Privacy Policy

1. Scope and Entity Identification

This policy applies to all visitors, registered early-access users, Closed Beta testers, and end users of Vault Vole. By accessing our website or utilizing our Android application, you acknowledge that you have read, understood, and consented to the data practices described herein. If you do not agree with this policy, you must refrain from using the website and uninstall the application.

For the purposes of applicable data protection legislation (including the EU/UK General Data Protection Regulation and the California Consumer Privacy Act), the Data Controller is Vault Vole Operations. Official inquiries may be directed to privacy@vaultvole.com.

2. Architecture & Privacy-First Principles

Vault Vole was engineered from the ground up to solve the "bookmark graveyard" dilemma without turning user attention and behavioral data into an advertising commodity. Our core operational principles are:

3. Categories of Information Collected

We only collect information necessary to deliver, maintain, and authenticate your experience with Vault Vole:

4. Information We Explicitly DO NOT Collect

To protect your privacy and ensure compliance with global data protection frameworks:

• No Social Media Authentication Credentials: We never ask for, intercept, scrape, or store your passwords, authorization tokens, or session cookies from Instagram, Meta, TikTok, or Google.
• No Private Direct Messages or Friends Lists: We do not have access to your personal direct messages, private social feeds, followers, or address books.
• No Precision Geolocation: We do not track or store your GPS coordinates or live location.
• No Biometric or Sensor Data: We do not record or analyze your fingerprint, face data, or camera/microphone outside the specific context of in-app video review initiated explicitly by you.

5. Legal Bases for Processing (GDPR Compliance)

Under the European Union and UK General Data Protection Regulation (GDPR), we process your personal data under the following lawful bases:

• Consent (Art. 6(1)(a) GDPR): When you explicitly submit your email address to join the waitlist, subscribe to updates, or participate in beta testing.
• Contractual Performance (Art. 6(1)(b) GDPR): To authenticate your account, verify your eligibility for the Lifetime Founder Pass, and deliver the core functionality of the Vault Vole application.
• Legitimate Interests (Art. 6(1)(f) GDPR): To prevent fraudulent queue submissions, secure our application infrastructure, monitor crashes, and enhance software performance.

6. Purpose and Use of Collected Data

We utilize your personal information exclusively for the following operational purposes:

1. Issuing your unique waitlist queue position (#1 through #500) and dispatching your Founder Pass confirmation email.
2. Enrolling your Google Play email address into the closed Android beta testing track.
3. Transcribing, formatting, and generating structured step-by-step blueprints from the public videos you choose to save.
4. Enabling conversational search and semantic querying across your personal collection of saved blueprints.
5. Responding to user technical support and bug report inquiries.

7. Artificial Intelligence & Content Blueprinting Disclosures

Vault Vole utilizes advanced natural language models and neural speech recognition technologies to parse spoken dialogue and extract structured knowledge from short-form video URLs.

8. Third-Party Subprocessors & Integrations

To maintain high reliability and strict security, Vault Vole relies on vetted infrastructure subprocessors bound by strict Data Processing Agreements (DPAs):

9. Data Security & Storage Standards

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All HTTP communications with our servers are enforced via HTTPS using Transport Layer Security (TLS 1.3).
• Encryption at Rest: Database records and cloud backups are encrypted using AES-256 standard encryption.
• Principle of Least Privilege: Access to backend database systems and API keys is strictly restricted to authenticated production servers with automated rotation.

10. Data Retention & Account Deletion Rights

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy or as required to meet legal obligations.

You have the right to request the permanent deletion of your email address, waitlist position, and all associated curations at any time. To exercise your right to deletion, send an email from your registered address to privacy@vaultvole.com with the subject line "Data Deletion Request". We will purge your records from our active databases within thirty (30) days of identity verification.

11. European Privacy Rights (GDPR & UK GDPR)

If you reside in the European Economic Area (EEA) or the United Kingdom, you possess guaranteed statutory rights under Chapter III of the GDPR:

• Right of Access (Art. 15): Obtain confirmation of whether your data is processed and request a portable copy.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal records.
• Right to Erasure (Art. 17): Request permanent erasure of your personal data ("Right to be Forgotten").
• Right to Restriction of Processing (Art. 18): Request temporary limitation on the processing of your data.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to data processing predicated upon our legitimate interests.
• Right to Withdraw Consent: Withdraw previously granted consent at any time without retroactive invalidation.

You also have the right to lodge a complaint with your local Data Protection Authority (DPA) if you believe our data processing violates applicable European law.

12. California Consumer Privacy Rights (CCPA / CPRA)

This section supplements our policy for California residents pursuant to the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act (CPRA):

13. Children's Online Privacy (COPPA Compliance)

Vault Vole is strictly intended for individuals aged 13 and older (or 16 and older in jurisdictions where local legislation mandates a higher age threshold). We do not knowingly collect, solicit, or maintain personally identifiable information from children under 13 years of age. If we learn that personal data belonging to a minor under 13 has been submitted without verifiable parental consent, we will immediately delete that information from our active databases. Parents or guardians who believe their child has registered may contact us at privacy@vaultvole.com.

14. Google Play Store & Android Platform Policy Disclosures

In accordance with Google Play Developer Program Policies and the Google Play Data Safety section requirements:

• App Permissions: Vault Vole requests only the minimum runtime permissions necessary to function (e.g., Internet access to resolve public links and download updates, and Android Scoped Storage to save downloaded offline blueprints).
• No Background Location or Microphone Access: We do not request or utilize `ACCESS_FINE_LOCATION`, `RECORD_AUDIO`, or `CAMERA` in background processes.
• Google Play Billing & License Verification: Lifetime Founder Pass unlocks and future Pro licenses are validated directly through the Google Play licensing APIs.

15. Policy Revisions & Contact Information

We reserve the right to modify or amend this Privacy Policy at our discretion to reflect evolving regulatory frameworks, technical updates, or feature additions. Material modifications will be announced via our website or via direct email notification to registered waitlist members. The date at the top of this document indicates when it was most recently revised.