Vaultland Privacy Notice
Version 1.1 — Final
Effective: 9 October 2026
This Privacy Notice explains how Vaultland handles Personal Data for its own account, service administration, security, support and legal obligations, and how that differs from Vaultland's processor/service-provider role for Customer-controlled Data Room content.
This Notice is provided for transparency. Displaying or reading it is not a request for consent to optional marketing, advertising or unrelated processing.
1. Who is responsible
For Personal Data Vaultland processes for its own account administration, security, billing, support, legal compliance and business operations, the controller/business is Vaultland, operated by the contracting provider identified in the applicable Order Form, invoice or account contracting record. Vaultland can be contacted through the Vaultland in-app Help/Support channel or by email at admin@vaultland-vdr.com (service: vaultland-vdr.com; public website: vaultland.net).
For Personal Data contained in Customer-controlled Data Rooms, the relevant Customer Organization generally determines the purposes and essential means of processing and acts as controller/business/controlador. Vaultland generally acts as processor/service provider/operador under the Vaultland Master Service & Data Protection Terms.
2. Personal Data we process
Depending on your relationship with Vaultland, we may process name, email, organization and professional role; account/authentication identifiers; Organization/Data Room memberships, roles, groups and permissions; subscription/lifecycle/support/billing metadata; NDA and legal-document acceptance evidence; Q&A and document-action metadata; audit/access/security events; IP address, user-agent and browser/device information; and support communications.
Customer Data may contain additional Personal Data selected and controlled by the Customer. Customers are responsible for data minimization and lawful disclosure of that data.
3. Why we process Personal Data
We process account/service data to create/administer accounts; authenticate users; provide and support the Service; manage Organizations/subscriptions/lifecycle states; prevent fraud, abuse and unauthorized access; maintain contractual/NDA/audit evidence; respond to support; comply with law; establish/defend legal claims; and improve reliability/security.
Depending on jurisdiction and activity, lawful grounds may include contract/performance, pre-contract steps, legal obligations, legitimate interests and other lawful bases. Where a specific optional activity legally requires consent, Vaultland will request consent separately.
4. Customer Data
When Vaultland processes Personal Data contained in Customer-controlled Data Rooms on the Customer's documented instructions, the processing is governed by the data-processing provisions of the Vaultland Master Service & Data Protection Terms. Vaultland does not use Customer Data for unrelated advertising or to determine the Customer's transaction decisions.
5. Hosting, subprocessors and transfers
Vaultland uses Microsoft Azure Blob Storage for uploaded VDR documents and generated PDFs, and Base44 (a Wix company) for the application, backend functions, application database, authentication and related platform services. Adobe PDF Services processes files submitted for document conversion and protected-preview preparation through Vaultland Converter.
Document storage location is distinct from the location of application execution, temporary processing, account data, document metadata, audit records and support operations. Files may pass through application backend services when uploaded, converted, viewed or downloaded. Azure storage does not, by itself, mean that all processing takes place in the EEA or that international transfers are eliminated. The current Azure document-storage account is configured in North Europe (Ireland, European Union) with zone-redundant storage (ZRS). Its redundancy replicas remain within that region; this configuration does not enable geo-redundant replication to a secondary region. This describes the location of stored document objects and their ZRS replicas, not an undertaking that all application services, temporary processing, support access or other data remain exclusively in the EEA. Material changes to this documented storage arrangement will be addressed through the applicable contractual notice and subprocessor procedures.
Base44 application data remains subject to its applicable hosting configuration, including storage in the United States. Restricted international transfers remain subject to applicable safeguards described in the Master Service & Data Protection Terms.
Where applicable law restricts international transfers, Vaultland and/or its processors will use an appropriate lawful mechanism, such as an applicable adequacy decision or approved contractual safeguards.
6. Recipients
Vaultland discloses Personal Data only as reasonably necessary to provide, secure, support and administer the Service; process billing where enabled; comply with law; protect rights/security; or follow Customer instructions where Vaultland acts as processor/service provider. Recipients may include authorized Vaultland personnel, relevant Customer administrators, infrastructure/service providers, professional advisers and authorities where legally required.
7. Retention and subscription lifecycle
Vaultland distinguishes Customer/VDR content from limited account/compliance evidence.
Customer/VDR content: under the current standard policy, Trial expiration is followed by a 15-day Recovery/export-only period. Paid subscription termination is followed by 30 days of Recovery/export-only access within a 90-day total retention period measured from termination; Days 31–90 are Locked Retention with no normal customer access. Deletion processing is ordinarily scheduled at the applicable deletion date unless the Service is restored or a legal/administrative hold applies. An eligible Organization Admin may request earlier deletion, but that request cannot override an applicable hold or legally required retention.
Account/compliance evidence: Vaultland may retain limited account identity, legal-document/NDA acceptance evidence, billing/accounting records, security/fraud/incident evidence, lifecycle/deletion evidence and records needed to establish or defend legal claims for periods appropriate to the purpose and legal obligations.
Individual document deletion: moving a document to Trash starts a 30-day restoration window, measured from that deletion action. During this window the document is unavailable for normal use but may be restored by an authorized administrator. Uploading, viewing or converting a document does not start this window. Merely archiving or closing a Data Room does not automatically delete its documents.
After the restoration window, the automated removal process removes the document's stored originals and converted PDFs, including stored versions, subject to applicable holds. Processing is scheduled and may require retries; expiry is not a guarantee of removal at that exact second. Organization termination follows the separate organization lifecycle above, including its applicable recovery periods and holds.
Verification and scope: Vaultland records the outcome of storage-removal operations and verifies that the targeted Azure objects are no longer readable through the storage service. Removal from active storage must not be presented as proof of erasure from every provider backup, retained version, snapshot or other residual copy. Any applicable provider retention or legal preservation requirements remain relevant. Failed or unverified removal remains pending or flagged for review and is not certified as completed.
Temporary conversion artifacts have a separate processing and cleanup lifecycle; deletion of a VDR document is not represented as simultaneous erasure of every processing copy. Limited audit and deletion evidence may be retained for the purposes described above. Copies previously downloaded by authorized recipients are outside Vaultland's storage-removal control.
8. Security
Vaultland uses safeguards appropriate to the Service, including authenticated access, server-side authorization, explicit Data Room membership, group/permission controls, short-lived signed file access, NDA controls, upload authorization, audit events and subscription/data lifecycle restrictions. No internet/cloud service can guarantee absolute security.
9. Rights — EEA / UK / Switzerland
Where applicable law provides them, individuals may have rights of access, rectification, erasure, restriction, portability, objection and rights concerning automated decision-making, and may withdraw consent where consent is the legal basis. Individuals may lodge complaints with a competent supervisory authority, including the AEPD where applicable in Spain.
10. Rights — Brazil
Where the LGPD applies, individuals may have rights including confirmation of processing, access, correction, anonymization/blocking/deletion where applicable, portability, information on sharing, review/opposition rights and other rights under Brazilian law. Complaints may be directed to the ANPD where applicable.
11. Rights — United States
Residents of certain U.S. states may have rights concerning access/knowledge, correction, deletion, portability and opt-outs/limits regarding certain uses, subject to statutory scope and exemptions. When acting as a service provider/processor for Customer Data, Vaultland does not sell that Customer Personal Data or share it for cross-context behavioral advertising/targeted advertising.
12. Exercising rights
For Vaultland's own controller/business data, contact Vaultland through the Vaultland in-app Help/Support channel or by email at admin@vaultland-vdr.com (service: vaultland-vdr.com; public website: vaultland.net). For Customer-controlled Data Room content, Vaultland may refer the request to or coordinate with the relevant Customer Organization. Vaultland may verify identity and authority before fulfilling a request.
13. Cookies and similar technologies
Vaultland uses authentication/session and security technologies necessary to provide the Service. If non-essential analytics, advertising or tracking technologies requiring consent are introduced, Vaultland will provide a separate consent mechanism where legally required.
14. Changes
Vaultland may update this Notice for legal, operational or technical changes. Material privacy changes may be highlighted in the application. Because this Notice is a transparency document rather than a contract acceptance, an updated Notice does not automatically require a checkbox unless applicable law requires a specific consent or other affirmative action.
Privacy contact: through the Vaultland in-app Help/Support channel or by email at admin@vaultland-vdr.com (service: vaultland-vdr.com; public website: vaultland.net).
Document storage: Microsoft Azure Blob Storage — North Europe (Ireland, EU), ZRS. Application and processing services are described above.