Privacy notice
Last updated: October 28, 2026
This notice explains what information Provaris collects, why, who else handles it, and what you can ask us to do. Provaris is a product of Gorsar Technologies, a DBA of Gorsar Enterprises LLC, Indiana, United States ("Gorsar", "we"). For anything about privacy, write to info@gorsar.io.
Provaris is offered to businesses in the United States and Canada (outside Quebec). We do not yet offer it elsewhere. This is an early-stage product, and we will update this notice as it changes.
Two different relationships
- Visitors and prospects: people who visit our website, ask for a demo, or write to us. For this information, Gorsar decides what is collected and why.
- Customer firms and their people: a firm that uses Provaris puts its own information, including information about its clients and staff, into Provaris. For that information the firm decides what goes in and why, and Gorsar handles it on the firm's behalf, under the firm's agreement with us. If you are a client or employee of a Provaris customer and have a question about your information, ask that firm first. If you ask us, we will pass the request to the firm unless the law says otherwise.
What we collect from visitors and prospects
| What | Where it comes from | What we use it for | Where it is kept |
|---|---|---|---|
| Name, work email, company, company size, and what you hope to solve (optional) | The "Book a demo" form | To reply and arrange a demo | Emailed to our sales mailbox; see the email rows below |
| How you found us (optional), and the campaign tags of the link you came from (such as utm_source) | The "Book a demo" form, and the link you clicked | To see which channels work | Emailed to our sales mailbox with the demo request, and in our email delivery provider's copy. It is not stored in the Provaris database |
| Name, email, company (optional), message | The contact forms on our sites | To reply | Emailed to our contact mailbox |
| Name, email, company (optional), what is stuck, and roughly how much has been spent (optional) | The "Help my stalled build" form | To reply and assess whether we can help | Emailed to our rescue mailbox |
| A scrambled (hashed) version of your IP address | Every form submission | To limit repeated submissions and block automated abuse. It is not saved with your message | Server memory only; it is lost when the server restarts |
| An email record: which of our mailboxes it went to, which form, whether it was delivered, any error, the time | When we send the notification of your message | To show an email was sent and find failures | Our database. It holds nothing you typed |
| Your message itself | The email we send to our mailbox | To read and answer you | Our email mailbox, and a copy held by our email delivery provider |
| Technical data your browser sends to our host (IP address, browser type, page requested, time) | Visiting the site | Delivering the site and keeping it running | Our hosting provider's logs, kept for the period set by the provider |
The page, the site that sent you, campaign tags, the approximate place, your browser, operating system and device, and a random code in the _ga cookie. Only if you choose "Accept analytics" |
Visiting our public pages (home page and "Book a demo") | To learn which pages and campaigns work | Google Analytics, with Google (see "Visit statistics" below) |
If you accept analytics, we count visits to this website with Google Analytics (described below). We do not use advertising cookies or tracking pixels. We add no other tracking script to the site.
Cookies and similar storage
- Sign-in. When a customer user signs in, our authentication provider sets cookies that keep them signed in. They are necessary for the service to work.
- Customer portal. The client portal sets two cookies that remember which client's portal is open.
- Preferences and work in progress. Your browser's local storage keeps settings such as light or dark display and how you last viewed a list, plus some working data so it survives a page reload: a running timer and its note, recently used projects, and AI-written talking points you generated. It stays on that device until it is cleared.
- Visit statistics, only if you accept. Google Analytics sets two cookies from our own site,
_gaand_ga_followed by a code for our account. They last up to two years. - Your analytics choice. Your choice is kept as one short note in your browser's local storage. If you decline, that note is all we store.
We do not set cookies for advertising. The public website's fonts are served from our own site; the exception is the signing page for e-signatures (see Google Fonts below).
Visit statistics
We count visits to our public pages (the home page and "Book a demo") with Google Analytics, a service of Google LLC. It runs only if you choose "Accept analytics" in the notice at the bottom of the page. If you decline, or do nothing, it does not load and nothing about your visit is sent to Google. It is not used on the sign-in page or on pages you reach after signing in.
If you accept, Google Analytics sets two cookies in your browser, _ga and _ga_ followed by a code for our account. They hold a random identifier that lets it recognise your browser on later visits and tell one visit from the next. They last up to two years. For each page view it records the page, the site that sent you, any campaign tags in the link (such as utm_source), the approximate place it works out from your connection, and your browser, operating system and device. It also records when you click a link that leads to another website. Google says Google Analytics does not log or store IP addresses. We also count a few actions, such as sending the demo form. We do not send your name, email or message to Google. Because it recognises your browser over time, this is personal information about your visits, although we do not know who you are.
We have switched off the Google settings that would let Google use this data for its own products, for advertising or to follow you across devices: Google signals and data sharing are off, and Google Analytics is not linked to any advertising account. We use the counts to learn which pages and campaigns work and to improve this site, not to target advertising at you.
Google may process the data in any country where it or its service providers have facilities. To read how Google uses information from sites that use its services, see How Google uses information from sites or apps that use our services.
Google keeps the detailed visit records for two months, by a setting we chose. Summary reports, which are totals and do not show individual visits, are not affected by that setting.
Because the visit data is tied to a random code in your browser and not to your name, we may not be able to find one person's visit data. If you want counting to stop, choose "Decline" (below), which removes the two cookies from your browser.
Your choice. Nothing is counted unless you accept. You can change your mind at any time with "Cookie choices" at the bottom of our public pages: choosing "Decline" removes the two cookies from your browser and stops counting. We do not ask again for 12 months. Each of our websites asks separately. You can also install Google's browser add-on that turns off Google Analytics on every site you visit.
Questions: info@gorsar.io
Where you found us
When you ask for a demo, we ask, optionally, how you found us. The answer is free text of up to 200 characters, so please do not include sensitive details. We send your answer and the campaign tags of the link you came from to our sales team by email, with the rest of your demo request, and keep them with it as described under "How long we keep information". We use them to see which channels work. We never send your answer to Google. If you accept analytics, Google Analytics does see the campaign tags in the link you clicked, as described under "Visit statistics".
What customer firms put in Provaris
A firm using Provaris decides what to enter. Typically this includes its staff's names, work emails and roles; its clients' names and contact details; projects, time entries, expenses, invoices and documents it uploads; and payment details if the firm chooses to use them. We handle that information to provide the service the firm signed up for, and not for our own marketing or for sale.
AI features
Provaris has AI features, for example extracting requirements from notes or summarising project information. When a user uses one, the text the feature works on is sent to an AI provider and the answer comes back. The provider depends on the firm's configuration and may be OpenAI, Anthropic, Google or xAI. Those companies process the text under their own terms. As of 28 October 2026, OpenAI, Anthropic and xAI (whose pages now also use the name SpaceXSI) each say that, by default, they do not use API inputs or outputs to train their models unless the account holder opts in or gives permission. Google's terms for its Gemini API differ by plan: for paid use, Google says it does not use prompts or responses to improve its products; for unpaid use, it says it may, and people may review them. Retention differs: OpenAI keeps abuse-monitoring logs for up to 30 days, xAI keeps requests and responses for 30 days, Anthropic's depends on the model and feature, and Google logs prompts and responses to detect misuse and may store them in any country. These are the providers' statements, not ours, and they can change. Do not put information into an AI feature that you are not allowed to share with those providers. A firm cannot yet switch AI features off for its own account; if that matters to your firm, write to info@gorsar.io before you start.
Who else handles information
These companies handle or receive information as part of running Provaris. The list is complete as far as we know at the date above; if we add one, we will update this notice.
| Company | What for |
|---|---|
| Supabase | Database, sign-in and file storage for Provaris |
| Vercel | Hosting the website and the application |
| Resend | Sending email from Provaris, including the form notifications above |
| Zoho | The mailboxes that receive form messages |
| Stripe | Taking payment, for firms that use payments in Provaris. Stripe's own notice applies to card details |
| OpenAI, Anthropic, Google, xAI | AI features, only when a user uses one (see above) |
| Cal.com | Booking the demo call, if you choose a time after sending the Book a demo form |
| Visit statistics on our public pages (Google Analytics), only if you accept | |
| Google Fonts | Handwriting-style fonts on the signing page, which sends the signer's IP address to Google, and a font in documents we generate |
Supabase, Vercel, Resend, Stripe, Cal.com, Zoho (for Zoho Mail), OpenAI, Anthropic and xAI each publish that they hold a SOC 2 Type 2 report of their own. Those reports cover the provider's service, not Provaris, which does not hold one.
If a firm connects Slack, Salesforce or Jira, Provaris sends that firm's chosen information to the firm's own account with that service.
We may disclose information if the law requires it, to protect our rights and the safety of others, or in a sale or merger of the business (we would ask the buyer to keep to this notice).
Resend says it holds stored email data in the United States.
These providers work in the United States and may work in other countries. Information about people in Canada may therefore be processed outside Canada, including in the United States, and be accessible to courts and authorities there. Visit statistics, if you accept them, are processed by Google in the same way.
How long we keep information
- Form messages and their email records: for as long as we need them to deal with your request and any follow-up with you. We delete them from our mailbox and database when you ask, unless the law requires us to keep a record. Our email delivery provider keeps its copy for its own period.
- Visit statistics: Google keeps detailed visit records for two months. Summary reports are not affected by that setting.
- Customer firm information: for as long as the firm's account is active. When the agreement ends, or when the firm asks, we delete the firm's information within 30 days of a written request, or a later date we agree with you, except where the law requires us to keep a record. Our database provider keeps backups for its own period, and deleted information leaves the backups when they expire.
- A firm can ask us in writing for a copy of its information at any time. We will send it in a common file format within 30 days of a written request, or a later date we agree with you.
How we protect it
Each customer firm's information is kept separate from other firms' by rules built into the database. We test this by signing in as a user of one firm and trying to read another firm's information. In October 2026 we ran the staff test against a copy of our live database and the client-portal test against the live system itself.
Provaris does not hold a SOC 2 report, an ISO 27001 certificate, or any other security or privacy certification, and we do not claim to comply with any such standard. No system is free of risk and we do not promise that nothing will go wrong. If personal information we hold for a firm is accessed by someone who should not have it, we will tell that firm without undue delay.
Your choices and rights
Depending on where you live you may be able to:
- ask what personal information we hold about you and get a copy;
- ask us to correct it;
- ask us to delete it;
- object to, or withdraw consent for, our use of it;
- complain to a privacy regulator.
You can also change your visit-statistics choice at any time with "Cookie choices" at the bottom of our public pages.
To ask, write to info@gorsar.io. We will reply within 30 days. We may need to confirm who you are first. If your information is held for a customer firm, we may pass your request to that firm.
Children
Provaris is for businesses. It is not meant for people under 16 and we do not knowingly collect information from them.
Changes
We will post changes here and change the date at the top. For a material change, we will also tell customer firms by email.