Home / Privacy Policy and Cookies
Privacy Policy and Cookies
Effective date: November 14, 2026
This Privacy Policy explains how Gorvado ("Gorvado", "we") collects, uses and shares personal information on the Gorvado website and services. It is written to meet the California Online Privacy Protection Act (CalOPPA), the California Consumer Privacy Act as amended by the CPRA (CCPA), and similar U.S. state privacy laws.
1. Notice at collection: what we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact details | Name, business email, phone number (optional), company name and address | You |
| Commercial information | Products you list, buying requests, offers, messages, favorites, saved searches | You |
| Business information | Legal name, entity type, state and file number, EIN, business address and phone, name and title of the person acting for the company, business verification documents, company website and description | You, public state registries |
| Team information | Role in the company, manager, job title, which conversations a person is responsible for, actions taken in the company account | You, your company's owner or admins |
| Internet activity | IP address, browser type, pages visited, security check results; for the list of your signed-in devices, the browser name and a shortened IP address | Your device, our service providers |
| Inferences | None. We do not build profiles about you. | — |
We do not ask for sensitive personal information as defined by the CCPA, such as Social Security numbers, government ID, financial account or precise location data. Please remove any such data from documents before uploading them. Business verification documents are visible only to your company's owners and admins and to Gorvado compliance staff.
2. How we use personal information
- Create and secure your account and confirm your email.
- Deliver messages, requests and offers between buyers and suppliers.
- Notify suppliers in the matching category about buying requests, and buyers about matching products they asked to follow.
- Moderate content, prevent fraud and spam, and handle reports.
- Send service emails. Marketing emails are sent only if you opt in, and every one includes a one-click unsubscribe link.
- Fill in a listing or a buying request from your words, and dictate chat replies. If you dictate, your browser's own speech service (for example Google in Chrome or Apple in Safari) turns your voice into text under its own privacy terms; Gorvado receives only the text and sends it to our AI provider to fill the form.
- Answer your questions in Gorvado Assistant (AI). Your questions and the data it looks up for you are sent to our AI provider (see Subprocessors) only to produce the answer; we keep the chat for 12 months to improve answers and prevent abuse. AI answers can be wrong — check prices and terms with the other party.
- Comply with law and enforce our Terms.
3. How we share personal information
- With other users: your company name, city and state are shown with your products, requests and offers. Your email and phone are not shown publicly. When you choose "Get offers from other suppliers", your message goes to up to five other suppliers in the same category.
- With subscribed suppliers (Buyer Access Credits): when you contact a supplier, or when a supplier on a paid plan reaches out about your Buying Request, that supplier can see your business contact details: your name, business email, phone (if you added one), company name, website, city and state. Suppliers pay Gorvado for their plan, so under California law this may be a "sale" or "sharing" of personal information. You can opt out at any time in Account → Contact details for suppliers, or with a Global Privacy Control signal; then suppliers can only talk to you in chat.
- With service providers that process data for us under contract: hosting, email delivery, payments for seller plans (Stripe — we never see full card numbers), bot protection (Cloudflare Turnstile), error monitoring, and website analytics (only with your consent).
- Connected apps (stock sync): if you connect Square, Shopify or QuickBooks Online, we read only item names, SKUs, prices and stock quantities to update your listings; we do not read customers, orders or payments and never write to your app. Access tokens are stored encrypted, and you can disconnect at any time (we then delete them).
- With Gorvado support, only with your consent: if you allow support access (Account → Password and security), a Gorvado support agent may open your account in view-only mode for the time you choose to help with your question. Every page they open is logged, you get an email when they do, and you can withdraw access at any time.
- For legal reasons: to comply with law, respond to lawful requests, or protect the rights and safety of users and Gorvado.
- In a business transfer: if Gorvado is merged or sold, subject to this policy.
Apart from making buyers' business contact details available to subscribed suppliers as described above (which you can opt out of), we do not sell personal information and do not share it for cross-context behavioral advertising.
4. Cookies, Do Not Track and Global Privacy Control
Strictly necessary cookies keep you signed in (gv_session), protect forms from bots and remember your cookie choice (gv_consent). They are always on.
Analytics (Umami, anonymous visit statistics) loads only after you allow it in the cookie banner. Marketing cookies are not used today and stay off unless you allow them.
You can change your choice at any time with "Cookie settings" at the bottom of every page. We treat a Global Privacy Control (GPC) signal as a request to opt out of sale, sharing and targeted advertising, and we turn marketing off automatically. Because we do not track you across sites, our site responds the same way whether or not your browser sends a "Do Not Track" signal.
Do Not Sell or Share My Personal Information
Buyers' business contact details can be made available to suppliers on paid plans (see section 3). To opt out, turn off "Let suppliers on paid plans see my business contact details" in Account, send a Global Privacy Control signal, or email info.gorvado@gmail.com. We honor opt-outs within 15 business days at the latest, usually right away. We do not use your data for cross-context behavioral advertising.
5. Retention
We keep account data while your account is open. When you delete your account we remove or de-identify your personal information within 30 days, except where we must keep it to comply with law, resolve disputes or prevent fraud. Business verification documents are deleted when the company account is deleted, and records of the verification decision are kept for up to 5 years for fraud prevention and legal compliance. Server logs are kept for up to 90 days. Records of support access (who opened an account, when, why and which pages) are kept for 2 years. Backups are overwritten within 14 days.
6. Your rights and choices
Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Texas and others), you may have the right to:
- Know and access the personal information we hold about you — use Account → Privacy and data → Download my data.
- Delete your personal information — use Account → Privacy and data → Delete my account.
- Correct inaccurate information — edit it in your Account or contact us.
- Opt out of sale, sharing or targeted advertising — we do none of these.
- Not be discriminated against for exercising your rights.
You can also send a request to info.gorvado@gmail.com. We verify requests by confirming control of the email address on the account. An authorized agent may submit a request with your signed permission. We respond within 45 days. If we deny your request, you may appeal by replying to our decision.
7. Email and text preferences
Text messages: if you switch on the weekly SMS stock check, we use your mobile number only to send that check and the confirmation code, through our provider Twilio. We do not sell or share mobile numbers or text-message consent with third parties for their marketing. Reply STOP to any text, or switch it off in Account → Stock check by SMS. We keep a record of your consent (time, number, wording) and of opt-outs.
You can turn off emails about new buying requests in Account settings, delete saved-search alerts, and unsubscribe from newsletters in one click. Service emails about your account and transactions you started cannot be turned off while the account is open.
8. Security
We use reasonable technical and organizational measures, including encrypted connections, hashed session tokens and access controls. No method of transmission or storage is completely secure.
9. Children
The Platform is for businesses and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child provided information, contact us and we will delete it.
10. Changes to this policy
We will post any update here with a new effective date. For material changes we will also notify account holders by email before they take effect.
11. Contact
Gorvado
Postal address available on request at info.gorvado@gmail.com