Privacy Policy

We collect the information you give us directly, including:

• Your name, email address and password
• Workspace, company and team-member information
• Client, project, invoice, expense and renewal information you enter to run your agency
• Secrets you choose to store in the vault, such as logins, keys and secure notes
• Payment and billing contact details, handled by our payment partner
• Messages you send us, and bug reports or feature requests you submit
• A profile photo, if you choose to add one

We also collect some information automatically:

• Account and sign-in activity, and a record of actions taken in your workspace
• Basic technical data such as your IP address, browser and device, used for security and troubleshooting
• A record that you accepted our Terms and this Policy (the date and the version)
• Website usage statistics and error reports, once you accept cookies (see Cookies below)

• To provide, maintain and secure the Service
• To sign you in and apply the roles and permissions of your workspace
• To process payments and manage your subscription
• To send account, security and billing emails
• To respond to support requests
• To detect, prevent and investigate fraud, abuse or security incidents

We do not sell your personal data, and we do not use your Customer Data (clients, projects, vault contents and so on) to train any model or for advertising.

We process your personal data on the basis of your consent - given when you create an account and accept our Terms and this Policy, and when you accept cookies - and to provide the Service you asked for. We also process it where the law allows or requires it, for example to keep tax and payment records or to respond to a legal order. We only collect what is needed for the purposes in section 2.

You can withdraw consent at any time: delete your account in Settings, or email us at the address in section 14 and we will stop the processing. You can also clear this site's cookies in your browser, which signs you out and stops analytics until you accept again. Withdrawing consent to the processing needed to run your account means we can no longer provide the Service to you.

Secrets you store in the vault are encrypted before they are saved, and are only shown when you choose to reveal them. The personal and business information you enter is also protected, and data is encrypted while it travels to and from our service.

We do not store your card number. Card payments are handled directly by our payment partner - we only receive a payment status and reference.

We use a small number of trusted partners to run the Service:

• Payments - to take payment for subscriptions
• Email - to send account and billing emails
• File storage - to keep profile photos, if you add one
• Hosting and database - where the application and its data run
• Website analytics - to see which pages are used; starts once you accept cookies
• Error monitoring - to find and fix problems, using technical details only
• Password safety checks - the vault's password-health feature checks passwords against known breaches without sending the password itself

Each partner only receives the information it needs for its job. We do not sell personal data or share it for advertising.

Where your data is stored. Our partners run servers that may be outside India. The DPDP Act allows personal data to be processed outside India except in countries the Government of India restricts. We protect data wherever it is held, and we will tell you if our storage arrangements change materially.

Besides the partners above, we only share personal data when we must or when you ask us to:

• to follow the law, a court order or a request from a public authority
• to protect the safety of people, the Service, or our rights, for example to stop fraud or abuse
• if the business is bought, merged or sold, in which case the new owner must protect your data in line with this policy and we will tell you
• with the people you choose, for example teammates you invite or links you create

When you first visit, we ask you to accept cookies. Accepting covers the cookies that keep you signed in and website analytics, and you need to accept to use the site and app: until you do, they make no requests that need a session and analytics is not loaded.

• Sign-in and security cookies - keep you signed in and protect your account. They cannot be read by scripts on the page and are cleared when you sign out.
• Sharing cookies - support secure sharing for people who open a link you shared.
• Preferences - your cookie choice and interface settings, kept in your browser.
• Analytics - after you accept, a website analytics tool sets its own cookies and records which pages are visited and which buttons are clicked. Its provider may process this outside India. It is not needed to sign in or use the product, and it is not used inside the signed-in app.

You can stop analytics by clearing this site's cookies and not accepting again.

We keep your account and workspace data for as long as your workspace is active. If you ask us to delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep it for legal, tax or fraud-prevention reasons. You can delete your account yourself in Settings, and a workspace owner can permanently delete the workspace and all of its data. Sign-in sessions and temporary links expire automatically. The activity record that shows who did what in a workspace is kept for a short, fixed period and then removed automatically. Backups are kept for a limited time and then deleted, so removed data can remain in backups until they expire.

Browser extension. If you install the extension, it uses the address of the website you are on to find matching logins in your workspace. It does not read page contents or what you type, and nothing is filled until you choose a login.

Sharing. Share links and client portal links let people you choose view specific information without an account. Links can expire or be revoked, and we record when they are opened. Share only with people you trust.

As a Data Principal you have the right to:

• Access a summary of the personal data we hold about you and how it is processed - use Settings → Profile → Download my data for a copy
• Correct, complete or update your information - edit your name in Settings, or contact us for anything else
• Erase your personal data - delete your account in Settings (a workspace owner can delete the whole workspace)
• Withdraw consent - see section 3
• Grievance redressal - see section 14
• Nominate another person to exercise these rights for you if you die or become unable to do so - email us the nominee's details

You can exercise most of these in the app, or by emailing clefvault@gmail.com. We may need to confirm it is really you before acting on a request.

We use technical and organisational safeguards to protect your data, including encryption and access controls. No method of storage or transmission is completely secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires, explaining what happened, what data was involved and what you can do to protect yourself.

The Service is for business use and is only for people aged 18 or over. You confirm you are 18 or older when you create an account. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.

Our website and emails may link to sites we do not run. This policy does not cover them, and we are not responsible for how they handle your information. Please read their policies.

For privacy questions, to exercise a right, or to make a complaint, write to clefvault@gmail.com with the subject “Privacy”. We acknowledge requests promptly and resolve them without undue delay, and in any case within the time the law allows. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We may update this policy from time to time. Changes will be shown by an updated “Last updated” date above, and we will notify you of significant changes.