Privacy

What we collect

• Snapshot report requests, the company and work email you give to open the written version of a free snapshot, together with the nine answers it was built from. Used to send you the document and to reply if you ask something. Not a marketing list, not enriched, not shared. The snapshot answers themselves are otherwise never transmitted: the findings are computed in your browser.
• Enquiry details, the work email, company, and answers you give in the form on the home page. Used to reply to you and for nothing else: not added to a marketing list, not enriched against a data broker, not shared. Deleted on request, and in any event within twenty-four months of the last contact.
• Account data, name, work email, organisation, authentication metadata.
• Profile content, the AI model records, evidence artifacts, policy claims and responses you create or upload.
• Share access logs, when a share link is opened, which items were viewed, and clarification requests. Disclosed to the publishing customer; this is a product feature and it is described to the reviewer on the page they open.

What we do not do

We do not train models on your content. We do not sell personal information. We do not use your content to improve the service for other customers. We do not place advertising or third-party analytics trackers on the application or on reviewer share pages.

Personal data inside evidence

Evidence artifacts may inadvertently contain personal data belonging to consumers, claimants or insureds. The service does not read or scan your documents: it withholds an artifact from sharing when you record that it contains such data, until you record that it has been redacted. This is a safeguard that depends on your record and not a guarantee; you remain the controller of that data and responsible for its lawful handling.

Retention

Share access logs: twenty-four months. A weekly job deletes rows past that window. Their purpose is to evidence what a reviewer saw and when, and the reviewer is a third party who never agreed to anything, so the period is enforced in the database rather than left to intention.

Profile content: until you delete it, or until you ask us to. We do not yet operate an automated lifecycle, so we will not pretend to one. A deletion request is actioned within thirty days and confirmed in writing.

We collect no product analytics and no usage telemetry, so there is no retention period to state for either.

Your rights

Depending on where you are, you may have rights to access, correct, delete, or export your personal information, and to object to certain processing. Write to support@vaulith.com, or (860) 980-7575, and we will respond within the period the applicable law requires.

Where data is processed

In the United States, by the subprocessors listed on our trust page.