Privacy

This page was rewritten, and why

AVORA is a demonstration project. It holds no banking licence, is authorised by no regulator, takes no deposits and sells nothing. This document is written to show the shape and tone such a document takes, and creates no rights or obligations for anyone.

Until recently this page said the site had no server, no database and no accounts, and that no personal data was held. That was true when it was written and stopped being true when the platform was built. A privacy notice that promises the opposite of what happens is worse than none, so here is what happens now.

What is stored

There is a server and a database. If you register, or an account is opened for you, these are held:

• Your name, your email address and, if you gave one, your phone number.
• Your password, never in the clear: an argon2 hash only, which cannot be turned back.
• Your accounts, their balances and every movement, with its date, amount and reference.
• Any identity documents you upload — passport, proof of address — and the outcome of their review.
• The emails we send you: subject, recipient, and whether they left the building.
• Your sessions, with the IP address and browser you signed in from.
• An audit log of what staff do to your record, including every time somebody opens one of your documents.

Do not upload real identity documents

This is the most important thing on this page. The documents screen will accept a real passport and will store it the way a bank would: outside the public folder, with a SHA-256 fingerprint, readable only by somebody holding the specific permission, and leaving a trace on every read.

None of that makes a demonstration project a place your passport belongs. Upload any image. If you have already uploaded a real one, tell us and we will delete it.

Who can read it

Staff, and not all staff equally. Permissions are per job: seeing that a passport arrived and opening that passport are two different grants, and far fewer people hold the second. Every document opened is logged with the name of whoever opened it and the time.

A password, a CVV or a private key is never shown in full, because none of them is stored in a form that could be shown.

What we do not do

There is no analytics, no advertising pixel, no third-party tracker and no profiling. The typeface is served from this site rather than a CDN, so loading a page makes no request to anybody else.

Nothing is sold or passed to third parties. The only external services the platform touches are the mail provider that delivers the messages we send you and the public exchange-rate source, which receives no data about you.

Your rights, and what is actually built

You can ask to see what is held about you, to correct it, or to have it erased. Said honestly: there is not yet a button to export it yourself or to close the account. Today it is done by writing to us, and a person does it by hand.

Your statements and your balance certificate you can download yourself, whenever you like, from your application.