Privacy Policy

Introduction and Commitment to Privacy

At Vaultix Wallet, privacy is not an afterthought-it's foundational to our product design and business philosophy. We believe that true self-custody extends beyond protecting your cryptographic keys to protecting your personal data.

Our Privacy Principles:

• Data Minimization: We collect only what is necessary to provide our services
• Zero Telemetry Hardware: Our hardware wallet collects no usage data, ever
• Transparency: We clearly communicate what data we collect and why
• User Control: You have complete control over your personal information
• Security First: All collected data is protected with industry-leading encryption

This Privacy Policy explains our data practices for the Vaultix website and pre-order process. Please note that the Vaultix hardware device itself operates with zero data collection-details in Section 4 below.

1. Data Collection Practices

What is Personal Data?

Personal data is any information that relates to an identified or identifiable individual. At Vaultix, we distinguish between two categories:

3. How We Store and Protect Your Data

Security Measures

We implement industry-standard security practices to protect your personal information:

• Encryption in Transit: All data transmitted to our servers uses TLS 1.3 encryption
• Encryption at Rest: Pre-order data is stored in encrypted databases with AES-256 encryption
• Access Control: Only authorized personnel with business need can access customer data
• Security Audits: Regular third-party security assessments of our infrastructure
• Data Segregation: Customer data isolated from marketing and analytics systems

Third-Party Service Providers

We use carefully vetted service providers to operate our website and pre-order system. These providers have access to limited data only as necessary to perform their functions:

Data Processing Agreements: All service providers sign Data Processing Agreements (DPAs) committing to GDPR-compliant data handling, security standards, and prohibiting unauthorized use of customer data.

Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we commit to:

• Notify affected users within 72 hours of breach discovery
• Report breach to relevant supervisory authorities as required by law
• Provide clear information about what data was compromised and steps you should take
• Implement immediate remediation measures to prevent further unauthorized access

5. Third-Party Service Providers

This section provides detailed information about external services that process personal data on behalf of Vaultix:

Email Marketing Platform

Provider: [Email service provider name]
Purpose: Sending pre-order confirmations, shipping notifications, and optional product updates
Data Shared: Email address, first name (if provided), country
Data Location: EU and US data centers (GDPR-compliant)
Privacy Policy: View provider privacy policy

Web Analytics

Provider: [Privacy-focused analytics platform]
Purpose: Understanding website traffic patterns to improve user experience
Data Shared: Anonymized page views, device type, referral source (no personal identifiers)
Cookie-less Tracking: Uses privacy-respecting methods without persistent cookies
Privacy Policy: View provider privacy policy

Web Hosting and CDN

Provider: [Hosting provider name]
Purpose: Secure website hosting and content delivery
Data Shared: Standard server logs (IP addresses, access times) retained for 30 days for security purposes
Data Location: EU and US data centers with GDPR compliance
Privacy Policy: View provider privacy policy

We Do NOT Share Data With:

• Social media platforms for advertising or tracking purposes
• Data brokers or marketing aggregators
• Government agencies (except when legally required by valid court order)
• Cryptocurrency exchanges or blockchain analytics companies
• Any third party for purposes unrelated to providing Vaultix services

7. Your Privacy Rights

Under data protection laws (GDPR, CCPA, and similar regulations), you have the following rights regarding your personal data:

Right to Access

What it means: You can request a copy of all personal data we hold about you.

How to exercise: Email privacy@vaultix.com with subject line "Data Access Request". We will provide your data in a commonly used electronic format within 30 days.

Right to Rectification

What it means: You can request correction of inaccurate or incomplete personal data.

How to exercise: Email privacy@vaultix.com specifying what information needs correction. We will update your data within 14 days.

Right to Erasure ("Right to be Forgotten")

What it means: You can request deletion of your personal data when it's no longer necessary for the purposes it was collected.

How to exercise: Email privacy@vaultix.com with subject line "Data Deletion Request". We will delete your data within 30 days, except where legal retention requirements apply (e.g., tax records).

Right to Data Portability

What it means: You can request your data in a machine-readable format to transfer to another service provider.

How to exercise: Email privacy@vaultix.com with subject line "Data Portability Request". We will provide your data in JSON or CSV format within 30 days.

Right to Object

What it means: You can object to data processing based on legitimate interests or for direct marketing purposes.

How to exercise: Click "Unsubscribe" in any marketing email, or email privacy@vaultix.com. Marketing opt-out takes effect immediately.

Right to Restrict Processing

What it means: You can request temporary restriction of data processing in specific circumstances (e.g., while disputing data accuracy).

How to exercise: Email privacy@vaultix.com explaining the circumstances. We will respond within 14 days.

Right to Withdraw Consent

What it means: Where data processing is based on consent, you can withdraw that consent at any time.

How to exercise: Use unsubscribe links in emails, or contact privacy@vaultix.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

9. GDPR and International Compliance

GDPR Compliance (European Union)

Vaultix complies with the General Data Protection Regulation (GDPR) for all users, regardless of location. Key GDPR commitments:

• Lawful Basis: All data processing has a lawful basis (consent, contract, or legitimate interest)
• Data Minimization: We collect only data necessary for specified purposes
• Purpose Limitation: Data used only for purposes disclosed at collection time
• Storage Limitation: Data deleted when no longer needed (see Section 8)
• Integrity and Confidentiality: Appropriate security measures protect your data
• Accountability: We maintain records demonstrating GDPR compliance

CCPA Compliance (California, USA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, and shared
• Right to delete personal information (with certain exceptions)
• Right to opt-out of "sale" of personal information (Note: Vaultix does not sell personal information)
• Right to non-discrimination for exercising CCPA rights

To exercise CCPA rights, email privacy@vaultix.com with subject line "CCPA Request".

International Data Transfers

Vaultix is headquartered in [Country]. Pre-order data may be processed in the following locations:

• European Union: Primary data storage in EU data centers (GDPR-compliant)
• United States: Backup systems and certain service providers (Standard Contractual Clauses in place)

Data Transfer Mechanisms: When data is transferred outside the EU/EEA, we use approved transfer mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Service providers with EU-US Data Privacy Framework certification (where applicable)
• Supplementary measures ensuring adequate protection (encryption, access controls)

Other Jurisdictions

Vaultix respects data protection laws in all jurisdictions where we operate, including:

• UK GDPR: Post-Brexit UK data protection regulation (equivalent to EU GDPR)
• Canada (PIPEDA): Personal Information Protection and Electronic Documents Act
• Australia (Privacy Act): Australian Privacy Principles compliance
• Brazil (LGPD): Lei Geral de Proteção de Dados compliance for Brazilian users

11. Privacy Inquiries and Contact

What to Include in Your Privacy Request

To help us process your request efficiently, please include:

• Your full name and email address associated with your Vaultix account/reservation
• Specific nature of your request (access, deletion, correction, etc.)
• Any relevant details to help us locate your information
• Preferred format for data delivery (if requesting access or portability)

Identity Verification: For security reasons, we may ask you to verify your identity before processing requests that involve accessing or deleting your data. This typically involves confirming details from your pre-order registration.

Supervisory Authority Contact

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority:

• EU Residents: Contact your national Data Protection Authority (Find your authority)
• UK Residents: Information Commissioner's Office (ICO) - ico.org.uk
• US Residents: Federal Trade Commission (FTC) - ftc.gov

We encourage you to contact us first so we can address your concerns directly before escalating to regulatory authorities.