Privacy Policy

Effective date: 1 January 2025  ·  Last updated: 1 June 2025

VaultNX Security ("we", "our", "us") operates the website at www.vaultnx.com and the VaultNX desktop application (together, the "Service"). This Privacy Policy explains what personal information we collect, how we use it, and your rights — with specific reference to the personal data laws of Singapore (PDPA), Malaysia (PDPA 2010), the Philippines (Data Privacy Act 2012), Indonesia (PDP Law 2022), and Thailand (PDPA 2019). If you are located in another jurisdiction, the most protective standard described here applies to you.

1. Information We Collect

Account and purchase data. When you purchase a license or register a free trial, we collect your name, business email address, company name (optional), country, and payment confirmation details. Payment card data is processed exclusively by PayPal and is never transmitted to or stored by VaultNX.

License activation data. When the VaultNX application activates a license, it sends your license key, a machine fingerprint (a one-way hash of hardware identifiers — not reversible to device details), your Windows username hash, and your IP address to our license server at lic.vaultnx.com. This is required to enforce seat limits and detect unauthorised transfers.

Support communications. If you contact us via the support form or email, we retain your name, email address, and the content of your message for the purpose of resolving your request.

Partner application data. If you apply to become a reseller partner, we collect your name, company, country, email, phone number, and business details you provide.

Website analytics. We collect standard server access logs (IP address, browser type, pages visited, referrer) for security monitoring and aggregate traffic analysis. We do not use third-party behavioural tracking cookies or advertising networks.

What we do not collect. We do not collect, process, or have any access to the files you store in your vault, your master password, your encryption keys, or any NAS credentials you configure in the application. All vault data is stored exclusively on your own hardware.

2. Legal Basis and Purpose of Processing

We process personal data only for the following purposes and only where we have a lawful basis to do so:

• Contract performance — fulfilling your license purchase, activating your license, and providing software updates.
• Legitimate interest — fraud prevention, license integrity enforcement, and security monitoring of our servers.
• Consent — sending promotional communications (you may withdraw consent at any time).
• Legal obligation — retaining transaction records as required by applicable tax and commercial laws.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data only with:

• PayPal — to process payments. Their privacy policy governs data they collect.
• Authorised reseller partners — only when you purchase through a partner channel; limited to order fulfilment data.
• Law enforcement or regulators — only when required by a valid legal order issued in a jurisdiction where we operate.

All third-party processors are bound by data processing agreements and are prohibited from using your data for their own purposes.

4. Cross-Border Data Transfers

Our license server and web infrastructure are hosted on servers based in Singapore. If you access the Service from Malaysia, the Philippines, Indonesia, Thailand, or another country, your personal data will be transferred to and processed in Singapore. Singapore's PDPA provides a framework substantially equivalent to the data protection laws of ASEAN member states. We rely on standard contractual obligations and, where applicable, adequacy determinations to legitimise such transfers.

5. Data Retention

License activation records are retained for the duration of your active license plus 2 years, to support license recovery requests. Purchase records are retained for 7 years to comply with tax and financial regulations. Support correspondence is retained for 3 years. Website access logs are rotated after 90 days. You may request earlier deletion subject to the exceptions in Section 7.

6. Security

All data in transit is encrypted using TLS 1.2 or higher. License server data is stored in a password-protected database on a hardened server. Access to personal data is restricted to authorised personnel on a need-to-know basis. We conduct periodic security reviews. In the event of a data breach affecting your personal information, we will notify you within the timeframes required by applicable law (72 hours under Thailand PDPA; as soon as practicable under PDPA SG, MY, PH, and ID).

7. Your Rights

Depending on your jurisdiction, you have some or all of the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion / Erasure — request deletion of your personal data, subject to our legal retention obligations.
• Portability — receive your data in a structured, machine-readable format.
• Objection / Restriction — object to or restrict processing based on legitimate interest.
• Withdrawal of consent — withdraw consent for marketing communications at any time.
• Complaint — lodge a complaint with the relevant data protection authority in your country.

To exercise any of these rights, email privacy@vaultnx.com. We will respond within 30 days.

8. Cookies

Our website uses only technically necessary cookies (session state, CSRF tokens). We do not use advertising cookies, remarketing pixels, or cross-site tracking technologies. No cookie consent banner is required for technically necessary cookies under applicable Asian privacy laws; however, you may block all cookies in your browser settings and the website will remain functional.

9. Children's Privacy

VaultNX is a business software product not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18 without verifiable parental consent, we will delete that data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated effective date. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact

For privacy-related enquiries, data subject requests, or complaints:

VaultNX Security
Email: privacy@vaultnx.com
Website: www.vaultnx.com