Last updated: 4 Nov 2026
Privacy Policy
Valdorro is operated by Rapid Flow Automation. This policy explains what we hold about you, who else touches it, and how to get it back or get it deleted.
The short version
Your idea is encrypted in transit and at rest, and it is used only to write your report. It is never sold. The AI that writes your report never trains on it. A short part of it — the title and the first 300 characters — is sent to a web search service to find evidence, and that service’s own policy lets it learn from search queries.
Bibhash Roy, who runs Valdorro, can see your idea, and uses that access to run the beta: to fix things when they break and to answer your questions.
You can delete any idea yourself, whenever you want. Deleting erases its content; only the title and a record of the run — when it ran, what it cost, and the verdict and score it got — are kept. Copies already sent to Anthropic and Exa are outside Valdorro’s control.
What we collect
We collect what the product needs to run and nothing beyond it. There is no advertising profile, no behavioural tracking, and no sale of data to anyone.
- Account
- Email address, supplied through Clerk when you create your account.
- Founder profile
- Your onboarding answers — commitments, abandonment patterns, tech stack, channels, kill triggers, buildability threshold.
- Ideas and reports
- The idea text you submit, plus every interrogation output, verdict, test result and report generated from it.
- Feedback
- Your beta feedback answers — ratings, whether you'd pay, and any comment or idea you attach to it.
- Credits and purchases
- Your credit ledger, including credits granted for invite activation and feedback, and — once purchases resume after the beta — a record of each purchase (amount, currency, date, Dodo transaction reference).
- Usage telemetry
- Model, token counts and cost per AI call, so runs can be metered and spend can be capped.
- Diagnostics
- Error reports captured when something fails, including the failing route.
We use Vercel Web Analytics to count visits. It records anonymous page views, not who you are.
Beta seat requests
When you ask for a beta seat on valdorro.com, we store your name, your email address, your one-line idea if you give one, which form you used, where the link you followed came from, and when. Your IP address is used only to stop automated sign-ups, as a one-way scrambled code, and deleted within a day; it is not stored with your request. We use these details only to reply about your seat and to send your invite. They are not sent to the AI or to web search. The confirmation email is sent through Resend, which receives your name, email address and idea to deliver it. Bibhash is also sent an email about each request, with your name, email address and idea. It arrives in a mailbox hosted by Hostinger and is forwarded to the Gmail account Bibhash reads, so Hostinger and Google also receive these details. If you tick the newsletter box, we also store when you ticked it, and your email address is added to the Rapid Flow Automation newsletter, which is run on Beehiiv under its own privacy policy; you can unsubscribe from any issue. If you don't tick it, you are never added to any mailing list. If you write to support@valdorro.com instead, your email arrives in a mailbox hosted by Hostinger and is forwarded to the Gmail account Bibhash reads, so Google also receives it. bibhash@valdorro.com, which sends the confirmation, reaches the same mailbox. We keep a request for 180 days after your last one, then delete it. Write to support@valdorro.com to delete it sooner.
Payment data
Purchases are switched off during the beta — every credit is granted, not bought. Dodo Payments is the merchant of record for when purchases resume: card numbers, bank details and billing addresses will go directly to Dodo and be handled under their policies. Valdorro never sees or stores your card details. What we would receive back is a confirmation that a purchase succeeded, the amount, and a transaction reference used to credit your account and answer billing questions.
How AI processing works
Your idea text, founder profile and prior layer outputs are sent to Anthropic, whose models write your interrogation report. That is the only purpose those requests serve, and Anthropic does not train on them.
To find market evidence, your idea’s title and the first 300 characters of its description are sent to Exa as a web search query. Nothing else from your idea, profile or report goes to Exa. Exa’s own policy allows it to use query data to improve and train its models.
Your ideas are not shown to other users. Aggregate, non-identifying counts — how many runs happened, how many tokens they cost — are used to operate and price the service.
How we protect it
- In transit
- TLS 1.2 or better between your browser, Valdorro and every service we use.
- At rest
- AES-256 encryption on the database, applied by Supabase to the whole volume.
- Isolation
- Every query the application makes is scoped to your account, and that scoping is covered by a test suite that runs against a live database.
What that does not mean: it is not end-to-end encryption. Your idea arrives readable at Anthropic, and in part at Exa, because a model cannot score text it cannot read and a search cannot run on it either. That is unavoidable in a product of this kind, and we would rather name it than let “encrypted” imply otherwise.
Who can see your idea
- Not other users. Ever.
- No staff can see it: Bibhash is the only person with access.
- Anthropic receives your full idea to write your report, and does not train on it.
- Exa receives your idea’s title and the first 300 characters of its description as a search query. Its own policy allows it to train on query data.
- Bibhash Roy, who runs Valdorro, can see your idea. He has administrative access to the database and uses it to run the beta — to diagnose failures and answer support questions. The admin screens inside the product do not show your description, your origin context or your report — but direct database access exists and is not technically restricted.
We disclose this because the list of companies below would otherwise read as the complete set of parties who can see your idea, and it is not.
Who processes your data
These are the sub-processors Valdorro relies on. Each one receives only the data its function requires.
- Clerk
- Authentication and account identity.
- Supabase
- Postgres database hosting for all account and idea data.
- Anthropic
- AI models that write your interrogation report and verdict. Receives your full idea; does not train on it.
- Exa
- Web search for market evidence. Receives your idea's title and the first 300 characters of its description as a search query; its own policy allows it to train on query data.
- Dodo Payments
- Merchant of record for purchases (checkout, tax, invoices) — currently inactive, since purchases are disabled during the beta.
- Resend
- Sends Valdorro's emails: reminder emails to signed-in users, the beta-seat confirmation, and an email to Bibhash for each seat request. Receives each recipient's email address and the content of the message, which for seat requests includes the name and idea you gave.
- Beehiiv
- Newsletter platform for the Rapid Flow Automation newsletter. Receives your email address only if you tick the newsletter box on the beta-seat form.
- Sentry
- Error monitoring and crash diagnostics.
- Vercel
- Application hosting, edge delivery, and request logs.
- Cloudflare
- DNS and network protection in front of our authentication provider.
- Hostinger
- Email hosting for support@valdorro.com, through which every data request and account-closure request passes.
Where your data lives
Valdorro runs entirely on cloud infrastructure. The primary database is hosted in the Asia-Pacific region (ap-southeast-1); application and AI requests are served from our providers’ regions, which include the United States and the European Union. Using Valdorro means your data is transferred across those regions.
Deleting an idea
Deletion happens in two steps, on purpose.
- Move to bin. The idea leaves your workspace and sits in your bin. Nothing is destroyed. You can restore it at any time. Items stay in the bin until you act — there is no automatic clear-out after 30 days or any other period.
- Delete permanently. From the bin, and only from the bin. You type DELETE to confirm. This cannot be undone.
What permanent deletion destroys: your description, your origin context, everything the five interrogation layers wrote, the reasoning behind your verdict, your report, and any test-result evidence you recorded. All of it is overwritten in the database. It is not recoverable, by you or by us.
Copies already sent to Anthropic to write your report, and the search query already sent to Exa, are outside Valdorro’s control. Deleting the idea cannot recall them.
What survives, and why: the idea’s title, the fact that an interrogation ran, when it ran, what it cost, and the verdict it got (Kill, Pivot or Prove) with its score. We keep the title so we can answer you if you ask about a deleted idea, and we keep the cost record because it belongs to your billing history. Nothing else remains.
If you want the title gone too, ask us to close your account.
How long we keep it
Your ideas and reports are kept for as long as your account exists, because your idea history is the product. You can delete any of them yourself at any time using the steps above.
Backups. Our database provider takes routine backups. A deleted idea may persist in a backup snapshot until that snapshot expires under the provider’s retention schedule, which we do not control. We do not restore backups to recover deleted content.
Closing your account. Email support@valdorro.com. We will delete your personal data and all idea content, including titles. Account closure is currently handled by hand, not by an automated process, and we will confirm to you when it is done. Purchase records are retained where tax and accounting law requires it.
Your rights
Under India’s Digital Personal Data Protection Act, 2023, and — if you are in the EU or UK — under the GDPR, you can ask us for:
- a copy of the data we hold about you
- correction of anything inaccurate
- an export of your ideas and reports
- erasure of your account and its contents (DPDP section 12, GDPR Article 17)
- withdrawal of consent to processing
Email support@valdorro.com. We aim to respond within 30 days and will tell you if anything must be retained for legal reasons.
Changes to this policy
If this policy changes materially we will update the date at the top and notify you in the app before the change takes effect.
Contact
Privacy questions, data requests and account deletion: support@valdorro.com.