Privacy Policy

Last Updated: 27 July 2026

Welcome to Wora ("Wora," "we," "us," or "our"), a hydration and wellness brand developed and operated by Convasio Studio. This Privacy Policy explains how we collect, use, disclose, and protect your information across:

• the Wora mobile application ("App"), an AI-powered hydration and habit-building tool; and
• the Wora website and online store, powered by Shopify, where you can browse and purchase Wora-branded products and merchandise (together with the App, the "Services").

If there is a conflict between our Terms of Use and this Privacy Policy regarding the collection, processing, or disclosure of your personal information, this Privacy Policy will govern.

By accessing or using the Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services.

If you have any questions about this Privacy Policy or our privacy practices, please contact us at hi@drinkwora.com or at the address provided in the "Contact Us" section below.

Information We Collect

The information we collect depends on whether you're using the App, the store, or both.

Account Information (App)

If you create an App account or sign in via a supported provider (such as Google or Apple), we may collect your name, email address, profile picture (if provided by your sign-in provider), account identifier, and username (if set for social features).

Hydration & Activity Data (App)

To provide the App's core services, we collect information you generate while using it, including water intake entries and timestamps, daily hydration goals and glass size preferences, reminder schedules, streaks, achievements, badges and Wora Points, habit history and statistics, challenge participation, AI verification results, and app settings.

Camera and Photo Data (App)

The App uses your device camera to verify hydration events through AI-powered image analysis.

• When you log a drink, the photo you capture is sent to a third-party AI image-analysis provider solely to assess whether the image is consistent with a genuine drinking action.
• Verification photos may be retained to power your history and streaks, and — if you use social features — to display in your activity feed to friends you're connected with.
• We do not use verification photos for facial recognition, biometric identification, or any purpose beyond hydration verification, your own history, and features you've explicitly enabled.
• You can disable photo-based verification in your settings, subject to feature availability.

Social and Friends Data (App)

If you use social features, we collect your friend connections, activity you share to your feed (logs, streaks, achievements, photos), reactions and comments, and leaderboard/challenge participation and rankings. This may be visible to connected friends or, for public leaderboards and challenges, other participants.

Contact and Order Information (Store)

When you shop with us, we collect your name, billing and shipping address, phone number, and email address; and transaction information such as items viewed, added to cart or wishlist, purchased, returned, or exchanged, and your order history.

Financial Information (Store)

We (via our store's payment processing infrastructure) collect payment card or other financial account information, transaction details, form of payment, and payment confirmation needed to process your order. We do not directly store your full card details.

Store Account Information

If you create a store account, we collect your username, password, and account preferences and settings.

Communications

Whenever you contact us — for App support or store customer service — we collect the content of that communication and your contact details.

Device & Technical Information

Across both the App and the store, we automatically collect technical information including device model and identifiers, browser and operating system information, IP address, network information, and usage information (how and when you interact with the Services), along with crash reports, performance diagnostics, and anonymous or pseudonymous analytics.

Permissions We Request (App)

Depending on how you use the App, we may request access to:

• Notifications – to send hydration reminders.
• Camera – to capture photos for AI drink verification.
• Photo Library – where applicable, to select an existing image for verification.
• Internet Access – to synchronise your account and provide cloud services.

You may revoke permissions at any time through your device settings, though some features may no longer function correctly without them.

Sources of Personal Information

We may collect personal information:

• Directly from you — when you create an account, use the App or store, place an order, or contact us.
• Automatically — through your device or browser as you use the Services, and through cookies and similar technologies on the store.
• From service providers — engaged to enable technology (e.g. payments, hosting, analytics) who collect or process information on our behalf.
• From partners or other third parties, where applicable.

How We Use Your Information

We use your information to:

• Provide, operate, and improve the App and store.
• Perform our contract with you — process payments, fulfil orders, arrange shipping, and facilitate returns or exchanges (store).
• Synchronise your App account and data across devices, deliver hydration reminders, generate insights, streaks and achievements, verify hydration events via AI, and power social features (App).
• Create and manage your account(s), remember your preferences, and tailor your experience, including product recommendations (store).
• Process subscriptions and purchases.
• Send you service-related communications, and — where you've consented or as permitted by law — marketing, promotional, and advertising communications, including showing you ads for products based on your past purchases or cart activity (store only; the App does not use your data for advertising and does not display third-party ads).
• Authenticate accounts, secure our Services, and detect, investigate, or act on fraudulent, abusive, or illegal activity, including attempts to manipulate AI verification, points, or leaderboards.
• Provide customer support and respond to your communications.
• Comply with applicable law, respond to legal process, and enforce our terms and policies.

We do not sell your personal information. The App does not use your hydration or verification photos, or any App activity data, for advertising.

Subscriptions and Payments (App)

Premium App subscriptions are sold through, and processed by, the Apple App Store and Google Play Store. Subscription management, including localisation, pricing, introductory offers, and receipt validation, is facilitated by a third-party subscription management platform acting on our behalf. We do not receive or store your full payment card details; renewals, cancellations, and refunds are handled by the relevant app store.

Analytics

We may use privacy-focused analytics and crash reporting to understand how the Services perform and to identify technical issues. These may collect anonymous or pseudonymous technical information such as crashes, device type, OS version, and feature usage.

Data Storage and Security

Your account and activity data are securely stored using third-party infrastructure providers to enable backup, sync, and (for the App) social features. We use safeguards including encryption in transit, secure cloud infrastructure, access controls, hashing of sensitive authentication data where applicable, and regular security monitoring. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. We recommend not using unsecured channels to send us sensitive information.

How We Disclose Your Information

We disclose information only where necessary, including:

• Service providers who help us operate the Services, including providers of backend database and data synchronisation infrastructure, AI-powered photo verification, subscription and purchase management, push notification delivery, authentication, payment processing, order fulfilment and shipping, and analytics/crash-reporting. A full list of the specific providers we use is available on request by emailing hi@drinkwora.com.
• Our e-commerce platform provider (Shopify) and its partner network, who host and power our store — see "Relationship with Shopify" below.
• Other users, where you use App social features — your shared activity, photos, and profile information may be visible to connected friends or, for public leaderboards/challenges, other participants.
• Business and marketing partners, to provide advertising related to store purchases, where required by law only with your consent or where you have not opted out.
• Affiliates or our corporate group, where applicable.
• In connection with a business transaction, such as a merger, acquisition, or asset sale — we'll provide notice where required.
• Legal and safety recipients — see "Legal Requirements" below.

These providers are contractually required to protect your information and may only use it to provide services to us. We do not sell or rent your personal information for third parties' own marketing purposes.

Relationship with Shopify

Our store is hosted by Shopify, which collects and processes information about your access to and use of the store in order to provide and improve it for us. Information you submit to the store will be transmitted to and shared with Shopify, and with third parties that may be located outside your country of residence, to provide and improve the store. Shopify may also use data from your interactions with our store, alongside other merchants and with Shopify generally, to provide us with certain enhanced features (for example, fraud prevention and analytics). In these circumstances, Shopify is responsible for the processing of your personal information for those purposes, including responding to related requests. You can learn more, and exercise certain rights, via Shopify's Consumer Privacy Policy and Privacy Portal, both linked at shopify.com.

International Data Transfers

Some of our service providers, including Shopify and our App infrastructure and AI providers, may process your information outside your country of residence, including in the United States. Where we transfer personal data out of the UK or EEA, we rely on recognised transfer mechanisms such as the UK and EU Standard Contractual Clauses, or transfers to countries recognised as providing an adequate level of protection.

Legal Requirements

We may disclose information where required by law, court order, or governmental authority, or where necessary to comply with a legal obligation, protect our legal rights or property, investigate fraud or misuse, or protect the safety of users or others.

Data Retention

We retain your information only as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. If you delete your App account, we will delete or anonymise your personal information within a reasonable period, except where legally required to retain records or where App content has already been shared with other users via social features.

Your Rights and Choices

Depending on where you live, you may have the right to:

• Access / Know — request access to, or a copy of, the personal information we hold about you.
• Delete — request deletion of your personal information.
• Correct — request correction of inaccurate information.
• Portability — receive your data in a portable format, or have it transferred to a third party, in certain circumstances.
• Manage communication preferences — opt out of promotional emails at any time via the unsubscribe link; we may still send non-promotional emails about your account or orders.
• Restrict or Object to Processing and Withdraw Consent (UK/EEA) — as described below.

Requests may be submitted to hi@drinkwora.com. We may verify your identity before responding, and you may designate an authorised agent to act on your behalf, subject to proof of authorisation. We will not discriminate against you for exercising these rights, and we will respond within the timeframe required by applicable law.

GDPR (European Economic Area & United Kingdom)

If you're located in the UK, EU, or EEA, you have the rights above, plus the right to object to processing, restrict processing, withdraw consent (without affecting the lawfulness of prior processing), and lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). For the EEA, a list of supervisory authorities is available from the European Data Protection Board.

AI-based drink verification (App) is automated processing used to support your own accountability. It does not produce a legal or similarly significant effect on you, and you may always review or dispute a verification result, or disable photo verification in settings.

For the purposes of applicable data protection law, we are the data controller of your personal information, except where Shopify acts as controller for the store-related processing described above.

California Privacy Rights (CCPA/CPRA)

If you're a California resident, you have the right to know what personal information we collect and why, access specific pieces of it, request deletion (subject to exceptions), correct inaccurate information, opt out of the "sale" or "sharing" of personal information, and not be discriminated against for exercising these rights.

Wora does not sell personal information. Our store, through Shopify's advertising features, may "share" certain information (such as browsing or purchase activity) with third parties to support personalised advertising across merchants, which can constitute "sharing" under the CCPA/CPRA. You may opt out of this via Shopify's targeted advertising settings or by contacting us. The App does not share or sell information for advertising purposes. As of this policy's effective date, we have no actual knowledge that we sell or share the personal information of individuals under 16.

You may exercise these rights by contacting hi@drinkwora.com.

Complaints

If you have complaints about how we process your personal information, please contact us using the details below. Depending on where you live, you may have the right to appeal our decision, or lodge a complaint with your local data protection authority.

Children's Privacy

The Services are not intended for children under the age of 13 (or the applicable age of majority/minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you're a parent or guardian and believe a child has provided us with personal information, please contact us and we will investigate and remove it.

Third-Party Services and Links

The Services integrate with trusted third-party providers as described above, and the store may link to third-party websites or platforms not operated by us. We are not responsible for the content, privacy practices, or security of any third-party sites or services — review their own policies before engaging with them.

Changes to This Privacy Policy

We may update this Privacy Policy periodically, including to reflect changes in our practices or for legal or operational reasons. We will post the revised policy here, update the "Last Updated" date, and provide notice as required by applicable law. Continued use of the Services after changes take effect constitutes acceptance of the updated policy.

Contact Us

Should you have any questions about our privacy practices or this Privacy Policy, or wish to exercise any of your rights, please contact us:

Email: hi@drinkwora.com Address: 61 Tower Street, Pontypridd CF37 1NR, United Kingdom