V vaultimary
Privacy & Data Governance

Privacy Policy

Effective Date: 1 January 2026
Last Updated: 15 February 2026

1. Overview & Data Controller

vaultimary ("we", "us", or "our") is dedicated to protecting your fundamental right to privacy. This Privacy Policy details our practices concerning the collection, processing, storage, and retention of personal data collected through our platform, marketing communications, and automated execution frameworks.

For the purposes of the Data Protection Act 2018 and the UK General Data Protection Regulation ("UK GDPR"), the designated data controller is vaultimary, with principal operations located at Corn Street 232, BS1 5LJ Bristol, United Kingdom.

2. Categories of Information Collected

We collect and process personal data across distinct operational scenarios:

  • Identity & Contact Details: Full name, electronic mail address, telephone number, country of residence, and government-issued identification where required for Anti-Money Laundering (AML) verifications.
  • Technical & Telemetry Data: IP addresses, browser specifications, operating system details, time-zone offsets, access timestamps, device identifiers, and network diagnostics.
  • Usage & Interaction Data: Analytical logs showing interactions with algorithmic models, dashboard preference settings, telemetry regarding feature engagement, and error logs.
  • Financial Configuration Data: Encrypted API exchange read/trade keys, currency denomination preferences, and algorithmic risk threshold parameters. vaultimary never stores raw private keys or master wallet seed phrases.

3. Legal Bases for Processing

We process your personal information only when authorized by law under Article 6 of the UK GDPR:

  • Contractual Performance: Processing required to establish your account, maintain platform access, authenticate sessions, and deliver requested algorithmic services.
  • Legal Compliance: Processing required to adhere to statutory, regulatory, tax, or anti-financial crime obligations under UK law.
  • Legitimate Interests: Necessary for enhancing platform security, safeguarding infrastructure from cyber threats, monitoring fraud, and improving quantitative analytical models.
  • Consent: Where you provide express, revocable consent for non-essential cookies, technical telemetry, or optional communications.

4. Cookies & Automated Tracking Technologies

vaultimary utilizes essential session cookies and performance telemetry to maintain security, session state, and interface continuity. Essential cookies enable navigation and core system access; performance cookies record anonymized engagement to troubleshoot platform latency. You may configure browser privacy settings to reject or delete cookies, though certain automated platform features may experience degraded functionality as a consequence.

5. Disclosure of Personal Information

We do not sell, rent, or trade your personal information to commercial third parties. Personal data may be shared exclusively under defined conditions:

  • Authorized Service Providers: Cloud hosting infrastructure (located in secure UK/EEA tier-4 data centers), cryptographic authentication vendors, customer support tooling, and regulatory audit specialists operating under strict data processing agreements.
  • Statutory Authorities: Law enforcement agencies, regulators, or judicial courts when compelled by lawful subpoenas, warrants, or court orders under United Kingdom statutory frameworks.
  • Corporate Restructuring: Transferees or prospective purchasers in connection with any merger, corporate sale, reorganization, or asset divestiture, subject to standard confidentiality protections.

6. International Data Transfers

Whenever data is transferred outside the United Kingdom, vaultimary ensures appropriate safeguards are enacted, such as the UK International Data Transfer Agreement (IDTA), standard contractual clauses approved by the Information Commissioner's Office (ICO), or transfers to jurisdictions recognized by the UK government as offering adequate data protection.

7. Data Retention & Safeguards

We maintain comprehensive technical, organizational, and physical safeguards designed to protect personal data against accidental loss, unauthorized access, alteration, or disclosure. All data transmissions are encrypted using TLS 1.3, and data at rest is secured via AES-256 cryptographic standards. Personal data is retained solely for the period required to fulfill operational purposes or satisfy statutory audit requirements (typically up to seven years for financial and regulatory compliance logs).

8. Your Statutory Rights

Under UK data protection legislation, you possess distinct enforceable rights:

  • The right to request access to the personal data we hold about you.
  • The right to request correction of inaccurate, incomplete, or outdated data.
  • The right to request erasure ("right to be forgotten") where retention is no longer legally justified.
  • The right to restrict or object to certain processing activities.
  • The right to receive your personal data in a structured, machine-readable format for transfer (data portability).
  • The right to withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

9. Contact & Supervisory Authority

To exercise your statutory rights or submit a privacy inquiry, please contact our Data Protection Officer via email at [email protected]. If you consider that our processing breaches UK data protection legislation, you have the right to lodge a formal complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.