Privacy Policy

1. Who We Are

vvault is operated from Belgium by Tom Nsengiyumva (sole proprietor), company number BE 1022.549.155, registered office Zwartleertouwersstraat 40, 8000 Brugge, Belgium ("vvault", "we"). For personal data processed under this policy, vvault acts as the data controller within the meaning of the EU General Data Protection Regulation (GDPR).

For any privacy matter, contact us at vvaultapp@gmail.com or via the in-app Support page.

2. Information We Collect

Information you provide directly: account details (name, email, handle, avatar, locale), uploaded content (audio files, covers, metadata such as BPM and key), your contacts and groups, campaign content and recipients, direct messages, marketplace listings and license terms, support messages, and billing-related information.

Information collected automatically: IP address, device and browser data, server logs, cookies and similar identifiers, approximate region (used for currency and language), and usage events needed to run, secure, and improve the service.

Information from recipients and visitors of your shared content: when someone opens a link, streams, downloads, or interacts with content you shared, we record those events (including technical data) and show them to you as engagement analytics.

3. Legal Bases

We process data on the following GDPR bases: performance of our contract with you (running your library, sends, analytics, marketplace, subscriptions); our legitimate interests (service security, abuse and fraud prevention, product improvement, measuring engagement on shared content); your consent where required (non-essential cookies, marketing communications, connecting third-party accounts); and compliance with legal obligations (tax, accounting, lawful requests).

4. Engagement Tracking

Opens, clicks, plays, play duration, downloads, and saves on content you share are recorded to provide your analytics. We apply protections to filter automated scanners and improve metric quality. If you receive a vvault-powered email or open a shared link, the sender can see these engagement events.

5. Connected Accounts and Imports

Gmail sending: if you connect Gmail, we store the tokens needed to send emails on your instruction. You control recipients and message content.

Google Drive and Dropbox import: if you import beats, you pick files in the provider's own picker and the files are transferred directly into your library. We only access the specific files you select (for Google Drive, under the drive.file scope), and we do not browse the rest of your storage.

vvault's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Desktop folder sync: if you use the desktop app's sync, files in folders you choose are uploaded to your library and kept in sync from your device.

6. Payments

Subscriptions, purchases, marketplace payouts, and refunds are processed by Stripe, and by Apple for in-app purchases on iOS. We receive payment status, amounts, and related metadata; we never store full card details. Currency shown is based on your approximate region.

7. Sharing and Public Pages

When you publish or share packs, tracks, folders, series, your profile, or a link-in-bio page, they can be reached through public or tokenized links according to your settings, including expiry and usage limits where configured. Anyone with access can view, stream, or download based on your configuration and license rules. Custom domains you connect serve the same content under your domain.

8. Emails We Send You

We send service emails (verification codes, password resets, receipts, security notices) and product emails such as onboarding tips or feature updates. Product and marketing emails include an unsubscribe option; service emails are necessary to operate your account.

9. Service Providers and Transfers

We rely on processors for hosting and storage (Supabase on AWS, EU region), email delivery (Resend), payments (Stripe, Apple), and error and usage monitoring. Providers process data only under contract and only as needed to provide their service.

Where a provider processes data outside the European Economic Area, we rely on safeguards recognized by the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision (including the EU-US Data Privacy Framework where applicable).

10. Data Retention

Account data is kept while your account is active. Deleted tracks and projects go through a recoverable state before permanent removal. When you delete your account, personal data is deleted or anonymized within a reasonable period, except what we must keep for legal, tax, accounting, or dispute purposes. Engagement events may be retained in aggregate, de-identified form.

11. Security

Audio files live in private storage and are served through signed, expiring links. Access to the service is over encrypted connections, and direct messages use additional encryption safeguards. We apply technical and organizational measures appropriate to the risk; no system can guarantee absolute security, and we will notify you and the competent authority of breaches where the GDPR requires it.

12. Your Rights

Under the GDPR you can access, correct, delete, or receive a copy of your data, restrict or object to certain processing, and withdraw consent at any time without affecting prior processing. Write to vvaultapp@gmail.com; we answer within one month.

You can also lodge a complaint with the Belgian Data Protection Authority (Autorite de protection des donnees / Gegevensbeschermingsautoriteit, www.dataprotectionauthority.be) or your local supervisory authority.

13. Children

vvault is not directed at children under 16, and we do not knowingly process their data. If you believe a child provided us personal data, contact us and we will delete it.

14. Changes and Contact

We will post any changes to this policy here and update the date above; for material changes we will notify you in the app or by email. Questions: vvaultapp@gmail.com.