Published on 16 October 2026. Changes that are not in your favour apply to existing accounts from 19 November 2026; changes in your favour or required by law apply on publication. vvault provides a workspace to upload and manage audio files, create packs and series, share links, send campaigns, track engagement, sell licenses, and manage billing. This policy explains what data we collect and how we use it to operate and secure the service.
This document exists in French and in English. Both versions have the same value; in case of doubt, the interpretation most favourable to the consumer prevails.
1Who we are
vvault is operated from Belgium by Tom Nsengiyumva (sole proprietor), company number BE 1022.549.155, registered office Minderbroedersstraat 10, 8000 Brugge, Belgium ("vvault", "we"). For the personal data described here, vvault is the data controller within the meaning of the EU General Data Protection Regulation (GDPR).
This policy covers the vvault web app, desktop app, iOS app, the public pages we serve on vvault.app and on custom domains, and our emails and support.
For any privacy matter, write to contact@vvault.app or use the in-app Support page. We are not required to appoint a Data Protection Officer under Article 37 GDPR and have not appointed one; that address reaches the operator directly. Because we are established in the EU, we do not need an Article 27 representative.
2What we collect
What you give us: account details (name, email, handle, avatar, locale), the content you upload (audio, artwork, titles, notes, and metadata such as BPM and key), your contacts and groups, campaign content and recipient lists, messages, marketplace listings and licence terms, the name you type to sign a licence, support correspondence, and billing details. If you buy without an account, we process the e-mail address and name entered at checkout, your order and your licence.
What we collect automatically: IP address, device and browser information, server logs, cookies and similar identifiers, approximate region (used to pick your currency and language), and the usage events needed to run, secure and improve the service.
What we collect from your listeners: when someone opens a link you shared, streams, downloads, saves or buys, we record that event and the technical data around it, and we show it to you as analytics.
What we receive from others: identity and profile basics from a sign-in provider if you use one, payment and payout status from Stripe or Apple, files you deliberately import from a cloud provider, and reports about content sent to us by other users or rights holders.
Please do not send us special-category data (health, beliefs, political opinions, biometrics and the like). We do not ask for it and we have no use for it.
3Legal bases
Contract (Art. 6(1)(b)): running your library, sharing, collaboration, sends, the marketplace and your subscription.
Legitimate interests (Art. 6(1)(f)): security, abuse and fraud prevention, measuring engagement on content you shared, product improvement, defending legal claims. You can object to processing based on legitimate interests at any time.
Consent (Art. 6(1)(a)): analytics and advertising cookies and pixels (ours and, on their pages, those of the creators who turned theirs on), and connecting a third-party account. Marketing e-mails about vvault are sent to members on the basis of our legitimate interest in telling customers about similar services (Art. 6(1)(f) and the e-privacy rules on existing customers): you can refuse them when you sign up and in every such e-mail, free of charge. You can withdraw consent or object at any time, without affecting what came before.
Legal obligation (Art. 6(1)(c)): tax and accounting records, lawful requests, and our duties as a hosting provider.
We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not profile you for that purpose.
4Engagement tracking
Opens, clicks, plays, play duration, downloads, saves and purchases on content you share are recorded so we can give you analytics. We filter automated scanners to improve accuracy, so figures are approximate.
If you open a vvault-powered email or a shared link, the person who sent it can see those events. If you would rather not be measured that way, do not open the link.
6Access levels: what becomes visible, and to whom
You decide what is reachable. Private means only you. Invite only means the people you name. Anyone with the link means whoever holds the link. For sale means reachable and purchasable. A track's own level governs the track's own link; inside a pack, the pack's level governs.
When something is reachable, the people who reach it can see what is on the page: title, artwork, duration, your handle and profile picture, and anything you put in the notes or description. Public items may also be indexed by search engines and cached or copied by others, which we cannot undo for you.
Content shared by link stays reachable to anyone holding that link until you change the level or reset the link. We cannot retrieve a link somebody already has.
7Collaboration
If you join or are invited to a shared pack, the pack's owner and the other members can see that you are a member, your handle and profile picture, what you add, and activity attributed to you inside that pack: uploads, versions, and edits where editing is enabled.
If you own a pack, the same is true in reverse: what you do there is visible to your collaborators. Removing a member ends their access going forward; it does not recall what they already downloaded.
8Buying and selling
When a sale happens we process what is needed to complete and evidence it: who bought what, when, for how much, under which licence, and the payment status. A licence document may name the buyer and the seller, because that is what makes it usable as proof of the rights granted.
Sellers see the purchases made from them and the information needed to honour the licence. Buyers see who they bought from. vvault is the seller of every marketplace sale (it issues the invoice and accounts for the VAT), so it keeps order, licence, invoice and payout records for ten years (section 15), because Belgian accounting and VAT law requires it and because they evidence the other party's rights.
Guest buyers: if you buy without an account, we use the e-mail address and name you enter at checkout to deliver your files and licence, send the receipt and invoice, and link the purchase to an account you may create later with the same address (contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c)). We do not send marketing to a guest buyer.
8APlugin activation (vvault Lock)
When you activate a plugin sold through vvault, vvault Lock records the licence, a computer identifier and a technical fingerprint of the installation, the plugin version, the IP address and the approximate location derived from it (country, city, approximate coordinates), and the time of each periodic check. Purpose: delivering the licence you bought and preventing its misuse (contract, Art. 6(1)(b), and legitimate interest in fighting piracy, Art. 6(1)(f)). The IP address, city and coordinates of an activation are erased 12 months after its last check, and a computer's name 12 months after the computer was last seen; the rest of the activation record (licence, fingerprint, plugin version, country, dates) is kept while the licence exists. Pairing codes used to connect a computer are deleted after 30 days, and security alerts (for example a tampered licence file) after 90 days. The plugin's creator sees, for each activation of their plugin, the licence it uses (key, type and status), the technical fingerprint, the plugin version, the country, the status, the dates of activation and last check, and any security alert raised by that installation, so they can manage licences and fight piracy. The creator does not see your e-mail address, the computer's name, the IP address, the city or the coordinates.
Plugins are made by their creators, who are third-party publishers, not by vvault. The creator receives only the activation data listed above, may use it only to manage licences and fight piracy, and is bound by the Seller Terms (section 14) to keep it confidential and secure and to delete it when no longer needed. Anything the plugin itself does on your computer beyond the licence check (for example its own online features or preset sharing) is the publisher's responsibility, under its own privacy notice.
9Content moderation
To keep vvault free of illegal and prohibited content (see the Terms of Use), we review content that is reported to us. We do not screen content before it is uploaded, published, sent or shared, and we are under no general obligation to monitor it. You can contest any decision, as described in the Terms.
When we review a report we process the reported content, the report itself, and the identifiers of the people involved. Legal bases: our legitimate interests in keeping the platform safe and lawful (Art. 6(1)(f)) and compliance with legal obligations (Art. 6(1)(c)). Reports and the record of what we decided are kept while the account is active, and afterwards where a case, dispute or legal obligation requires it.
Content indicating serious crime, in particular child sexual abuse material, is preserved in a restricted state, is not distributed further, and is reported to the competent authorities as the law requires.
10Connected accounts and imports
Gmail sending: if you connect Gmail, we store the tokens needed to send e-mail on your instruction, from your address. You control the recipients and the message.
YouTube: if you connect a YouTube channel, vvault uses YouTube API Services to upload and schedule the videos you prepare, update their details and read their statistics. By connecting it you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms); Google's Privacy Policy (https://policies.google.com/privacy) applies to Google's processing. You can revoke vvault's access at any time from Settings or from your Google account's security settings (https://myaccount.google.com/permissions); we then delete the stored tokens, and the data obtained from the API is deleted within 30 days unless you keep using it in vvault.
Instagram: if you connect an Instagram account, we access it through Meta's API only for the feature you use, and store the tokens needed for it.
Google Drive and Dropbox import: you pick files in the provider's own picker and they transfer into your library. We access only the files you select (for Google Drive, under the drive.file scope). vvault's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Desktop folder sync: files in the folders you choose are uploaded from your device and kept in sync.
WaveMatch: when you run WaveMatch, an audio excerpt of the track is sent to ACRCloud, a recognition service, to find similar recordings; ACRCloud does not keep it for its own purposes.
You can disconnect any of these at any time in Settings. Disconnecting stops future access; it does not undo transfers already made at your instruction.
11Payments
Subscriptions, purchases, payouts and refunds are processed by Stripe, and by Apple for in-app purchases on iOS. We receive payment status, amounts and related metadata. We never see or store full card numbers. The currency shown is based on your approximate region.
12Emails we send you
Service emails (verification codes, password resets, receipts, invoices, contract notices such as a renewal reminder or a change to these documents, security notices) are necessary to operate your account and have no unsubscribe. Tips, product news and offers always carry an unsubscribe link, and you can refuse them when you sign up. Every e-mail names the operator of vvault.
13ACreators' pixels
Some creators connect their own Meta pixel or Google tag to their vvault pages and storefront (a feature of the Ultra plan). If you accepted advertising cookies, vvault loads it on that creator's pages only and sends it the pages you view there and your storefront actions (viewing an item, adding to cart, checkout, purchase), without the page's query string and without your e-mail address. For this collection and transmission, vvault and the creator are joint controllers: vvault runs the consent and answers your requests about it at contact@vvault.app; the creator, and then Meta or Google, decide what happens to the data in their accounts. Refusing or withdrawing consent stops it.
The essence of our arrangement with creators (Art. 26(2) GDPR) is in section 13 of the Seller Terms (vvault.app/homepage/seller-terms): vvault is responsible for the consent banner, the information you receive here and requests concerning the collection; the creator is responsible for what they do with the data in their own Meta or Google account and for requests about that use.
14Transfers outside the EEA
Your content and account data are hosted in the EU (Supabase, AWS EU region). Audio files are stored with Cloudflare R2, a US company; some providers process limited data in the United States (e-mail delivery, payments, analytics, support).
Where that happens we rely on a transfer mechanism the GDPR recognises: an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified), or the European Commission's Standard Contractual Clauses with the additional measures the circumstances require. Write to us if you want to know which one applies to a specific provider.
15How long we keep things
Account and content: while your account is active. Deleted tracks and packs stay recoverable for 24 hours (Recently deleted), then are removed. After you delete your account, your personal data is deleted or anonymised within 30 days, and backups expire within a further 30 days.
Orders, invoices, licences and payout records: ten years from 1 January of the year after the transaction (Belgian accounting and VAT law), because they also evidence the other party's rights. The name and e-mail on them are kept with them.
Server and security logs: up to 90 days. IP address and browser user agent recorded with plays, opens, clicks and downloads: kept in full for 30 days (de-duplication, abuse and bot checks); after that the user agent is deleted and the IP address is shortened to its network (the last block is removed), which still shows the country; the shortened address is deleted after 12 months. Engagement events on shared content: while the account that shared it exists, then aggregated. Cookie-consent records: while your account exists and 5 years after the last change, to prove your choice. Lock activation records: see section 8A. Moderation records: while the account is active and as long as a case or legal obligation requires. Marketing-opt-out list: kept so we never e-mail you again.
16Security
Audio lives in private storage and is served through signed links that expire. Traffic is encrypted in transit, data is encrypted at rest, and direct messages carry additional safeguards. We apply technical and organisational measures appropriate to the risk.
No system is perfectly secure. Where the GDPR requires it, we notify the competent authority and, where the risk to you is high, you.
17Your rights
You can ask us to give you access to your data, correct it, delete it, give you a portable copy, restrict how we process it, or object to processing based on legitimate interests, including a straightforward right to object to direct marketing at any time. Where processing rests on consent, you can withdraw it at any time without affecting what came before.
Write to contact@vvault.app. We answer within one month, and tell you if we need longer or if we cannot act on a request and why. We may ask for information to confirm it is really you.
You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be), or to the supervisory authority where you live or work.
18Children
vvault is not for children under 16, and we do not knowingly process their data. If you believe a child has given us personal data, contact us and we will delete it.
19Changes and contact
We post changes here and update the date above. For material changes we tell you in the app or by email. Questions: contact@vvault.app, or Minderbroedersstraat 10, 8000 Brugge, Belgium.