Privacy Policy

Last Updated: January 19, 2026

At Vault, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our secure file storage and sharing service.

1. Information We Collect

Information You Provide to Us

• Account Information: When you create an account, we collect your email address, username, and password (encrypted).
• Files and Content: We store the files you upload, along with metadata such as file names, sizes, and upload dates.
• Payment Information: If you subscribe to Vault Pro, payment details are processed securely through Stripe. We do not store your full credit card information.
• Communications: If you contact our support team, we may keep records of your correspondence.

Information Collected Automatically

• Log Data: We collect information about your interactions with our service, including IP addresses, browser type, access times, and pages viewed.
• Device Information: We collect information about the device you use to access vault, including device type, operating system, and unique device identifiers.
• Cookies: We use essential cookies to maintain your session and authentication. We do not use tracking or advertising cookies.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our file storage and sharing service
• Process your transactions and manage your subscription
• Send you technical notices, security alerts, and support messages
• Respond to your comments, questions, and customer service requests
• Detect, prevent, and address technical issues and security threats
• Monitor and analyze usage patterns to improve user experience
• Comply with legal obligations and enforce our Terms of Service

3. Security of Your Files

We implement multiple layers of security to protect your data:

• Virus Scanning: Every file uploaded is automatically scanned using VirusTotal to detect malware and viruses before storage.
  Note on VirusTotal Scanning: When you upload a file, UseVault generates a cryptographic hash (a unique digital fingerprint) of that file and submits only the hash to VirusTotal for malware verification. The actual contents of your file are never transmitted to VirusTotal or any external party. This process protects your privacy while ensuring your vault remains free from malware.
• Encryption: All files are encrypted at rest using 256-bit AES encryption. Data in transit is protected using TLS/SSL.
• Access Controls: Only you can access your files unless you explicitly create a share link. We implement strict authentication and authorization controls.
• Password Protection: Passwords are hashed using bcrypt with industry-standard security parameters.
• Infrastructure Security: Our servers and databases are protected by firewalls, intrusion detection systems, and regular security updates.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

• With Your Consent: When you create a share link, the files you share become accessible to anyone with the link (and password, if you set one).
• Service Providers: We work with third-party service providers who perform services on our behalf, such as:
  • Stripe for payment processing
  • VirusTotal for virus scanning
  • Cloud hosting providers for infrastructure
  These providers are contractually obligated to protect your information and use it only for the services they provide to us.
• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).
• Business Transfers: If vault is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
• Protection of Rights: We may disclose information when we believe it is necessary to protect our rights, your safety, or the safety of others.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. Specifically:

• Account Data: Retained until you delete your account
• Files: Retained until you delete them or close your account
• Log Data: Retained for up to 90 days for security and troubleshooting purposes
• Deleted Data: When you delete files or your account, we permanently remove the data from our active servers within 30 days. Backups are purged within 90 days.

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can access and download your files at any time through your account dashboard.
• Correction: You can update your account information in your account settings.
• Deletion: You can delete individual files or your entire account at any time. Account deletion is permanent and cannot be undone.
• Export: You can download all your files at any time.
• Opt-Out: You can opt out of non-essential communications in your account settings.

GDPR and International Privacy Rights

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right to access, correct, or delete your personal data
• Right to restrict or object to processing of your data
• Right to data portability - you may download all your files at any time
• Right to withdraw consent at any time without affecting the lawfulness of prior processing

Data Protection Officer: As a small business operating below the threshold requiring a formal Data Protection Officer under Article 37 of the GDPR, UseVault is not required to appoint a DPO. Privacy matters are handled directly by the business owner and operator, SkillBreed LLC (Florida Document No. L19000003521). All privacy inquiries, including GDPR and CCPA requests, may be directed to: privacy@skillbreed.com. We aim to respond within 48 hours.

Infrastructure: Your files and data are stored on servers hosted by DigitalOcean LLC, a cloud infrastructure provider. DigitalOcean is contractually obligated to protect your data and processes it only as directed by SkillBreed LLC. For more information, see DigitalOcean's privacy policy at digitalocean.com/legal/privacy-policy.

7. Children's Privacy

Vault is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately and we will delete it.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your country. By using Vault, you consent to the transfer of your information to our facilities and service providers globally.

9. Third-Party Links

Our service may contain links to third-party websites or services that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make changes, we will:

• Update the "Last Updated" date at the top of this policy
• Post the revised policy on this page
• Send a notification email to your registered email address at least 14 days before material changes take effect

Material changes include modifications to how we collect, use, or share your personal information, changes to your rights, or changes to how we store or protect your files.

Your continued use of UseVault after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you may close your account and download your files before the effective date.

11. Do Not Track Signals

We do not track users over time and across third-party websites and therefore do not respond to Do Not Track (DNT) signals. We do not use advertising or tracking cookies.

12. California Privacy Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, and disclose
• Right to request deletion of your personal information
• Right to opt-out of the sale of personal information (note: we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, please contact us using the information below.