Privacy Policy

Effective date: October 2, 2026

SpacesOS Inc. operates Valora and the website at valorahq.com (the "Site"). This policy explains what information we collect on the Site, how we use and share it, and how to ask us about your data. The Site is intended for people in the United States. Valora provides educational content and an inquiry route; it is not a registered investment adviser. Submitting a request does not establish an adviser-client relationship. We are not arranging advisor matches or introductions at this time.

Information you provide

When you use an inquiry form on the Site, we collect the information you enter. The inquiry form (the popup, and the /#contact form) sends your name, email and any phone number you enter when you select "Send my inquiry" on the first screen. This sends an inquiry even if you do not complete the later screens. You can then add how you heard about us, an estimated investable asset range and an optional note. If you add these details and select "Finish", the form sends a second submission. If you leave those details blank, "Finish" shows the receipt without sending another submission. The inquiry form at /find-your-advisor/ also asks for your role, primary goal, investable assets, city, biggest money question and, if provided, timing, followed by contact details. We record source or campaign information from the page or link that brought you to the form. If you email us, we keep your address and correspondence.

Please do not enter Social Security numbers, account numbers, passwords, or detailed financial statements. A range and a short description of your situation are enough for an initial inquiry.

How a request reaches us

Our Site sends form submissions through a Google Apps Script to an internal Google Sheet called "Valora Leads (Organic)." We use the Sheet to review and follow up on requests. Each submitted request is recorded and emailed separately: each submission generates an alert email containing the fields sent and a confirmation email to the address entered. Completing both sends in the multi-step form therefore generates two records and two sets of emails. A Notion copy may be created by a best-effort sync. These are not Google Forms; the forms are built into the Site.

The Sheet is owned by Bhavya Barot at barot@valorahq.com. The current submission alerts go to that address and to brands@grow.surgeaio.com, an external agency inbox. That agency address receives the information in the alert email, including your form answers and contact details. The Sheet is not generally shared, but a person with an email or Notion copy can access the information in that copy. We will update this description if the agency recipient is removed from the live notification flow.

Why we use your information

We use request information to confirm receipt, review your question, contact you about your request and email next steps. We do not currently arrange advisor introductions or provide personalized investment advice. We also use information to operate and secure the Site, maintain records, understand usage, and meet legal obligations. A confirmation email means the system recorded a submission; it does not mean an advisor has reviewed or accepted it. We do not promise a particular response time in this policy.

Valora follow-up is separate from advisor sharing. Your request lets Valora contact you about that request. It does not authorize us to send your form answers to an advisor, and we are not making advisor introductions today. The current form has no separate advisor-sharing consent checkbox. Our team holds identifiable request information from advisor forwarding. If a referral service is considered in the future, it will require legal review and a separate, unchecked choice through which you affirmatively authorize sharing with a specifically named advisor; a current inquiry alone will never be treated as that choice. This is a manual hold, not an automated consent system.

Information collected automatically

PostHog processes Site usage data, such as pages viewed, clicks and other interactions, the text of elements you click, referrals, approximate location inferred from IP, and device or browser details. PostHog also records sessions, which can include replays of what appears on the page as you use it, with form fields you type into masked. It may use first-party cookies or browser storage to recognize a returning visitor. RB2B may identify the company associated with a business visit and may process information that identifies an individual using its own data and identifiers. Our hosting and security providers process technical requests and logs. See the Cookie and Analytics Notice for details. At present, analytics and visitor-identification tools may run when the page loads, before any cookie-consent choice. Browser settings can limit cookies or storage, but some Site features may not work as intended.

On the reviewed guide and calculator pages, the Valora conversation guide sends your question and the page path to Valora's server to select from reviewed answers. It does not send that question to Gemini or another model provider. PostHog and RB2B run on these pages as described above, including before any cookie choice. Because PostHog records sessions, what appears on the page, including your question and the guide's answers, may be included in session recordings. Text you type into form fields is masked, but please do not enter personal or private information in the guide. A short-lived signed token keeps the current conversation context; it does not contain your question, contact details or an identifier for you. Closing or reloading the conversation clears its browser state. To limit abuse, the guide uses a hashed form of your IP address for rate limiting, and those records expire automatically after 24 hours. Our hosting and security systems may still process technical requests and logs.

Sharing and service providers

We share information with service providers who help operate the Site and process requests, including our hosting provider, Google for Apps Script, Sheets and email, Notion where a copy sync succeeds, PostHog for analytics and session recording, and RB2B for business visitor identification. The current external agency alert recipient is identified above. We may disclose information when required by law or to protect rights and safety, and information may transfer in a business transaction subject to applicable law. We use RB2B for business visitor identification as described above; its data practices may be governed by its own policy. We are checking our vendor settings and applicable state-law classifications before making any categorical statement about sale or cross-context sharing. We are not making advisor introductions today. Any future identifiable sharing with a named advisor would require legal review and separate affirmative permission; the proposed unchecked checkbox is not yet live.

Retention, access and deletion

There is currently no automatic deletion of lead records. Form information may remain in the Sheet, alert and confirmation emails, and a Notion copy if the sync succeeds. We keep it while needed to respond, administer the service, handle disputes or meet legal obligations; analytics retention is set in the analytics tools. To request access, correction or deletion, email barot@valorahq.com. We may ask you to verify your identity. Deletion is handled manually across the Sheet and copies in email and Notion, subject to records we must keep by law or for legitimate disputes. We respond to verified requests within deadlines required by applicable law.

Depending on your state, you may have rights to know, correct, delete, obtain a copy of, or restrict certain uses of your personal information, and to appeal a decision. We will not discriminate against you for exercising applicable rights. Contact us at the address above to make a request or ask how a right applies. We do not currently respond to browser Do Not Track signals.

Security, children and visitors outside the United States

We use reasonable administrative and technical safeguards and limit access to people who need it, but no method of storage or transmission is completely secure. The Site is meant for adults, not children under 13. If you believe a child sent us information, contact us so we can address it. Visitors outside the United States should know their data may be processed in the United States and other countries where service providers work.

Changes and contact

We may update this policy and post a revised effective date. For privacy questions and requests, email barot@valorahq.com.