Privacy Policy

This Privacy Policy explains how Vaultix ("Vaultix", "we", "us", or "our") collects, uses, discloses, and protects personal data when you use our website, applications, APIs, and related services (the "Services").

For purposes of applicable privacy laws, Vaultix is the data controller for personal data collected directly from users. Where we process personal data on behalf of customers, we act as a data processor.

We collect personal data that you provide directly, data generated through use of the Services, and limited data from third parties.

• Account and profile data: name, work email, company, role, authentication credentials, and account preferences.
• Customer Content: uploaded documents, questionnaire files, prompts, review edits, and exported files.
• Usage data: features used, timestamps, event logs, error reports, device/browser details, and IP address.
• Billing data: subscription plan and payment status (card details are processed by certified payment providers, not stored directly by Vaultix).
• Support data: communications with our support, sales, or security teams.

We use personal data to provide, maintain, secure, and improve the Services.

• Authenticate users, create accounts, and manage workspace access.
• Process files and generate AI-assisted outputs, including citations and confidence scoring.
• Operate collaboration, audit logging, exports, and workspace administration features.
• Send transactional notices, billing updates, product communications, and service alerts.
• Monitor performance, detect abuse, prevent fraud, and enforce our Terms.
• Comply with legal obligations and respond to lawful requests.

Where GDPR or equivalent laws apply, our legal bases include: (a) performance of a contract; (b) legitimate interests (for example service security and product improvement); (c) compliance with legal obligations; and (d) consent where required.

To provide AI functionality, selected Customer Content may be processed by trusted model and infrastructure providers acting under contractual obligations.

We implement controls to reduce misuse, and we restrict internal access to Customer Content to authorized personnel who need access for support, security, or legal compliance.

You are responsible for validating AI outputs before relying on them for legal or compliance decisions.

We do not sell personal data. We may disclose personal data only as described below:

• Service providers and subprocessors supporting hosting, storage, analytics, billing, customer support, and AI infrastructure.
• Within your organization, according to workspace role permissions.
• In connection with mergers, acquisitions, financing, or sale of assets, subject to confidentiality safeguards.
• To comply with law, enforce rights, protect safety, or respond to valid legal process.

Vaultix may process data in multiple countries. Where required, we use recognized transfer safeguards such as standard contractual clauses and equivalent protections.

We retain personal data for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

Customers may configure retention settings for certain uploaded files. Backups and security logs may persist for a limited additional period.

We use administrative, technical, and organizational safeguards designed to protect personal data, including encryption in transit, access controls, and security monitoring.

No system is completely secure. You should use strong passwords, enable available security controls, and notify us immediately of suspected account compromise.

We use cookies and similar technologies for authentication, security, session management, and product analytics.

You can manage certain cookie preferences in your browser settings. Disabling some cookies may affect service functionality.

Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict specific processing activities.

• EEA/UK: rights under GDPR, including access, rectification, erasure, portability, and objection.
• California: rights to know, delete, and correct personal information and to receive equal service without discrimination.
• You may submit requests by emailing privacy@vaultix.app. We may need to verify your identity before completing requests.

The Services are not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact us so we can take appropriate action.

We may update this Privacy Policy periodically. If changes are material, we will provide notice through the Services or by email. The updated policy becomes effective on the date stated at the top of this page.

For privacy questions or requests, contact: privacy@vaultix.app

For legal notices, contact: legal@vaultix.app