Privacy Policy

Last updated: 12 July 2026 · Vaulex Group Ltd · ICO registration ZC087196

The short version. Your files are stored in the United Kingdom, encrypted in transit and at rest. We do not sell your data and we do not look through your files. We only collect what we need to run the service, bill you and support you. You can get a copy of your data, or have it deleted, whenever you ask.

1. Who is responsible for your data

Vaulex Group Ltd (company number 17004770), 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, is the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office under reference ZC087196.

2. Controller and processor — an important distinction

There are two different kinds of data involved here, and we treat them differently.

Your account data (your name, email, billing records, support messages). We decide how this is used, so we are the controller. This policy explains what we do with it.
The contents of your files. If you store other people’s personal data in your account — your clients’ records, your staff’s details, a spreadsheet of customers — you are the controller and we are your processor. We only act on your instructions. The terms governing that are set out in our Data Processing Agreement.

3. What we collect, why, and on what legal basis

What	Why	Lawful basis (UK GDPR)
Name, email address, username, password (hashed)	To create and run your account, and to let you sign in	Contract — we need it to provide the service you asked for
Billing records: plan, amounts, dates, invoices, card type and last four digits	To take payment, issue invoices and keep proper accounts	Contract, and legal obligation for accounting records
Your files, folder names and file names	To store them and give them back to you when you want them	Contract. Where the files contain other people’s data we act as your processor
Technical logs: IP address, browser, times of access, actions taken	To keep the service secure, prevent abuse, and diagnose faults	Legitimate interests — keeping the service safe and working
Support messages and emails you send us	To answer you and to keep a record of what was agreed	Contract and legitimate interests
Marketing preferences, if you opt in	To send you offers and news from the Vaulex family of brands	Consent — and you can withdraw it at any time

We do not use your data to make automated decisions that have a legal or similarly significant effect on you, and we do not profile you.

4. Where your data is stored

Your files are stored in the United Kingdom. We use Wasabi’s London storage region (eu-west-1), hosted in an Equinix data centre in the UK which is certified to ISO 27001, SOC 2 and PCI-DSS. Files are encrypted while they travel to us and while they are stored.

Our website and database are hosted on servers operated by us in the United Kingdom.

5. Who else is involved (our processors)

We keep the list short on purpose. These are the only third parties that handle personal data on our behalf:

Who	What they do	Where	Safeguard
Wasabi Technologies	Stores your files	United Kingdom (London region)	Data stays in the UK. Wasabi is a US-parent company, so where its staff need access for support this is covered by the UK International Data Transfer Addendum
Stripe	Takes payments and issues invoices	UK / EU, with group companies in the US	UK International Data Transfer Addendum. Stripe handles your card details directly — we never see them
Mailgun (Sinch)	Sends our emails (password resets, receipts, notices)	European Union region	UK International Data Transfer Addendum
Google reCAPTCHA	Stops bots creating fake accounts on our sign-up form	US	UK International Data Transfer Addendum. See our Cookie Policy

We may also disclose data where the law requires it — for example a valid request from the police or a court order — or to establish or defend legal claims. If our business is ever sold or transferred, your data may move with it, and we would tell you.

We never sell your personal data, and we never share it with advertisers.

6. How long we keep it

Your files: for as long as your account is open. When you close your account, or if we close it, files are deleted from our systems, ordinarily within 30 days.
Your account record: deleted or anonymised within 30 days of closure, except where we need to keep something for the reasons below.
Billing and invoice records: kept for six years after the end of the relevant financial year, because HMRC requires it.
Security and access logs: ordinarily up to 12 months.
Marketing consent records: kept for as long as you are subscribed, plus a record of your unsubscribe so that we do not contact you again by mistake.

7. Your rights

Under UK GDPR you can ask us to:

give you a copy of the personal data we hold about you;
correct it if it is wrong;
delete it (though we may need to keep billing records — see above);
restrict or object to how we use it;
give it to you, or to someone else, in a portable format;
withdraw your consent to marketing at any time — every marketing email has an unsubscribe link, and you can also manage your preferences in your account.

Ask us via our contact page. We will respond within one month.

If you are unhappy with how we have handled your data, please tell us first — see our Complaints Policy. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

8. Security

Files are encrypted in transit (HTTPS/TLS) and at rest.
Passwords are stored hashed. Nobody at Vaulex can read your password.
Card details are handled by Stripe and never touch our servers.
Access to production systems is restricted to those who need it.
We keep access logs so that unusual activity can be investigated.

No system is completely secure. If a breach ever affected your personal data and posed a risk to you, we would tell you and the ICO, as the law requires.

9. Cookies

We use a small number of cookies. What they are, and how to control them, is set out in our Cookie Policy.

10. Children

The service is for businesses. It is not intended for anyone under 18, and we do not knowingly collect data about children.

11. Changes to this policy

If we make a material change we will tell you by email or in your account. The date at the top always shows when this policy was last updated.