Privacy notice.

01 · Scope

This notice applies to SecurityVault Systems Private Limited (“SecurityVault,” “we,” “us”) and the websites, products, and services we operate.

Who decides what happens to your data

• We are the Data Fiduciary for personal data we collect for our own purposes: website visitors, people who book a demo, request access or contact us, privacy requests and grievances, and the business contacts and billing details of our customers.
• Your organisation is the Data Fiduciary for the application. SecurityVault is an enterprise service: each customer onboards and offboards its own people, usually through its single sign-on, and decides what is kept. User accounts (name, email, single sign-on identifiers, roles) and everything the organisation puts into its tenant are processed by us as its Data Processor, under our contract and DPA with it. Your organisation's privacy notice governs that data; requests about it go to your organisation, and we help it answer them.

02 · What we collect

Information you give us

• Contact data. Work email, name, employer, role, optional phone number and the message you write — when you book a demo, request access, or contact support.
• Account data (as Data Processor). Name, email, single sign-on identifiers, role assignments and organisation metadata, provided by your organisation.
• Billing data. Billing contact and invoicing details. We invoice directly and do not store payment card numbers.
• Privacy requests. What you tell us when you exercise a right, raise a grievance or nominate someone, including the nominee's name, contact details and relationship to you.
• Consent records. When you give or withdraw consent: the time, the notice version you saw, the language, and each choice you made.

Information we collect automatically

• Edge request logs and security signals. Standard web-server and CDN logs (IP address, user agent, requested page), authentication events and suspicious-activity signals. Used only to secure and operate the service and retained briefly (see section 06).
• Product telemetry. Feature usage, performance metrics and error reports from the application — scrubbed of customer content.
• Website analytics — only if you agree. If, and only after, you turn on the “Analytics” category in Cookie settings, the website loads Cloudflare Web Analytics. It records the page address, the referring page, your browser's user agent and page-load timings; your IP address is processed by Cloudflare to deliver the measurement. It sets no cookies and is not used for advertising or cross-site tracking. Until you agree, the script is not loaded at all. The application does not run analytics.

Information we do not collect

• We do not buy personal data from data brokers.
• We do not send customer content to third-party AI providers — AI features run on models hosted inside our own infrastructure.
• We do not train models on customer data.

03 · Purposes and grounds

For each purpose we name the ground under India's Digital Personal Data Protection Act, 2023 (DPDP Act) — your consent (section 6) or a legitimate use (section 7) — and, in parentheses, the EU/UK GDPR basis for people those laws protect.

• Respond to your enquiry or access request — contact data. Ground: your consent, given on the form (GDPR: consent / steps before a contract).
• Deliver and secure the service — account data, security signals and edge logs, processed on your organisation's instructions as its Data Processor; for our own security logs, legitimate uses permitted by section 7, including compliance with law (GDPR: contract / legal obligation).
• Improve the product — aggregated product telemetry. Ground: the purpose for which your organisation's users voluntarily use the service under section 7(a) (GDPR: contract).
• Website analytics — only with your consent, given through Cookie settings (GDPR: consent).
• Invoices and tax — billing data. Ground: compliance with law (GDPR: legal obligation).
• Product news — only if you tick the optional box on a form; every message carries an unsubscribe link (GDPR: consent).
• Handle your privacy requests and grievances — the data you give us for that purpose. Ground: compliance with law (GDPR: legal obligation).

04 · Consent

• Separate and unticked. Forms ask for your consent to this notice with a box you tick yourself, separately from accepting the Terms where they apply. Product news is a separate, optional box.
• Itemised. Each form lists, next to the consent box, the personal data it collects and why, before you agree.
• Recorded. We keep a record of each consent: when it was given, the notice version, the language and the choices made.
• Withdrawn as easily as given. Change website analytics at any time with Cookie settings (linked in every page footer). Withdraw any other consent with the privacy request form or by email. Withdrawal stops the processing that relied on it; it does not affect processing before the withdrawal.

05 · Sharing & subprocessors

We share personal data only with subprocessors operating under written DPAs equivalent to our customer DPA. The current list is published at securityvault.io/subprocessors and updated with 30 days’ advance notice for material changes.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising.

We may disclose information when required by valid legal process. We require valid process, scope-narrow our response, notify the affected party unless legally prohibited, and intend to publish a transparency report.

06 · Retention & erasure

• Application accounts are kept for as long as your organisation keeps you as a user. Your organisation's administrator removes users; when it does, the account is erased.
• Billing records are retained for seven years for tax and accounting compliance.
• Enquiries and access requests are retained for two years from our last exchange with you, then erased.
• Product-news contacts are retained until you unsubscribe or for two years of inactivity, whichever is first.
• Security logs are retained for one year; signed evidence may be retained per customer DPA configuration.
• Privacy requests and consent records are retained for as long as we need to show how we handled them, and at least one year as the DPDP Rules require for related logs.

Notice before erasure. When we, as Data Fiduciary, are going to erase your personal data because its purpose has been served — rather than because you asked us to — we email you at least 48 hours before erasure, so you can tell us if you need it kept.

When a customer leaves

When a customer's contract ends, or the customer asks us to, we delete its tenant after a second administrator approves the deletion. A 30-day recovery window then applies: the tenant is locked — nobody can sign in and its scans and integrations stop — and, on the customer's request, it can be restored in full. When the window ends, all of that organisation's data is permanently and completely deleted from our production systems: user accounts, configuration, findings, evidence, audit records, stored files, and the credentials and keys held for it. We keep only an erasure record that proves the deletion and contains no customer data. Our backups are encrypted and expire on a rolling cycle, so copies of deleted data leave our database backups within 15 days and every other backup within 30 days after the deletion. Where the law requires us to keep a specific record (for example invoices), we keep only that record for the period the law sets.

07 · Your rights

You can ask us to:

• give you a summary of the personal data we process about you and the processing activities, and the identities of those we have shared it with;
• correct, complete or update inaccurate or incomplete data;
• erase data that is no longer needed, unless the law requires us to keep it;
• withdraw consent;
• register a nominee (section 08); and
• resolve a grievance.

Depending on where you live you may also have rights to portability, restriction or objection, and (in California) the rights to know, delete, correct and limit. We do not sell personal information or share it for cross-context behavioural advertising, and we honour Global Privacy Control signals.

How to make a request

• Website: the privacy request form — choose access, correction, erasure, withdrawal of consent, nomination or grievance.
• Application users: your account is managed by your organisation — ask its administrator to change or delete it. You can remove your name yourself at any time under Profile → Privacy & data. If you send us a request about application data, we pass it to your organisation and tell you we have done so.
• Email: privacy@securityvault.io, or grievance@securityvault.io for grievances.

We confirm the request comes from you using the email address and account records we hold, and ask for more only when strictly needed. We acknowledge requests and grievances within 72 hours and resolve them within 30 days. Requests are free. A jurisdiction-by-jurisdiction guide is at Your privacy choices; browser storage is documented in the cookie policy.

08 · Nomination

You may nominate another individual to exercise your rights if you die or become unable to do so through unsoundness of mind or bodily infirmity.

• Register: choose “Nominate a person” on the privacy request form, giving the nominee's name, email or phone number, and their relationship to you. You can change or cancel a nomination the same way. For application data, nominations are handled by your organisation.
• Confirm: we confirm the nomination with you by email and record it with your request history.
• Use: the nominee contacts privacy@securityvault.io with reasonable proof of the event and of their identity; we then act on their requests as we would on yours.

09 · International transfers

SecurityVault hosts the platform in India. Primary hosted tenant storage is in India. Network-edge processing and transactional email use the providers and locations listed in our subprocessor inventory; configured integrations and customer instructions may involve additional transfers. Where personal data of EEA, UK or Swiss data subjects is transferred to India, the transfer relies on Standard Contractual Clauses and supplementary measures (technical, organisational, contractual) as required by the Schrems II framework. Transfers out of India follow section 16 of the DPDP Act: we do not transfer personal data to any country or territory restricted by the Central Government.

10 · Security & personal data breaches

Data is encrypted in transit with TLS, both over public networks and between our internal services; our public endpoints accept TLS 1.2 or higher. We also use encryption at rest and hold keys in a dedicated secrets manager. Our security posture is documented on the Security page and the trust centre.

If a breach affects your personal data

If we become aware of a personal data breach affecting data for which we are the Data Fiduciary, we will, without delay, tell each affected person — by email or through the application — and the Data Protection Board of India. Our message to you will set out, in clear and plain language:

• what happened: the nature and extent of the breach, and when and where it occurred;
• the consequences relevant to you that are likely to arise from it;
• the measures we have taken or are taking to reduce the risk;
• the steps you can take to protect yourself; and
• how to contact us about it.

We give the Board a detailed report within 72 hours of becoming aware of the breach (or any longer period the Board allows), report cyber incidents to CERT-In within 6 hours as Indian law requires, and notify other supervisory authorities and people where their laws require it. Where we process data for a customer, we notify that customer under our DPA so it can meet its own obligations.

11 · Children and persons with disability

SecurityVault is a business service and is not directed at children. Our forms ask you to confirm you are 18 or older. We do not knowingly process the personal data of a child (anyone under 18 in India, or under 16 elsewhere) without the verifiable consent of a parent or lawful guardian.

• Parental consent route. A parent or lawful guardian may contact us through the privacy request form on a child's behalf. Before acting, we verify that they are an identifiable adult — using details we already hold or details and documents they provide — as the DPDP Rules require. The same applies to a lawful guardian acting for a person with a disability.
• No tracking of children. We do not track or behaviourally monitor children, and we do not direct targeted advertising at them.
• If you believe we hold a child's personal data without such consent, contact us and we will erase it.

12 · India — DPDP Act

For Data Principals in India, SecurityVault Systems Private Limited is the Data Fiduciary for personal data we collect for our own purposes (section 01), and a Data Processor for application accounts and customer tenant data under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The Act has a phased commencement schedule; we already provide the rights and contact routes in this notice.

Grievances and the Data Protection Board of India

Raise a grievance with our Privacy & Grievance Team at grievance@securityvault.io or through the privacy request form. We acknowledge it within 72 hours and resolve it within 30 days. If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India, established under section 18 of the DPDP Act, using the online process the Board publishes. The Act asks you to use our grievance route first.

Language

This notice is provided in English. On request we will provide it in any language listed in the Eighth Schedule to the Constitution of India.

13 · Contact

Privacy & Grievance Team
SecurityVault Systems Private Limited
India
grievance@securityvault.io

Requests to exercise your rights: privacy@securityvault.io or the privacy request form. Data protection questions: dpo@securityvault.io.

EU / UK representatives: none appointed yet. Until a representative is named here, EU and UK data subjects should write to privacy@securityvault.io and may lodge a complaint with their national supervisory authority.

14 · Changes

When we change this notice we update the version and date above. If a change affects what you consented to, we ask again before relying on it; material changes are also announced on the changelog.