Privacy Policy

1. Who We Are

VaultSync Solutions, Inc. ("VaultSync", "we", "us", or "our") operates the GDBS Scientific Computing Platform, accessible at gdbs.getvaultsync.com and through official mobile applications. Our registered business address and primary contact is listed in Section 11 below.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use GDBS, visit our websites, or interact with our services.

2. Information We Collect

Account & Identity

• Full name and email address provided at registration
• If you use Social posting: the developer-app keys you enter, the access tokens LinkedIn, Meta or X issue when you connect an account, and the posts you schedule. They are stored encrypted, used only to publish your own posts, and never shown back in the browser. Removing an app's keys disconnects its accounts
• If you subscribe to GDBS updates (on a tool page or elsewhere on the site): your email address, an optional name, and the topic you chose. Nothing is sent to you until you confirm the address from the email we send.
• Password (stored as a one-way bcrypt hash — never in plaintext)
• License tier and subscription status
• Account creation date and last login timestamp

Usage & Technical Data

• IP address at time of login and API requests
• Browser type, operating system, and device type
• Pages visited and features accessed within GDBS
• Session tokens (JWT, stored client-side; not persisted server-side)

Payment Data

• Payment is processed entirely by Stripe, Inc. — we never store card numbers, CVV, or full payment credentials
• We retain Stripe customer IDs, subscription IDs, and transaction references for billing support

Investment Data (Friends & Family Round)

• Name, email, phone (optional), and investment amount
• Accredited investor declaration and acceptance of terms
• Reference code, tier, and revenue share percentage
• IP address at time of submission

Simulation Inputs

• Parameters entered into GDBS calculators and simulation modules (e.g., material properties, boundary conditions) are processed in your browser and are not sent to us
• Two features route text through our server. Worklog Automation jobs pass through our compute API to run in your own signed-in browser; with team encryption on, the job travels as ciphertext that our server stores and forwards without reading. The legal drafting tool sends the text of your request to our server, which forwards it to Anthropic to generate the draft when AI drafting is enabled, and otherwise builds the draft from a template
• We do not store simulation inputs or outputs beyond the active session unless you explicitly save a report

3. How We Use Your Information

• Authenticate you and maintain your account session
• Deliver licensed platform features based on your subscription tier
• Process payments and manage billing through Stripe
• Send product and rule-change updates to registered users and to confirmed subscribers. Every update carries an unsubscribe link that takes effect immediately; essential account, security and billing email is still sent after you unsubscribe from updates.
• Send transactional emails: account confirmations, password resets, payment receipts, and investment confirmations
• Respond to support requests and troubleshoot issues
• Monitor platform stability, detect abuse, and enforce our Terms of Service
• Comply with legal obligations

4. Third-Party Services

• Stripe, Inc. — payment processing. Stripe's privacy policy governs payment data: stripe.com/privacy
• Google Play / Android — app distribution. Google's privacy policy applies to Play Store interactions
• Microsoft 365 (Exchange Online) — delivery of transactional email and of the updates described above. We do not sell, rent or share email addresses.
• Anthropic — only when AI drafting is enabled: the text of a legal drafting request is sent to Anthropic's API to generate the draft
• LinkedIn, Meta (Facebook and Instagram) and X — only if you connect an account under Social posting: the text, link and image address of each post you schedule are sent to the networks you chose for it. Their own privacy policies apply to what they publish
• CourtListener (Free Law Project) — case-law searches are sent through our server to CourtListener; only your search query is transmitted
• Anthropic — only when AI drafting is enabled: the text of a legal drafting request is sent to Anthropic's API to generate the draft
• CourtListener (Free Law Project) — case-law searches are sent through our server to CourtListener; only your search query is transmitted
• Public Government Data Sources — the Legal Research tools query keyless public government APIs (Federal Register, eCFR, SEC EDGAR). No API key is used and no personal data is transmitted to these services beyond your search query

5. Data Retention

• Active accounts: data retained for the life of your account plus 90 days after closure
• Payment records: retained for 7 years for tax and legal compliance
• Investment records: retained indefinitely as part of the legally binding commitment record
• Session logs / IP logs: retained for up to 90 days then purged

6. Data Security

We implement industry-standard security measures including:

• TLS encryption in transit for all platform communications
• Bcrypt hashing for all stored passwords
• JWT-based stateless authentication with configurable expiry
• Server-side API key storage — third-party API keys you configure are stored server-side and never exposed in client responses
• Access controls limiting data access to authorized personnel only

No method of transmission or storage is 100% secure. We will notify affected users in the event of a data breach as required by applicable law.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and associated data (subject to retention obligations)
• Portability — receive your data in a machine-readable format
• Objection — object to processing in certain circumstances

To exercise any of these rights, contact us at privacy@getvaultsync.com. We will respond within 30 days.

8. Children's Privacy

GDBS is a professional scientific computing platform intended for users aged 18 and older. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us personal information, we will delete it promptly.

9. Cookies & Local Storage

GDBS keeps your authenticated session and UI preferences (e.g. last active module, API keys you configure) in your browser's local storage on your device. We do not use third-party tracking cookies or advertising cookies, and we do not share session data with any third party. A single, non-tracking session-presence cookie (a 1/0 flag, no token material, no PII) is set on the parent .getvaultsync.com domain so the marketing site can show "Sign In" instead of "Register" to returning visitors. No cookie consent banner is required as we do not deploy non-essential cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and by updating the "Last updated" date at the top of this page. Continued use of GDBS after changes constitutes acceptance of the revised policy.

11. Contact Us