Legal

Privacy Policy

⚠️ Draft. This policy describes how VaultDocAI works today. It must be reviewed by a qualified lawyer and the placeholders in [brackets] filled in before public launch.

Last updated: [date]

This policy explains what personal data VaultDocAI ("we") collects, why, and the choices you have. VaultDocAI is operated by [legal entity name], [address], India. We act as the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. What we collect

  • Account details: your name, email address and, if you sign in with Google, your Google profile photo.
  • Your files: documents you upload, their names, folders, sizes, types and upload dates.
  • Secure Vault: files and their names are encrypted on your device before upload. We store only encrypted data and cannot read it. Your recovery key and PIN never reach us.
  • Usage records: how much storage you use and how many files you have.
  • Technical data: basic logs (such as IP address and timestamps) kept by our infrastructure providers for security and reliability.

2. Why we use it

  • To create and secure your account and let you sign in.
  • To store your files and show them only to you.
  • To enforce storage limits and keep the service reliable.
  • To send essential emails, such as verification, password reset and PIN reset links.

We do not sell your personal data and do not use your documents for advertising. [If AI features are added: describe how documents are processed and whether any third-party AI provider receives them.]

3. Where your data is stored

Your files and records are stored with Google Cloud / Firebase in the asia-south2 (Delhi, India) region. Google acts as our data processor. Sign-in is handled by Firebase Authentication.

4. On your device

We store small pieces of data in your browser: your sign-in session, your theme choice, and, if you use the Secure Vault, an encrypted copy of your vault key protected by your PIN. We do not use advertising or tracking cookies.

5. How long we keep it

We keep your data while your account exists. When you delete a file, it is removed from storage. When you delete your account (Account → Delete account), all your files, vault data, records and your sign-in account are deleted. Backups or logs held by our providers may persist for a limited period [specify].

6. Your rights

Under the DPDP Act you can:

  • access a summary of your personal data and how it is processed;
  • correct or update it (for example your name);
  • erase it, including by deleting your account at any time;
  • withdraw consent, which may mean closing your account;
  • nominate another person to exercise your rights in case of death or incapacity;
  • raise a grievance with us, and then with the Data Protection Board of India.

7. Security

Access to each account's data is restricted by server-side security rules, data is encrypted in transit and at rest by our providers, and Secure Vault files are end-to-end encrypted. No system is perfectly secure; please use a strong password and keep your recovery key safe.

8. Children

VaultDocAI is not intended for anyone under 18 without verifiable consent of a parent or lawful guardian, as required by the DPDP Act.

9. Contact and grievances

Grievance Officer: [name], [email], [address]. We aim to respond within [timeframe].

10. Changes

We will post updates here and notify you by email of significant changes.