Privacy Policy

Privacy is of utmost importance at Vault12. We recognize the significance of protecting information which is stored or protected using Vault12 applications. This Privacy Policy informs you of the ways we work to ensure the privacy and confidentiality of your information and describes the information we gather, how we use that information and the circumstances under which we disclose such information to third parties.

In this Privacy Policy, the term “Service” has the same meaning as described in the Terms of Service. If you do not agree with this Privacy Policy, in general, or any part of it, you should not use the Service. This Privacy Policy is periodically reviewed to ensure that any new obligations and changes to our business model are taken into consideration. We may amend this Privacy Policy at any time by posting an amended version on our website.

What information do we collect and what do we do with your information?

Vault12 does not collect, store or sell any of your personal information, nor any of your files, excluding generally accepted analytics for performance measurement purposes. Both your personal data and your files are encrypted by the Vault12 application on your device before being relayed through our Zax (https://github.com/vault12/zax) Server. This encrypted data only temporarily exists on our servers and is deleted once the destination device picks it up. Vault12 does not have the keys nor the capability to decrypt any of this information. If any government agency requests your personal data or files in an unencrypted format, Vault12 is technically unable to provide this to them.

All payments to Vault12 are transacted through third parties (Apple Pay or Google Payments), and those third parties do not provide Vault12 with any of your credit card or other personal financial information.

Lost/erased devices

In the event you lose or erase one of the devices guarding your Vault, you should restore your Vault immediately. If too many of the devices guarding your Vault are lost/erased or you delete the Vault12 application, then we will not be able to provide instructions for the restoration of your files or data. This is because we do not store the private keys that secure Vaults on any of our servers.

Consent to anonymous logging

While we do not have access to any of your personal data, Vault12 does keep anonymized logs of user activity (“User Logs”). By using Vault12 or any of its Services, you are consenting to your activity being included in our User Logs. User Logs allow us to evaluate how our products are being used, without providing us with any details of who is using our product.

Third-Party analytics tools and cookies

Vault12 uses certain third-party web analytics tools that help us understand how users engage with our website, such as Google Analytics. These third parties may use first-party cookies to track user interactions to collect information about how users use our website. This information is used to compile reports and to help us improve our website. The reports disclose website trends without identifying individual visitors.

Guardian Rewards Program Data

If you participate in Vault12's Guardian Rewards Program (the “Program”), this section describes how Vault12 handles the related information, in addition to the rest of this Privacy Policy.

• What we collect. A Guardian's self-supplied public wallet address, and records of the reward transactions Vault12 executes on a Vault Owner's instruction (such as amount, timestamp, and transaction hash).
• Why we collect it. To register a Guardian to receive rewards, verify eligibility, screen for sanctions and fraud risk, execute and record the reward transfer, and comply with tax-reporting obligations. Vault12 does not use a registered wallet address to identify or profile you beyond these purposes.
• Who we share it with. Registered wallet addresses may be shared with blockchain-analytics or compliance vendors (for example, sanctions-screening providers) and, where legally required, with tax-reporting service providers. Vault12 does not sell wallet addresses.
• How long we keep it. Wallet addresses and reward transaction records are retained for the duration of your Program participation, plus a compliance and recordkeeping period of up to seven years for tax-relevant records, after which they are deleted from Vault12's systems. Vault12 cannot delete or alter the corresponding public blockchain record.
• Public by nature. Because a registered wallet address and its on-chain history are public, Vault12 cannot guarantee anonymity or unlinkability once an address is used in connection with the Program.
• Your choices. You may withdraw from the Program and request deletion of your wallet address from Vault12's own internal records, subject to the compliance retention period above. This does not, and cannot, affect the public blockchain record.

U.S. State Privacy Rights (California and Other States)

Depending on where you live, you may have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, or similar state privacy laws. Subject to certain exceptions, these rights may include the right to:

• know what personal information Vault12 has collected about you and access it;
• delete personal information Vault12 has collected about you;
• correct inaccurate personal information;
• opt out of the “sale” or “sharing” of your personal information — “sharing” under the CPRA is defined broadly enough to include cross-context behavioral-advertising cookies and pixels; and
• not be discriminated against for exercising any of these rights.

To exercise these rights, contact Vault12 at hello+privacy@vault12.com. Vault12 will respond within the timeframe required by applicable law (generally 45 days, extendable once) and may need to verify your identity before completing your request. Where required by law, Vault12 will honor Global Privacy Control (GPC) signals as a valid opt-out request.

International Users (GDPR/UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, Vault12 processes personal information only where it has a valid legal basis to do so (such as your consent, performance of a contract, or Vault12's legitimate interests). Where Vault12 transfers personal information out of the EEA or UK, it relies on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses. Subject to applicable law, you have the right to access, rectify, erase, or restrict the processing of your personal information, to data portability, to object to processing, and to lodge a complaint with your local data protection supervisory authority.

Children's Privacy

The Service is not directed to children under 13 (or under 16 in jurisdictions where the GDPR's higher age threshold applies), and Vault12 does not knowingly collect personal information from children under that age. If you believe a child has provided Vault12 with personal information, please contact us at hello+privacy@vault12.com so we can investigate and, where appropriate, delete it.

Security & Breach Notification

Vault12's Service is built on a zero-knowledge, encrypted-relay architecture: your Vault data and files are encrypted on your device before being relayed through Vault12's Zax server, and Vault12 does not hold the keys needed to decrypt them. In the event of a data breach affecting your personal information, Vault12 will notify affected users, and any regulators to the extent required, in accordance with applicable law.

Data Retention

Vault12 retains anonymized User Logs for [retention period to be confirmed], customer support communications for [retention period to be confirmed], and payment metadata for as long as required to comply with tax and accounting obligations. Guardian Rewards Program data is retained as described above. Vault12 does not retain personal information longer than necessary for the purposes described in this Policy or as required by law.

Inquiries

Any inquiries about this Privacy Policy may be directed to: hello+privacy@vault12.io.