Privacy Policy

1. Who We Are

Vaulter ("we", "us") is a platform at vaulter.run where you describe an application and we build, host, and publish it for you. This policy explains what personal data we collect, how we use it, and the choices you have. You can reach us about anything in this policy at team@vaulter.run.

2. Data We Collect

Account data: your name, email address, and sign-in credentials (including sign-in via Google or other identity providers). Billing data: your plan, payments, and invoices, processed by Stripe; we never store your full card number. Content: the projects, prompts, code, files, and settings you create on the platform. Connected service data: when you connect a third-party service to a project, we store the connection metadata and, on your request, fetch data from that service (described in sections 5 and 6). Usage and technical data: build and deployment activity, API call logs, IP address, browser, and device information used to operate, meter, rate-limit, and secure the Service.

3. How We Use Data

We use data to provide and improve the Service, to build and run the apps you ask us to build, to bill you, to enforce plan limits and prevent abuse, to communicate with you about the Service, and to comply with legal obligations. We do not sell your personal data, and we do not use your data for third-party advertising.

4. AI Processing

Vaulter is an AI-powered product. Your prompts, project content, and, when you explicitly request it, data from services you have connected are sent to the AI providers Vaulter uses, currently Anthropic and OpenAI, to generate code and responses. We send this data through their commercial APIs. Anthropic's commercial terms do not allow it to train models on data sent through its API, and OpenAI does not use data sent through its API to train its models unless the customer chooses to share it. These providers may keep data for a limited time to detect abuse, as their own terms describe. We do not use your content or your connected service data to train AI models.

5. Connected Third-Party Services

You can connect a third-party service (for example Google Calendar, Notion, or Stripe) by signing in to it on the provider's own consent screen (OAuth) or by entering an API key. A connection is either personal, which only you can use, or a workspace connection, which the workspace's owners and admins manage and make available to the workspace's projects. Vaulter requests the permissions set for that service, and the provider shows them on its consent screen before you agree.

Where credentials are kept. Access tokens, refresh tokens and API keys are encrypted by Vaulter before they are stored in Vaulter's database, and each one can only be decrypted for the connection it was stored for. Stored credentials are used only on Vaulter's servers. They are never sent to your browser, never placed in your app's code, and never shown to your app's visitors.

How a connection is used. The Vaulter AI assistant reads from or acts on a connected service when you ask it to, within the permission level you set for that connection, and it asks you before making changes unless you have allowed it to make them. An app you build calls a connected service only through the actions approved for that app, and a published app only through the actions approved when it was published. Every call is checked on our servers at the moment it is made, and calls are recorded in an activity log. The log records the connection, the action, the time and the outcome. It does not keep the content sent or returned.

Disconnecting. When you disconnect a service, Vaulter deletes the credentials it stored, and apps that used it can no longer call it. Where the provider supports it, Vaulter also asks the provider to withdraw Vaulter's access. Some providers, Google among them, use one sign-in for several services: removing one of those services deletes Vaulter's access to it but leaves the sign-in in place for the others, and disconnecting the account asks the provider to withdraw the whole sign-in. For an API key, Vaulter deletes its copy, and the key keeps working at the provider until you delete it there. Disconnecting does not remove data that an app already saved in its own database, or that you copied elsewhere; delete that data in the app, or delete the app.

You can also withdraw Vaulter's access at any time from the provider's own security settings, for Google at https://myaccount.google.com/permissions.

6. Google User Data

Vaulter's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. This applies to Google sign-in and to the Google services you connect, such as Google Calendar, Google Drive and Google Sheets. We use Google data only to provide the features you ask for in Vaulter and in the apps you build. We transfer it to others only as needed to provide those features (for example, to the AI provider answering a request in which you asked the Vaulter AI assistant to read your Google data), for security, or as required by law. We do not use it for advertising, we do not sell it, and we do not allow humans to read it except with your permission, for security purposes, or where required by law. Google user data is never used to develop, improve or train AI models.

7. Service Providers

We rely on a small set of infrastructure providers that process data on our behalf: Supabase (database, authentication, storage), Vercel (application hosting), Cloudflare (app delivery, previews, thumbnails), Stripe (payments), Resend (transactional email), and the AI providers listed in section 4. Each processes data only as needed to provide their service to us and is governed by its own privacy and security commitments.

8. Apps You Publish

Apps built on Vaulter can be published to the web and can have their own users and data. For those apps, the app owner (you) decides what data the app collects and is responsible for it; Vaulter processes that data as infrastructure on the owner's behalf. If you are an end user of an app built on Vaulter, the app's owner is your first point of contact for privacy questions about that app.

9. Retention and Deletion

We keep your data while your account is active. Connected accounts belong to you or to your workspace, not to a project, so deleting a project does not disconnect them; disconnect a service as described in section 5. If you delete a workspace, its connections are ended and their stored credentials deleted. If you delete your account, your connections are ended and their stored credentials deleted, and we delete or de-identify your personal data within a reasonable period, except where we must retain records for legal, billing, or security reasons. You can request deletion at any time at team@vaulter.run.

10. Security

We protect data with encryption in transit, encrypted secret storage, scoped and audited access to third-party connections, server-side enforcement of access rules, and rate limiting. No system is perfectly secure, but security is a core design constraint of the platform, and we review it continuously.

11. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can manage most data directly in your account settings, and you can contact us at team@vaulter.run to exercise any of these rights. We respond to verified requests within the timeframes required by applicable law.

12. Changes

We may update this policy as the Service evolves. If we make material changes, we will notify you by email or an in-product notice before they take effect. The date at the top of this page shows when it was last revised.

13. Contact

For privacy questions or requests, email team@vaulter.run.