed for the company's work, for resolving disputes or by law.
Deals, invoices, receipts, transaction history, audit logsWhile the company's workspace is active and up to 7 years where needed for tax, accounting and other obligations or for resolving disputes.
Machine translationA finished translation — up to 7 days.
Company CRM dataWhile the company's workspace is active and the data is needed for its CRM, unless the law requires it to be kept longer.
Technical logsNormally up to 90 days, unless needed to investigate abuse or an incident or by a lawful request.
Push-notification tokens and active sessionsUntil you turn off notifications, sign out or delete your account.
ContactsNot stored on VORKO servers; if you turned on synchronisation, they are kept by Telegram under its rules.
Employee Control correspondenceNo more than 30 days after receipt. Withdrawing consent immediately stops the collection of new messages.
Employee Control reports and settingsWhile the company's workspace is active and the reports are needed to provide the service, resolve disputes or by law.
VORKO Assistant journalWhile it is needed to run the service and look into support requests. At the request of the user or the company it is deleted earlier, except for records that must be kept by law or to resolve a dispute.

To request access, correction or deletion of data, write to us (Section 13). Messages already delivered through Telegram are kept under Telegram's rules, which we do not control.

7. Conduct rules and complaints (zero tolerance)

VORKO has chats in which users communicate. We have zero tolerance for objectionable, abusive, illegal or infringing content and for abusive behaviour. Such content and behaviour are prohibited by the Terms of Use and may lead to removal of the content and termination of access.

In the app you can report a message, a chat or a user that breaks the rules, and block another user. We aim to acknowledge a report within 24 hours and to act on confirmed violations within 48 hours. You can send a report with the Report action in the app or to the address in Section 13.

We cannot check in advance the messages that arrive from the Telegram network; for content published through VORKO, where technically possible, we may apply automatic or manual filters, rate and attachment limits and sensitive-content warnings. Reporting, blocking and a published contact address are always available.

8. Data protection

The connection between the app and our servers is protected by encryption (TLS), and messages travel over Telegram's encrypted protocol. The sign-in token is stored on the device (on iOS, in the protected Keychain storage) and is used to authorise requests; the server keeps information about active sessions. The keys of the personal Telegram session stay on the device and are not uploaded to VORKO servers. No method of transmission or storage is perfect, but we take reasonable measures to protect data.

9. No advertising or tracking

VORKO contains no advertising, third-party analytics, crash-reporting SDKs or tracking across apps and websites. We do not use the advertising identifier. The App Privacy information in the App Store reflects this.

10. Children

VORKO is a tool for foreign-trade professionals and is not intended for children. We do not knowingly collect children's data. If you believe a child has given us data, write to us and we will delete it.

11. Your rights

You have the right to:

  • obtain information about the processing of your personal data;
  • require that your data be clarified, blocked or deleted if it is incomplete, outdated, inaccurate or no longer needed for the stated purposes;
  • withdraw consent for features that work by consent: contact synchronisation can be turned off in settings, Employee Control on the Control screen where this setting is available, and the permission for VORKO Assistant in the assistant menu;
  • appeal against our actions to the authority for the protection of the rights of personal-data subjects (Roskomnadzor) or in court.

If you are in another country, you may also have other rights under its law. Send requests to the address in Section 13; we reply within 10 working days. We consider requests about the VORKO Assistant journal and company records taking into account operational, dispute-related and legal obligations.

A company that uses Employee Control reports is itself responsible for informing its employees and for complying with employment law. A company that runs a CRM in VORKO is itself responsible for the legal grounds for processing its clients' data and for informing them.

12. Changes to this Policy

We may update this Policy. If we make a material change, we will update the effective date and the document version above, and the app will ask you to review and accept the new edition before you continue.

13. Contact

This Policy is published at https://v2.vorko.io/legal/privacy.