Vizora Approvals — Privacy Policy

Last updated: 14 June 2026 · Vizora Ltd

This policy explains how the Vizora Approvals mobile app ("the app") handles personal data. Vizora Approvals is a business-to-business application: organisations ("customers") provision it for their staff to review and approve documents such as purchase orders, invoices and expense claims. For data their users process through the app, the customer organisation is the data controller and Vizora Ltd acts as a data processor on their behalf.

Who we are

Vizora Ltd ("Vizora", "we"). Contact: privacy@vizora.com.

Information we process

Account & identity — when you sign in with your organisation's Microsoft 365 account, we receive your name, email address and a Microsoft user identifier (object ID). We do not receive or store your Microsoft password.
Device information — a device identifier and, if you enable notifications, a push notification token, so we can deliver approval alerts to your device.
Approval content — the documents routed to you for approval and the decisions (approve/reject, comments, timestamp) you record. This data belongs to your organisation.
Technical logs — basic operational logs (e.g. request times, errors) used to run and secure the service.

The app does not use your photos, contacts, precise location, or microphone. Face ID / biometric checks are performed on your device by the operating system; the app only receives a pass/fail result and never your biometric data.

How we use it

To authenticate you, show the approvals assigned to you, record your decisions back to your organisation's system, send approval notifications, and operate and secure the service. We do not use your data for advertising, and we do not sell personal data.

Sub-processors

Microsoft Azure — hosting and database (data held in our customer's data warehouse).
Microsoft Entra ID — sign-in / identity.
Expo push service — delivery of push notifications (Apple APNs / Google FCM).

Data retention

Account and approval data is retained for as long as your organisation uses the service, or as required for audit, after which it is deleted or anonymised. Operational logs are kept for a limited period.

Deleting your account and data

You can delete your account from within the app at Account → Delete account. This removes your personal data and devices; approval history may be retained in anonymised form for audit. Your organisation's underlying Microsoft 365 account is managed by them and is not affected. You may also contact us at privacy@vizora.com to request deletion.

Security

Data is encrypted in transit (HTTPS/TLS). Tokens are stored in the device's secure keystore. Each customer's data is isolated in its own database. Approve/reject actions can require a device biometric check.

Children

The app is a workplace tool intended for adults and is not directed at children.

Your rights

Depending on your location you may have rights to access, correct, or delete your personal data. As this is a workplace tool, please raise such requests with your organisation (the data controller) or contact us and we will assist them.

Changes

We may update this policy; material changes will be reflected by the "last updated" date above.