Privacy Policy

Effective 12 October 2026 · Vault Workspace LLC

If you read this page in another language, the translation is for convenience only; the English version is the binding one.

IN SHORT

We use your data to run Vault: your account, your images and instructions, payments and support. We never sell it, and we don't use your images or results to train AI.

To create results, your images and instructions are sent to the AI providers listed below. Analytics and the support chat only run if you accept cookies.

You can access, export, correct or delete your data at any time by emailing support@vaultworkspace.com.

1. Who is responsible

Vault Workspace LLC (a limited liability company organised under the laws of the State of Wyoming, United States) is the controller of personal data processed through vaultworkspace.com and the Vault app. We operate from Romania (European Union). Contact us about privacy at support@vaultworkspace.com.

If you upload content containing other people's personal data (for example a client's home or people in a photo), you decide why and how it is used, and we process it on your behalf to provide the Service, following your instructions and this policy.

2. What we collect

3. Why we use it (legal bases)

If you're in the EU, EEA or UK, these are our legal bases under the GDPR:

Purpose

Legal basis

Create and run your account; generate, store and show your results; projects, sharing and client portal; customer support

Performance of our contract with you

Take payments, manage subscriptions and credits, keep tax and accounting records

Contract; legal obligation

Keep Vault secure: authentication, bot checks, rate limits, fraud and abuse prevention, error monitoring, internal alerts about sign-ups, payments and failures

Legitimate interests (keeping the Service safe and working)

Service emails: confirmations, receipts, security and important changes

Contract; legitimate interests

Tips, onboarding and product update emails to customers

Legitimate interests (you can unsubscribe in every email) or consent where required

Analytics to understand and improve the product

Consent (cookie banner); you can withdraw it any time in Cookie settings

Translating the interface into your language, and your instructions into English for the AI models

Legitimate interests; performance of our contract

Complying with law and defending legal claims

Legal obligation; legitimate interests

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. How AI processing works

When you run a tool, the image and instructions needed for that job are sent to the AI provider that performs it (see the table in section 5). The provider returns the result, which we store in your private vault.

The Vault Assistant sends your chat messages (not your images) to a language model to decide what to do and to reply. Instructions typed in other languages may be translated into English by a language model before they are sent to image and video models.

To create a video, a still image may be sent to a language model to write the camera directions.

We do not use your content or results to train AI models. We use AI providers through their business APIs, under terms that treat your inputs as confidential and let providers keep them only as needed to run the service, monitor abuse and meet legal duties. One provider (fal.ai) may use anonymised or aggregated usage data derived from inputs to improve its services; it does not receive your name or email.

5. Who we share data with

We never sell personal data or share it for cross-context behavioural advertising. We share it only with:

Provider

What for

Data involved

Supabase

Database, authentication, file storage and server functions

All account data and content

Lovable

Hosting of the web app; AI gateway to Google Gemini models for the assistant, image analysis and generation (for example upscaling and presentation documents), and translations

App traffic; assistant messages, instructions, interface text, images processed by those tools

fal.ai

Running image and video models (including models by Google, Black Forest Labs, Kuaishou/Kling and Alibaba/Qwen, and upscalers)

Images and instructions for each job

Anthropic

Writing camera directions for videos; internal operations tooling

A still image for video jobs; error summaries

Replicate

Backup image upscaling

Image to upscale (only if used)

Lemon Squeezy

Reseller and Merchant of Record: checkout, payments, tax, invoices, subscription management (acts as an independent controller for payment data)

Name, email, billing address, payment details, purchase

Resend

Sending emails

Name, email, email content

Crisp (only with consent)

Support chat

Name, email, chat messages, device data

Google Analytics (only with consent)

Product analytics

Pseudonymous identifiers, usage events, IP (truncated by Google)

Cloudflare Turnstile (when enabled)

Bot protection on sign-up and sign-in

Device and browser signals

Internal alerts to our team about new sign-ups, purchases, client-portal logins and failures; and, if you choose to use it, chatting with Vault through our Telegram bot

Name, email, plan, error details; for bot users: Telegram ID, messages and files you send

We also share data: with people you choose (share links, invited clients, apps you connect to your account); with professional advisers under confidentiality; if required by law or to protect rights and safety; and with a buyer or successor if our business is sold or reorganised, who must keep protecting it as described here.

6. International transfers

Several providers are based in the United States or process data there. When personal data from the EU, EEA or UK is transferred, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) in our providers' data processing terms, or on the EU-US Data Privacy Framework where the provider is certified. You can ask us for more information about these safeguards.

7. How long we keep data

Account, profile, projects and your saved files and results: while your account is open, and until you delete them.

When you delete your account (Settings → Delete account, or by email): your files are deleted immediately and your account data within 30 days; copies in backups are overwritten on the backup cycle. We keep billing records the law requires.

Temporary working copies of uploads made during a job: deleted automatically, normally within 24 hours.

Share links: until you turn them off (Stop sharing, or Settings → Shared links) or delete your account.

Billing and tax records: as long as tax and accounting laws require (up to 10 years).

Error logs: deleted after 12 months. Usage and credit records: while your account is open, because they make up your credit history.

Analytics data: according to our Google Analytics retention setting (up to 14 months).

Support conversations: up to 2 years after the conversation, unless you ask us to delete them sooner.

8. Security

Data is encrypted in transit (HTTPS) and stored with our providers' encryption at rest. Most uploads and results are stored privately and shown to you through short-lived signed links. Images used in presentation documents, profile photos and studio logos are stored at unlisted public addresses so they can be embedded, and files sent to AI providers may be held at unlisted provider addresses for a limited time. Access is controlled per user in the database, staff access is limited to what's needed to run and support the Service, and payments never touch our servers. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

9. Your rights

Depending on where you live, you have the right to:

access your personal data and get a copy (including in a portable format)

correct inaccurate data

delete your data and your account

restrict or object to processing based on legitimate interests, including emails

withdraw consent at any time (for analytics and chat: Cookie settings in the footer or in Settings)

not be subject to decisions based solely on automated processing with legal or similarly significant effects

You can delete your account yourself in Settings → Delete account. For anything else, email support@vaultworkspace.com from your account address. We reply within one month (we may extend this by up to two further months for complex requests, and will tell you). We may need to confirm your identity. You can also complain to a data protection authority, for example where you live, or in Romania to the ANSPDCP (dataprotection.ro). We'd appreciate the chance to help first.

10. Information for specific countries

Wherever you live, you can use the rights in section 9. In addition:

United Kingdom: UK GDPR and the Data Protection Act 2018 apply as described above. Transfers use the UK International Data Transfer Addendum. You can complain to the ICO (ico.org.uk).

Switzerland: the revised Federal Act on Data Protection (nFADP) applies. Transfers use the Standard Contractual Clauses adapted for Switzerland or the Swiss-US Data Privacy Framework. Authority: FDPIC (edoeb.admin.ch).

Brazil: under the LGPD you can confirm and access processing, correct, anonymise, block or delete data, port it, learn who we share it with, and withdraw consent. Our legal bases are those in section 3 (contract, legal obligation, legitimate interests, consent). Authority: ANPD (gov.br/anpd).

Canada (including Québec): we handle personal information under PIPEDA and, for Québec, Law 25. Our privacy contact is reachable at support@vaultworkspace.com. Your information is stored and processed outside Canada (mainly in the EU and US) by the providers in section 5, and may be accessible to authorities there. You can complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information.

Australia and New Zealand: we follow the Australian Privacy Principles and the New Zealand Privacy Act 2020. Your information is disclosed to the overseas providers in section 5 (mainly in the US and EU). You can complain to the OAIC (oaic.gov.au) or the NZ Privacy Commissioner.

Japan: under the APPI, personal data is provided to the foreign providers listed in section 5 (mainly in the US and EU), which handle it under contracts requiring protection equivalent to the APPI. You may request disclosure, correction, suspension of use and deletion.

South Korea: under PIPA, personal data is transferred overseas to the providers in section 5 (mainly the US and EU), over the internet when you use the Service, for the purposes stated there and retained as described in section 7. You can refuse by not using the relevant features or by deleting your account; some features then won't work.

India: under the Digital Personal Data Protection Act 2023, you may access, correct and erase your data, withdraw consent, and nominate someone to exercise your rights. Our grievance contact is support@vaultworkspace.com; if you're not satisfied, you may complain to the Data Protection Board of India.

Turkey: under KVKK, your data is transferred abroad to the providers in section 5 under standard contracts or other safeguards permitted by law. You may exercise the rights in Article 11 KVKK by email, and complain to the KVKK Authority.

South Africa: we process personal information under POPIA; you can complain to the Information Regulator.

Singapore, the UAE, Saudi Arabia and other countries with data protection laws: we apply the protections in this policy and honour the rights your local law gives you; contact us to use them.

China: Vault is not offered for users in mainland China.

11. US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose (described above), to access and delete it, to correct it, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer characteristics. To make a request, email support@vaultworkspace.com. You may use an authorised agent; we'll verify the request.

12. Children

Vault is not intended for anyone under 18, and we don't knowingly collect children's data. If you think a child has given us personal data, contact us and we'll delete it.

13. Changes and contact

We'll update this policy when our practices or providers change, and update the date at the top. For significant changes we'll tell you by email or in the app before they take effect. Questions or requests: support@vaultworkspace.com.