Privacy Policy

Appfinity, operated by [Company Legal Name] of [Registered Address], is the data controller for personal data described in this policy. For all privacy matters, contact us at contact@tryvault.shop. Where required by law, our representative in [Jurisdiction] is [Representative Name].

We collect only what we need to respond to you and deliver our services:

• Enquiry data — name, work email, company, indicative budget, and the contents of your message when you submit a project brief or email us.
• Engagement data — contract details, billing contacts, project correspondence, and any credentials you choose to share for delivery purposes.
• Technical data — IP address, browser type, referring page, and pages visited, collected in server logs for security and reliability.

We do not knowingly collect special-category data, and we ask clients not to place production personal data in non-production environments.

We process enquiry and engagement data to take steps at your request prior to entering a contract, and to perform that contract. We process technical logs on the basis of our legitimate interest in operating a secure service. Where [Jurisdiction] law requires consent — for example for optional analytics or marketing email — we ask for it separately and you may withdraw it at any time.

Our website uses strictly necessary cookies required for page delivery and security. If we enable analytics, it will be listed here with its provider, purpose, and retention period, and where required in [Jurisdiction] it will load only after you consent. You can block or delete cookies in your browser settings; strictly necessary cookies cannot be disabled without affecting site function.

We never sell personal data. We share it only with sub-processors who help us operate, each bound by a written data processing agreement:

• [Hosting Provider] — website and application hosting
• [Email Provider] — business email and enquiry correspondence
• [Accounting Provider] — invoicing and statutory record keeping

We may also disclose data where required by law, court order, or a competent authority in [Jurisdiction].

Where personal data is transferred outside [Jurisdiction], we rely on an adequacy decision or on standard contractual clauses together with a transfer risk assessment. A copy of the relevant safeguards is available on request at contact@tryvault.shop.

Enquiries that do not lead to an engagement are deleted after [12] months. Engagement and billing records are retained for [7] years to meet statutory accounting obligations in [Jurisdiction]. Server logs are retained for [90] days. When a retention period ends, data is deleted or irreversibly anonymised.

We apply access control on a least-privilege basis, encrypt data in transit, require multi-factor authentication on internal systems, rotate credentials on personnel change, and review dependencies for known vulnerabilities. No system is perfectly secure; where a breach affects your rights we will notify you and the supervisory authority in [Jurisdiction] within the legally required timeframe.

Subject to [Jurisdiction] law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability, or object to processing based on legitimate interests. Email contact@tryvault.shop and we will respond within [30] days. If you are not satisfied, you may lodge a complaint with the supervisory authority in [Jurisdiction].

Our services are directed at businesses and are not intended for individuals under the age of [16]. We do not knowingly collect data from children; if you believe we have, contact us and we will delete it.

We may update this policy to reflect changes in our services or the law. Material changes will be announced on this page with a revised "Last updated" date, and where required we will notify affected clients directly.