Privacy Policy

1. Data Controller

RegVault ("we", "us", "our") is the data controller responsible for your personal data. For inquiries, contact us at contact@regvault.net.

2. Information We Collect

When you submit the newsletter sign-up form, we collect:

• Full name
• Company name
• Job title / position
• Business email address

When you request RegVault Early Access, we collect your name, company name, business email address, optional role or position, and consent.

Early Access submissions are stored in a dedicated Supabase database table and are not added to the newsletter or Monthly Report mailing list.

To prevent abuse, we store a pseudonymous network identifier produced with HMAC-SHA256, never the raw network address. Rate-limit records become eligible for cleanup after 24 hours and are removed during subsequent limiter activity. Low-traffic periods can delay physical deletion.

We also collect anonymized usage data through Google Analytics (page views, session duration, scroll depth) using cookies.

3. Purpose of Processing

• To deliver regulation analysis reports via email (newsletter)
• To contact applicants about, evaluate eligibility for, and support onboarding to RegVault Early Access
• To inform you about RegVault service updates and launch
• To analyze website usage for improving our service

Legal basis (GDPR Art. 6(1)(a)): your explicit consent provided through the applicable form checkbox.

4. Third-Party Data Processors

We share your data with the following service providers, solely for the purposes described above:

• Supabase Inc. — database hosting for newsletter, report, and dedicated Early Access storage
• Resend Inc. — email delivery only for the Monthly Report and newsletter; Resend does not process Early Access submissions
• Google LLC — website analytics (Google Analytics 4)
• Vercel Inc. — website hosting

5. Data Retention

We retain your personal data for as long as you remain subscribed to our newsletter. Upon unsubscription or deletion request, your data will be deleted within 30 days.

We retain Early Access request data while evaluating and onboarding applicants, or until you withdraw consent or request deletion. We delete it within 30 days of a valid deletion request.

6. Your Rights

Under GDPR (EU) and PIPA (Republic of Korea), you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Withdraw consent at any time
• Data portability
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email us at contact@regvault.net.

7. Cookies

We use Google Analytics cookies to collect anonymized usage statistics. These cookies do not identify you personally. You can disable cookies in your browser settings at any time.

8. International Data Transfers

Depending on the service you use, your data may be transferred to and processed in the United States by Supabase, Google, Vercel, and—for Monthly Report and newsletter delivery only—Resend. These transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.