Privacy Policy

Effective date: 13 September 2026

1. Who we are

Vorbly is an AI sales assistant for websites and messaging channels. It is operated by "MOYSHA CRM SOLUTIONS" S.R.L., a limited liability company registered in the Republic of Moldova on 23 November 2020, IDNO 1020604001895, registered office at str. Cernov 62, or. Dondușeni, MD-5101, Republic of Moldova ("Vorbly", "we", "us").

Contact for any privacy matter: privacy@vorbly.ai

This policy explains what personal data we handle, on what basis, who else sees it, how long we keep it, and how anyone can have it deleted. It applies to https://vorbly.ai, to the Vorbly dashboard, and to the Vorbly chat widget and messaging integrations wherever they are installed.

2. Two different roles — read this first

Vorbly handles personal data in two distinct capacities, and your rights work slightly differently in each.

(a) We are the controller for data about our own customers: the people and companies who register a Vorbly account. We decide why and how that data is processed.

(b) We are a processor for data about visitors — the people who write to a business through a Vorbly chat widget, Telegram bot, Instagram, Messenger or WhatsApp account. The business that installed Vorbly is the controller of that conversation: it decides to run the assistant, what the assistant asks, and what happens with the resulting enquiry. We process that data on that business's documented instructions, under a written data processing agreement.

If you wrote to a business and want to know why it holds your data, ask that business. If you want your data removed from our systems, you do not need to find them first — see section 9 and our Data Deletion Instructions. We act on requests sent directly to us.

3. Data we process as controller (account holders)

We do not sell personal data. We do not use customer content to train artificial intelligence models, and our model provider is contractually barred from doing so with data sent through our account.

4. Data we process as processor (visitors)

When someone writes to a business using Vorbly, we process on that business's behalf:

• the content of the conversation, including messages, images and files the visitor sends;
• contact details the visitor provides — typically name and phone number, sometimes email;
• the stated interest: what the visitor asked about, which product, when;
• channel identifiers: Telegram chat id, Instagram, Messenger or WhatsApp scoped user id, or an anonymous widget session id;
• technical data: IP address, approximate country derived from it, browser language, page the widget was opened on, referral and campaign parameters of that page;
• derived records: a short summary of the conversation, sentiment markers and quality signals used to improve the assistant's answers for that business.

We do not knowingly collect special categories of data (health, religion, political opinion, biometric or genetic data). Businesses are contractually required not to configure the assistant to collect them. If a visitor volunteers such information in a message, it is stored as part of the conversation and deleted on the same terms as the rest of it.

The assistant is artificial intelligence. It is disclosed as such in the chat. Messages are sent to our model provider to generate replies. The assistant's answers about price, availability and appointments are generated from data the business itself entered; we do not guarantee their accuracy and they do not constitute an offer from us.

5. Children

The service is not directed at children. We do not knowingly process data of persons under 16 as account holders. Businesses using Vorbly are responsible for the audience they direct the assistant at.

6. Who else sees the data (sub-processors)

We use a small number of service providers. Each of them is bound by a written agreement that restricts them to processing data only on our instructions.

The current list is published at https://vorbly.ai/subprocessors. We give account holders at least 30 days' notice before adding a sub-processor that handles visitor data, and they may object; if we cannot resolve an objection, they may terminate the affected service without penalty.

We also disclose data where we are legally obliged to — to a court, a supervisory authority or law enforcement acting under a valid order — and, if we are ever acquired or merged, to the acquiring entity, subject to this policy continuing to apply.

7. International transfers

Vorbly is operated from the Republic of Moldova. Some of our providers are located in the United States, which is not recognised as providing an adequate level of protection. Those transfers take place under standard contractual clauses incorporated into our agreements with those providers, which impose data protection obligations equivalent to those applicable in Moldova and the European Union. A copy of the relevant clauses is available on request to privacy@vorbly.ai.

8. How long we keep data

Conversations and visitor records. The business sets the retention period in its dashboard. The default is 365 days from the last message; it can be set between 30 and 3650 days. When the period expires, messages are deleted automatically.

Lead records. Kept while the business keeps them, and deleted when the business deletes the lead, deletes the customer card, or closes its account.

Account data. Kept for as long as the account exists. When the account is closed, it is deleted immediately and permanently, except:

Billing records. Kept for the period required by Moldovan accounting and tax law, currently 5 years, regardless of account closure.

Technical and security logs. 90 days.

Deletion requests and their outcome. 3 years, as evidence that we handled the request — this record contains the request itself and what we did, not the deleted data.

9. Your rights

Anyone whose data we hold may ask us to: confirm what we hold and get a copy; correct it; delete it; restrict or object to its processing; receive it in a machine-readable format; and withdraw consent where processing rests on consent.

These rights apply to everyone, regardless of country of residence, and free of charge.

To exercise them, use the form at https://vorbly.ai/data-deletion or write to privacy@vorbly.ai. We answer within 30 calendar days. If your request concerns data we hold as a processor for a business, we forward it to that business and handle it as described on the data deletion page — you do not have to contact the business yourself.

We may ask for information that lets us locate your records (for example, the phone number you gave in the chat) and, where a request is doubtful, for something that establishes you are the person concerned. We ask for the minimum necessary and do not keep it afterwards.

If you believe we have handled your data unlawfully, you may complain to the National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP), 48 Serghei Lazo Street, Chișinău, MD-2004, www.datepersonale.md — or, if you are in the European Union, to the supervisory authority of your country.

10. Security

Access to production data is restricted to named personnel and protected by two-factor authentication. Data is encrypted in transit (TLS) and at rest. Channel credentials and other secrets are additionally encrypted with AES-256-GCM. Access between organisations is enforced at database level, so one customer cannot read another's data. We apply rate limits and automated abuse detection, log privileged actions, and review access regularly.

No system is immune. If a breach occurs that is likely to result in a risk to individuals, we notify the supervisory authority within 72 hours of becoming aware of it and notify affected controllers without undue delay.

11. Cookies and local storage

The Vorbly website uses cookies that are strictly necessary for it to work (session, security, language) and, if you consent, analytics cookies. You can refuse analytics without losing access to anything.

The chat widget stores a session identifier in your browser's local storage so the conversation survives a page reload. It is not used to track you across other websites and is removed when the conversation is deleted.

12. Changes

We update this policy when the service changes. The effective date at the top always reflects the current version. If a change materially affects account holders, we notify them through the notification channels configured in the dashboard at least 14 days in advance.