Privacy Policy

RegVault LLC, a Wyoming limited liability company with its address at 1621 Central Ave #8277, Cheyenne, WY 82001, USA ("we", "us", "our"), is the controller of your personal data. Our privacy officer is Vincent Park, Founder. You can reach him at privacy@regvault.net. For general questions, contact us at contact@regvault.net.

When you start a trial, we collect your work email address, full name, company, job role, the areas of work you choose, your time zone, and the time and version of the terms you accepted.

During a trial we record which regulations you open, which versions you compare, and your PDF downloads, including the time, the document and the network address from which each PDF is downloaded.

When you request a quote, we collect your name, company, work email, team size and any message you add. When you contact us, we collect your name, email address, topic and message.

To prevent abuse of our forms, our rate limiter stores only a pseudonymous identifier derived with HMAC-SHA256 from your network address or email address, never the raw value. Rate-limit records become eligible for cleanup after about one day and are removed during subsequent limiter activity. Low-traffic periods can delay physical deletion.

Our former Early Access form collected your name, company name, business email address, optional role or position, and consent. Those requests are stored in a dedicated Supabase database table and are not added to a newsletter mailing list.

Our former report sign-up form collected your full name, company name, job title or position, and business email address. We do not send WP29 report PDFs or report download links by email.

Where laws such as the GDPR require a legal basis, we rely on the following.

• To create and secure your account and provide your trial or subscription (contract, GDPR Art. 6(1)(b))
• To send account emails and trial emails about your trial's start and end (contract and legitimate interests, Art. 6(1)(b) and (f))
• To answer quote requests and contact inquiries (steps before a contract, Art. 6(1)(b))
• To prevent abuse and keep the service secure (legitimate interests, Art. 6(1)(f))
• To contact people who requested Early Access through our former form about RegVault, its launch and service updates (consent, Art. 6(1)(a), given through that form's checkbox)
• To understand, in aggregate, how trials are used and improve RegVault (legitimate interests, Art. 6(1)(f))

You can unsubscribe from trial emails at any time with the link in each email. Account emails still arrive.

• Supabase Inc. — database hosting and sign-in
• Resend Inc. — delivery of account and trial emails, and of internal notifications about sign-ups, quote requests and contact inquiries
• Vercel Inc. — website hosting
• Cloudflare, Inc. — Turnstile bot protection on the sign-up, resend-confirmation and password reset forms (Cloudflare receives your network address for this check)

We require these providers to protect your data and to use it only on our instructions.

We process data in the United States and in other countries where our service providers operate. For transfers from the EU, the UK and other regions that have transfer rules, we use safeguards such as the European Commission's Standard Contractual Clauses.

If you do not become a customer, we delete your trial account and its records 12 months after your trial ends. If you do not confirm your email within 7 days, we delete your sign-in account and keep only the sign-up record, which we delete after 12 months. Customer accounts are kept for the duration of the contract.

We keep requests from our former Early Access form until you withdraw consent or ask us to delete them. Data from our former report sign-up form is kept until you ask us to delete it. When you ask us to delete your data, we do so within the time required by applicable law, except where we must keep it for legal reasons.

We keep contact inquiries for as long as we need them to answer you and follow up, and you can ask us to delete them at any time.

Depending on where you live — for example the EU, the UK, US states such as California, Korea and other countries — you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data
• Receive your data in a portable format
• Restrict or object to processing
• Withdraw consent at any time
• Opt out of trial emails

To exercise any of these rights, email us at privacy@regvault.net. We respond within the time required by applicable law. You can also complain to your local data protection authority.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not discriminate against you for exercising your rights.

We encrypt data in transit and protect it with access controls and least privilege. Where the law requires, we notify you and the authorities of a personal data breach.

RegVault is a business service and is not for anyone under 16. We do not knowingly collect data from children.

We use cookies to support sign-in and keep you signed in, and a short-lived cookie (30 minutes) that remembers your email address on the "Check your inbox" page after you sign up, and preference cookies that remember interface layout, such as whether a sidebar is open. Cloudflare Turnstile may set its own cookies to tell people and bots apart. Blocking these cookies may prevent sign-in from working.

If you are in the EU or UK, you can contact us directly at privacy@regvault.net.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

RegVault LLC, 1621 Central Ave #8277, Cheyenne, WY 82001, USA. Privacy questions: privacy@regvault.net. General contact: contact@regvault.net.