How Vaulthat handles account, billing, archive, and security data.

Who we are

What personal data we collect

• Account and identity data such as your name, email address, password hash, email-verification status, two-factor authentication secrets and recovery codes, and your current workspace selection.
• Workspace and collaboration data such as workspace names, user roles, invitations, membership history, and activity records linked to users, projects, and assets.
• Archive and project data such as project names, descriptions, folder paths, file names, MIME types, checksums, file sizes, archive manifests, upload sessions, restore requests, restore windows, and download events.
• Billing and payment data such as Stripe customer IDs, subscription records, invoice and payment references, payment status, payment-method brand and last four digits, and billing reminder history. We do not store full payment card numbers in the app database.
• Technical and security data such as session records, IP addresses, user-agent strings, timestamps, and service metadata needed for fraud prevention, troubleshooting, and service security.

How we use personal data

• To create and manage accounts, authenticate users, and secure workspace access.
• To provide archive upload, storage, restore, download, and billing functionality.
• To process payments, invoices, subscription access, failed-payment handling, and operational collections workflows.
• To send transactional emails and service notices, including invitations, billing alerts, restore notices, and account-security messages.
• To maintain audit trails, investigate misuse, prevent fraud, enforce our terms, and protect the integrity of the service.
• To comply with legal, tax, accounting, and regulatory obligations.

Our lawful bases

• Contract: to provide Vaulthat, administer workspaces, store archive content, process restores, and manage subscriptions and billing.
• Legitimate interests: to secure the service, maintain operational logs and audit trails, prevent abuse, improve reliability, recover debts, and communicate with workspace users about the service.
• Legal obligation: where we need to keep records or disclose information to comply with applicable law, taxation, accounting, fraud-prevention, or regulatory duties.
• Consent: if we introduce non-essential cookies, analytics, or optional communications that require consent, we will ask for it first where required.

Cookies, sessions, and analytics

Who we share data with

• Stripe, for subscription management, billing portal access, invoices, payment processing, and payment-failure handling.
• Amazon Web Services, for archive storage, restore operations, and supporting infrastructure used by the application.
• Email and application infrastructure providers that help us deliver transactional communications and operate the platform.
• Professional advisers, law enforcement, courts, regulators, or counterparties where disclosure is reasonably necessary for legal, regulatory, fraud-prevention, or dispute purposes.

International transfers

How long we keep data

• Account and workspace records are kept while your account or workspace remains active and for a reasonable period afterwards where needed for security, dispute resolution, or legitimate business records.
• Billing, charge, and payment records may be retained for longer periods where needed for accounting, tax, audit, fraud-prevention, or legal purposes.
• Session and technical security records are retained in line with operational needs and housekeeping processes.
• Archive content, project metadata, restore records, and related audit trails are retained until deleted by the workspace or removed through service retention and billing-enforcement workflows, including when prepaid storage ends without an active subscription or when failed-payment enforcement requires deletion.

Your responsibilities for uploaded content

Security of archive data

Your rights

Changes to this policy