Privacy Policy

We collect the following categories of information when you use VaultLegacy:

1.1 Account Information

• Email address -- Required for account creation, authentication, and service communications
• Full name -- Used for account identification and personalization
• Location (country/region) -- Used to provide jurisdiction-relevant information and comply with local regulations

1.2 Digital Asset Metadata

When you use our vault features, we store metadata about your digital assets, such as:

• Account names and types (e.g., "Coinbase account," "Gmail account")
• Beneficiary designations and distribution instructions
• Notes and messages for your designated contacts
• Asset categories and organizational labels

1.3 Payment Information

Payment processing is handled entirely by Stripe, our third-party payment processor. We do not store your full credit card number, CVV, or banking details on our servers. We receive and store only:

• Transaction confirmation and payment status
• Last four digits of your payment method (for your reference)
• Billing country and postal code
• Stripe customer ID (for managing your account)

1.4 Automatically Collected Information

• Usage data: Pages visited, features used, actions taken within the Service
• Device information: Browser type, operating system, device type, screen resolution
• Log data: IP address, access times, referring URLs, error logs

We use the information we collect for the following purposes:

2.1 To Provide and Maintain the Service

• Create and manage your account
• Store and encrypt your vault data
• Process your payments
• Enable beneficiary designations and trusted contact features
• Authenticate your identity and secure your account

2.2 To Improve the Platform

• Analyze usage patterns to improve features and user experience
• Identify and fix technical issues, bugs, and security vulnerabilities
• Develop new features based on aggregate usage data
• Monitor Service performance and reliability

2.3 To Communicate With You

• Send essential service emails (account verification, security alerts, payment confirmations)
• Notify you of changes to our Terms of Service or Privacy Policy
• Respond to your support requests and inquiries
• Send important product updates that affect your account functionality

We do not send promotional marketing emails without your explicit opt-in consent. You may opt out of non-essential communications at any time.

Protecting your data is fundamental to our mission. We implement multiple layers of security:

Additionally, we implement:

• Regular security audits and penetration testing
• Automated monitoring for suspicious activity and unauthorized access attempts
• Data backups with encrypted redundant storage
• Incident response procedures for rapid breach identification and mitigation

While we employ robust security measures, no system is perfectly secure. We cannot guarantee absolute security but are committed to protecting your information using industry best practices.

We use a limited number of third-party service providers to operate VaultLegacy. Each provider is selected for their security standards and data protection practices:

We may also use:

• Cloud hosting providers for secure infrastructure and data storage
• Email delivery services for transactional emails (account verification, security alerts)
• Analytics tools for aggregated, anonymized usage statistics (no personal data shared)

All third-party providers are contractually obligated to protect your information and may only use it to perform services on our behalf. We do not allow them to use your personal information for their own purposes.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and related data protection laws.

6.1 Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: Where you have given explicit consent for specific processing activities (e.g., marketing communications). You may withdraw consent at any time.
• Contract Performance: Processing necessary to fulfill our contractual obligations to you, including providing the Service, managing your account, and processing payments.
• Legitimate Interest: Processing necessary for our legitimate business interests, such as improving the Service, ensuring security, and preventing fraud, where these interests do not override your data protection rights.
• Legal Obligation: Processing required to comply with applicable laws and regulations.

6.2 Your Rights Under GDPR

As an EU/EEA user, you have the right to:

• Access -- Request a copy of the personal data we hold about you
• Rectification -- Request correction of inaccurate or incomplete personal data
• Erasure ("Right to Be Forgotten") -- Request deletion of your personal data, subject to legal retention requirements
• Restriction -- Request restriction of processing of your personal data in certain circumstances
• Data Portability -- Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller
• Object -- Object to processing based on legitimate interests or direct marketing
• Withdraw Consent -- Withdraw previously given consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

6.3 Data Protection Officer

To exercise any of your GDPR rights, or if you have questions about our data protection practices, please contact our Data Protection Officer:

6.4 International Data Transfers

Your data may be transferred to and processed in countries outside the EEA. When such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally approved transfer mechanisms.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

7.1 Your Rights Under CCPA/CPRA

• Right to Know: You have the right to request that we disclose what personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request the deletion of your personal information, subject to certain exceptions (e.g., legal compliance, completing transactions, security).
• Right to Opt-Out of Sale: You have the right to opt out of the "sale" of your personal information. However, VaultLegacy does not sell your personal information and has never sold personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, quality of service, or access levels for exercising your privacy rights.
• Right to Correct: You have the right to request correction of inaccurate personal information we hold about you.
• Right to Limit Use of Sensitive Information: You have the right to limit our use of sensitive personal information to purposes necessary to provide the Service.

7.2 How to Exercise Your Rights

California residents may submit requests by:

• Emailing privacy@vaultlegacy.com with the subject line "CCPA Request"
• We will verify your identity before processing any request
• We will respond within 45 days, with a possible extension of 45 additional days for complex requests

7.3 Categories of Information Collected (Last 12 Months)

VaultLegacy uses essential cookies only. We do not use advertising cookies, tracking pixels, or third-party marketing cookies.

8.1 Essential Cookies We Use

8.2 Cookie Consent

Because we use only essential cookies that are strictly necessary for the Service to function, they do not require consent under most privacy regulations. However, we provide transparency about all cookies used, and you can manage cookies through your browser settings.

Disabling essential cookies may prevent certain features of the Service from functioning properly, including authentication and session management.

Our data retention practices are designed to keep your data only as long as necessary:

9.1 Active Accounts

Your personal data and vault contents are retained for as long as your account remains active and in good standing. "Active" means you have not requested account closure or been terminated for Terms violations.

9.2 Account Closure

Upon receiving a valid account closure request:

• Vault data: Permanently deleted within 90 days of the closure request
• Account information: Anonymized or deleted within 90 days
• Transaction records: Retained for up to 7 years as required by tax and financial regulations
• Anonymized analytics data: May be retained indefinitely in aggregate form that cannot identify you

9.3 Legal Holds

If we are required to preserve data due to litigation, regulatory investigation, or legal obligation, we will retain the relevant data until the hold is lifted, after which standard deletion procedures apply.

VaultLegacy is not intended for use by individuals under the age of 18. We do not knowingly collect, use, or disclose personal information from anyone under 18 years of age.

If we become aware that we have collected personal information from a person under 18, we will take immediate steps to:

• Delete the personal information from our systems
• Terminate the associated account
• Notify the parent or guardian, if contact information is available

If you are a parent or guardian and believe your child under 18 has provided personal information to VaultLegacy, please contact us immediately at privacy@vaultlegacy.com so we can take appropriate action.

This policy complies with the Children's Online Privacy Protection Act (COPPA) and equivalent international regulations.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes:

• We will update the "Effective Date" and "Last Updated" date at the top of this page
• For material changes, we will provide notice via email to the address associated with your account at least 30 days before the changes take effect
• We will display a prominent notification on the Service
• Where required by law, we will obtain your consent before applying material changes

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

If you disagree with any changes, you may request account deletion by contacting us at privacy@vaultlegacy.com.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For general support inquiries, please contact support@vaultlegacy.com.

For GDPR-specific inquiries, please direct your correspondence to our Data Protection Officer at privacy@vaultlegacy.com with the subject line "GDPR Inquiry."

We aim to respond to all privacy-related inquiries within five (5) business days, and to fulfill data rights requests within the timeframes required by applicable law.