The controller for processing personal data in connection with VaultSide (the “Service”) is:

The Service is operated by a single individual. No data protection officer has been appointed because the thresholds of Art. 37 GDPR and § 38 BDSG are not met. Please direct any privacy-related requests to the address above.

2. Overview

This policy explains how your personal data is processed when you use the web application at vaultside.cre8flow.de, the installable Progressive Web App (PWA), or the Chrome browser extension of VaultSide. It applies across all three surfaces because they share the same code base and back-end infrastructure.

3. Hosting of the web app and PWA

The website and PWA are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the site, technically necessary data (such as IP address, user-agent, time of the request) is automatically processed by the host in server logs to provide the service, ensure stability and security, and prevent abuse.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing the Service reliably). Data may be transferred to third countries; the host is contractually obliged to comply with the GDPR and relies for transfers to the United States on Standard Contractual Clauses and the EU-US Data Privacy Framework. Host’s privacy policy: https://vercel.com/legal/privacy-policy.

4. Database and authentication

To store your account, project/vault data, lists, notes and other app content, and for authentication by e-mail and password, we use Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992. Data is processed in the EU (Frankfurt) region.

Data processed includes: e-mail address, a hashed password (authentication), session tokens, your content (see section 8 on encryption), creation and modification timestamps and technical metadata required to operate the Service. Legal basis: Art. 6 (1) (b) GDPR (performance of the user contract) for service delivery, and Art. 6 (1) (f) GDPR for security and logging.

Back-end provider’s privacy policy: https://supabase.com/privacy.

5. Cookies, local storage and browser storage

We use no tracking or advertising cookies. However, we store technically necessary data in your browser without which the Service cannot function:

• the session token for authentication (local storage / IndexedDB) so you stay signed in after reload;
• UI preferences such as sort orders, collapsed filters and chosen language (local / session storage);
• in the browser extension, encrypted content is additionally cached in chrome.storage (local) so the side panel and popup remain responsive.

Legal basis for this storage is § 25 (2) no. 2 TDDDG (strictly necessary for the Service) and Art. 6 (1) (b) / (f) GDPR.

6. Server log files

Each time the web app / PWA is accessed, the host automatically collects information transmitted by your browser (browser type and version, operating system, referrer URL, IP address, time of request). This data is not combined with other data sources and is used solely to provide and secure the Service. Logs are typically deleted within days or weeks. Legal basis: Art. 6 (1) (f) GDPR.

7. Account registration

A user account is required to use the Service. We process your e-mail address and a self-chosen login password. To confirm your e-mail we send you a verification link by e-mail; delivery is handled by the back-end provider listed in section 4.

Legal basis: Art. 6 (1) (b) GDPR (performance of contract). Data is stored until your account is deleted (see section 14).

8. Encryption of your content (zero-knowledge)

Sensitive content (passwords, credentials, FTP data, encrypted fields inside vaults) is encrypted in your browser before it is sent to our server. Encryption uses AES-GCM; the key is derived from your master password using PBKDF2 (310,000 iterations) and never leaves your device.

Neither we nor the back-end provider can read your encrypted content in plain text. Consequence: if you forget your master password, your content cannot be recovered. Please store your master password safely.

9. Usage analytics (internal)

We collect aggregated, non-personalised usage events (e.g. “session started”, “feature used”) to improve the stability, performance and evolution of the Service. These events are stored on our own back-end (section 4) and are not shared with third parties. No profiling or automated decision-making takes place.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in improving and securing the Service). You have the right to object pursuant to Art. 21 GDPR — please contact us at legal@vaultside.de.

10. Feedback and e-mail contact

If you contact us via the built-in feedback form or by e-mail, we process the information you provide (e.g. name, e-mail, message) to handle your enquiry. Legal basis: Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries). We delete the data once it is no longer required for processing, unless statutory retention obligations apply.

11. Browser extension (Chrome Web Store)

If you install the VaultSide extension from the Chrome Web Store, Google Ireland Limited / Google LLC as the store operator processes data related to installation and updates of the extension. We have no influence over this. Please consult Google’s privacy policy (policies.google.com/privacy).

The extension uses the Chrome permissions storage, sidePanel, tabs, activeTab, scripting and contextMenus solely to deliver app functionality (e.g. local storage of encrypted data, opening the side panel, context-aware actions). In particular, we do not read or transmit the content of websites you visit beyond actions you explicitly trigger.

12. Recipients of personal data

We share personal data only with the following categories of recipients, and only to the extent necessary to provide the Service:

• our hosting provider (section 3);
• our back-end / authentication provider (section 4);
• where applicable, the browser vendor (section 11) for users of the extension;
• authorities upon order, where required by law.

We have entered into Art. 28 GDPR data-processing agreements with all processors.

13. Retention period

We store personal data only for as long as it is necessary for the respective purpose or as legal retention obligations require. Account data is kept until the account is deleted. Log files are deleted regularly after a short period (see section 6).

14. Your rights as a data subject

You have the following rights under the GDPR:

• access (Art. 15 GDPR);
• rectification (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• objection (Art. 21 GDPR);
• withdrawal of consent (Art. 7 (3) GDPR) — without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights it is sufficient to send an informal e-mail to legal@vaultside.de.

15. Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority. The competent authority for the federal state where we are based is:

You may also contact the authority of your place of residence or work.

16. Automated decision-making / profiling

No decision based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR takes place.

17. Changes to this policy

We reserve the right to adapt this privacy policy when features, providers or the legal framework change. The current version is shown at the top of this page.