Your privacy choices.

01 · Summary

• We do not sell personal information and do not share it for cross-context behavioural advertising — so there is no "Do Not Sell or Share" toggle to flip; the opt-out is permanently on by construction.
• We honour Global Privacy Control (GPC) signals. Because we do not sell or share, a GPC signal changes nothing about how your data is handled — it is already treated that way.
• We do not use personal data for automated decisions that produce legal or similarly significant effects, and we do not profile visitors.
• Make a request with the privacy request form or at privacy@securityvault.io. We acknowledge within 72 hours and answer within 30 days, or sooner where law requires.
• Website analytics runs only if you turn it on, and you can turn it off again in Cookie settings.
• Application users: your account is provided and managed by your organisation, which is responsible for it. Ask your organisation's administrator to change or delete it; you can remove your name yourself under Profile → Privacy & data.

02 · United States (CCPA/CPRA and state privacy laws)

If you are a resident of California or another US state with a comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you have the right to:

• Know / access — the categories and specific pieces of personal information we hold about you, the sources, purposes, and disclosures.
• Delete — request deletion, subject to legal retention obligations (for example, billing records).
• Correct — fix inaccurate personal information.
• Portability — receive your data in a usable format.
• Opt out of sale/sharing and targeted advertising — not applicable in practice: we do not sell, share, or use personal information for targeted advertising, and this is a binding commitment in our privacy notice.
• Limit use of sensitive personal information — we do not collect sensitive personal information on this site.
• Non-discrimination — exercising any right never affects pricing or service quality.

Notice at collection (California)

Categories collected: identifiers (name, work email) and professional information (employer, role) — only when you submit a form; internet activity (server logs for security, and cookieless page-performance measurement provided by Cloudflare). Purposes: responding to you, providing the service, security, and keeping the site fast and reliable. Retention: per the schedule in the privacy notice. Sold or shared: none.

03 · EU / UK / EEA (GDPR)

Under the EU/UK GDPR you may access, rectify, erase, or port your personal data; restrict or object to processing (including any processing based on legitimate interest); and withdraw consent at any time without affecting prior processing. Legal bases per purpose are listed in the privacy notice.

We have not appointed an EU or UK representative under Article 27 of the GDPR or the UK GDPR. Contact us directly at privacy@securityvault.io, or our privacy and data protection team at dpo@securityvault.io (further details are in the privacy notice), and you may lodge a complaint with your national supervisory authority at any time.

04 · India — Digital Personal Data Protection Act, 2023

For Data Principals in India, SecurityVault Systems Private Limited acts as a Data Fiduciary for personal data collected through this website and as a Data Processor for customer tenant data. The Act has a phased commencement schedule; we already provide the rights below for personal data we hold as Data Fiduciary. Use the privacy request form for any of them:

• Access — a summary of your personal data being processed and the processing activities.
• Correction and erasure — update, complete, or erase personal data you provided.
• Grievance redressal — a readily available means to raise a grievance, answered within the statutory period.
• Nominate — designate another individual to exercise your rights in the event of death or incapacity; see how nomination works.
• Withdraw consent — as easily as it was given: Cookie settings for analytics, the request form or email for anything else. Withdrawal stops the processing that relied on it.

Grievance contact (India)

Privacy & Grievance Team, SecurityVault Systems Private Limited
grievance@securityvault.io · privacy request form
We acknowledge grievances within 72 hours and resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India using the online process the Board publishes.

Our service is not directed at children. We do not knowingly process a child's personal data without verifiable consent from a parent or lawful guardian, we do not track or behaviourally monitor children, and we do not serve targeted advertising to anyone. Parents and lawful guardians can contact us through the privacy request form.

05 · How to exercise a request

• Online — the privacy request form.
• Email privacy@securityvault.io from the address your request concerns, stating the right you want to exercise and your jurisdiction.
• Application data — your organisation controls it. We pass any request about it to your organisation and tell you we have done so.
• Verification — we verify requests against the email address and account records on file; we ask for additional proof only when strictly needed and never request government ID for routine requests.
• Authorised agents (California) — agents may submit on your behalf with signed permission; we will confirm directly with you.
• Timeline — acknowledgement within 72 hours; substantive response within 30 days (45 with notice, where the law allows an extension).
• No fee — requests are free unless manifestly unfounded or excessive, in which case we explain before anything is charged.

06 · Appeals

If we decline a request in whole or part, we explain why and how to appeal. Reply to our decision or write to privacy@securityvault.io with the subject "Appeal"; a person not involved in the original decision reviews it within 30 days. You may also contact your supervisory authority (EU/UK), state attorney general (US), or the Data Protection Board of India where the relevant complaint procedure applies and is in force.