Privacy Notice

This Privacy Notice explains how Vaultly ("Vaultly", "we", "us") collects, uses, shares, and protects personal data when you use our receipt and warranty tracking service (the "Service"). Vaultly is the data controller for personal data processed through the Service.

1. Who we are

Vaultly operates the Service available at vaultlykeep.com. If you have any questions about this Notice or your data, contact us through the in-app support channel.

2. Personal data we collect

• Account data: name, email address, hashed password, authentication identifiers.
• Content you upload: receipts, warranty documents, product images, item metadata, notes.
• Usage data: optional signed-in page views, feature activity, device type, browser, IP address, approximate location, timestamps.
• Support data: messages and attachments you send us.
• Billing identifiers: subscription status and customer IDs returned by our payment processor. Card numbers and full billing details are handled by Lemon Squeezy and never stored by Vaultly.

3. Why we use your data and legal basis

• Provide the Service (performance of contract): create your account, store and display your receipts, send reminders.
• Security and fraud prevention (legitimate interests): detect abuse, protect accounts, maintain integrity of the Service.
• Improve the product (consent / legitimate interests): understand optional usage analytics to fix bugs and prioritise features.
• Customer support (performance of contract / legitimate interests): respond to questions and issues.
• Legal compliance (legal obligation): tax records and responding to lawful requests.

4. How we share data

We share personal data only with:

• Service providers / subprocessors for hosting, database, storage, email delivery, error monitoring, and analytics.
• Lemon Squeezy, our Merchant of Record, which processes payments, manages subscriptions, calculates and remits tax, and issues invoices. Lemon Squeezy acts as an independent controller for checkout and payment data. Lemon Squeezy explains its own data practices in its Privacy Notice.
• Professional advisers (legal, accounting, auditors) where reasonably necessary.
• Authorities where required by applicable law or to protect our rights.

We do not sell your personal data.

5. International transfers

Our providers may process data outside your country of residence, including in the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We retain personal data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymise it.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. You can download a copy of account data from Profile → Privacy & GDPR, update your display name in Profile, disable optional analytics in Profile, and send an account deletion request from Profile. EU/UK users may lodge a complaint with their local supervisory authority. We will respond within the timeframe required by applicable law (generally within one month for GDPR requests).

8. Security

We use appropriate technical and organisational measures including encryption in transit, access controls, and least-privilege practices to protect personal data. No system is perfectly secure, but we work to maintain a high standard.

9. Cookies

We use cookies and similar technologies that are strictly necessary to operate the Service (session, authentication, security, and interface preferences). Optional signed-in page-view analytics are disabled unless you enable them in Profile → Privacy & GDPR. If we add marketing cookies in the future, we will request your consent where required and provide a way to manage preferences.

10. Changes

We may update this Notice from time to time. Material changes will be communicated through the Service or by email. The "Last updated" date above shows the latest revision.