1. Operator and scope
Vorelia is a brand of OnyxBell, LLC, an Ohio limited liability company in the United States. Contact: contact@getvorelia.com.
Mailing Address: 1274 W Clifton Blvd Lakewood, OH 44107 United States
Effective date: 2026-10-22
This policy covers the informational website intended for getvorelia.com, voluntary email contact and Vorelia Backup Recovery, a separate internal utility. The coaching application remains in protected private staging. Public application access, registration and subscriptions are unavailable.
This is not a complete privacy notice for future customer-facing SaaS services. Applicable product privacy disclosures and terms require review before activation or introduction of real customer and fitness-client data.
2. Website visits and email enquiries
The website provides product information and email contact links. It does not display an enquiry form; form delivery is disabled. Choosing an email link opens your own email service for a separate communication.
The website code has no active registration, checkout, payment collection, advertising, analytics, tracking pixels or third-party embeds. It does not set cookies or use browser storage to track visitors. These statements concern the website code, not independent hosting or email-provider logging.
If you email us, we receive your sender address, message, attachments and other information you choose to provide. We use that information to respond and manage the enquiry. Please do not send passwords, recovery links, access tokens, confidential client records or health information. This request does not mean such information can never be received.
A hosting provider may process technical request information, including IP address, request time, requested page, browser details and security events, to deliver and protect the site. Its final hosting-log settings, processing locations and provider retention details remain subject to publication review; no absence of provider logging is promised.
3. Separate protected staging application
The separate application uses Supabase for its QA database and authentication and Vercel for protected staging hosting. Supabase Auth has also been used for approved recovery-email tests. The informational website does not connect to that database or grant access to staging.
Controlled coaching records are fictional. Staging authentication and backups may nevertheless contain real operator or approved test-account identifiers, including email addresses; they are not anonymous or free of personal information.
Application data categories include lead and client contact details, coaching dates, notes, check-in responses and follow-up history. Check-in questions can concern nutrition, energy, stress and sleep/recovery; custom text may contain additional sensitive information. This describes application categories, not information requested by the public website or permission to introduce real client data.
4. Founder-only Google Drive backup utility
Vorelia Backup Recovery is a separate single-user utility for the Founder-controlled Google account, used for encrypted database backup storage and recovery verification. It is not customer Google Sign-In, a Gmail or Calendar integration, a public coaching application or a customer backup feature. The website does not initiate Google authorization or execute backups.
The utility requests only Google Drive’s drive.file permission for files created by or explicitly selected for use with the utility, including the authorized destination. It does not request general access to every file in Drive. Use remains limited to the Founder-authorized backup workflow.
To verify the account, destination and transfer, it processes the Founder’s Google account email and permission identifier; file and folder identifiers, names, parent relationships, types, ownership, permission and capability information; file sizes and integrity hashes; and storage-quota and usage information.
Database archives and recovery catalogs are encrypted locally before upload. A separate, unencrypted minimal transfer manifest contains recovery-point identifiers, timestamps, filenames, sizes and integrity hashes. These readable details are metadata, not plaintext database records, and are not described as encrypted. Artifacts are independently downloaded and checked; locally decrypted material is used for isolated restoration verification.
Backup contents can include QA business and Auth records and recovery metadata. Encryption does not make them anonymous. Local operational reports may retain non-secret identifiers, timestamps, hashes and verification results. The original encryption key and recovery passphrase are kept separately from uploaded database ciphertext.
In the accepted manual workflow, Google authorization codes, access tokens and related authorization material are handled in short-lived process memory. Durable authorization and scheduled unattended operation are not enabled. Offline refresh-token custody is not represented as implemented. Future persistent authorization requires separate approval and updated disclosures before use.
5. Providers and use of information
Vercel hosts the separate public informational website and the protected staging application. Supabase provides the QA application database and Auth services. Google provides OAuth authorization and Drive storage and metadata services for the internal utility. IONOS provides the business email service for contact@getvorelia.com and is the domain registrar. These roles do not imply that the static website sends visitor information to the application database or backup utility.
The backup workflow runs locally on the authorized Windows computer. Bitwarden supports Founder-controlled secret custody, separate from website operation. These are operational dependencies, not website analytics services. Providers may handle their own technical and security information under their applicable terms. Exact processing locations and contractual disclosures remain subject to publication review.
Enquiries are used for correspondence. Google-derived information is used to authorize the Founder, verify the destination, transfer approved encrypted artifacts, check integrity and verify recovery. It is not used for advertising, profiling, selling information or training generalized AI or machine-learning models.
Vorelia Backup Recovery’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Access and use are limited to the authorized operator and necessary provider processing for this workflow. No customer-facing Google access is offered.
Information may also be disclosed where required by law or necessary to address security incidents and protect legal rights. This policy does not certify provider-wide compliance, establish contractual processor roles or promise processing in a particular country.
6. Retention and deletion
Enquiry information and related records are kept according to their purpose: responding to correspondence, relevant recordkeeping, security and applicable legal obligations. No fixed general retention period is promised. Hosting and email providers may retain separate technical or correspondence records; final provider practices remain to be confirmed for publication.
The approved backup retention policy is 30 daily, eight weekly and 12 monthly recovery points, subject to protected and held recovery-point constraints. Selections can overlap. Held snapshots, separately protected key material and the last two verified recovery points are protected by the planning rules. Automated enforcement and remote deletion are not active. Existing copies require deliberate operator review; this is not a promise that a copy disappears on a fixed date.
Downloaded and decrypted recovery material is temporary verification material. The accepted controlled test verified cleanup of its downloaded artifacts and disposable local database. Failed or uncertain cleanup requires operator review; no universal or instantaneous deletion guarantee is made. Original encrypted recovery points and non-secret verification evidence can remain after a drill.
Removing Google authorization prevents future authorized access but does not automatically delete files in Drive, local archives or operational reports. The operator must review those copies separately. Restoring access requires an explicitly authorized consent process.
Staging preserves issued/submitted check-ins, answers and related history using integrity protections. Requests affecting those records require review of applicable purposes, obligations and technical constraints. A deletion request is not a promise of immediate erasure from every active record, backup or provider system.
7. Security and requests
The backup workflow uses access restrictions and local encryption, but no system guarantees absolute security or successful future recovery. Report concerns to contact@getvorelia.com without credentials or sensitive records.
You may contact us about information you supplied, request access or correction, or request deletion, subject to identity verification and applicable obligations. Rights, response requirements and legal disclosures depend on the people served and relevant law and remain subject to legal review before publication. This policy does not establish new universal rights, deadlines or deletion guarantees.
The authorized Google account holder can review or revoke access through Google Account permissions at myaccount.google.com/permissions. Revocation can prevent future backups; it does not separately delete stored copies.
8. Audience and updates
This informational site is directed to independent adult fitness coaches. It is not designed to collect information from children, and the internal utility is not offered to children. Contact us if you believe a child supplied personal information so it can be reviewed.
Material changes to collection, Google access, providers or service availability require policy review. The effective date is shown in this policy.