Privacy Policy

vault42.eu is a website with an email waitlist. This policy explains what personal data the site collects and what we do with it. The data controller is named in the next section. During the beta, Vault42 is operated by Marijn Wijbenga as a sole trader. We plan to transfer it to a Czech limited company as it grows; this page will be updated and customers will be informed in advance.

Data controller

Marijn Wijbenga, trading as Vault42
Revoluční 2137/8b, 110 00, Praha 1 - Nové Město, Czech Republic
Email privacy@vault42.eu

What we collect

• Your email address, when you join the waitlist. This is the only required field.
• Optional answers you choose to give in the signup form, such as which plan interests you or a short free-text comment.
• Basic engagement analytics: which links and form steps you interact with, the page path, your language, and the time. This is first-party and is not used to identify you personally.
• Attribution data present when you first arrive: campaign parameters (utm_source and similar), the referring URL, and any referral code from a shared link.
• A random session identifier in your browser's sessionStorage, used to group one visit's events together. It is not a cookie and is cleared when you close the tab.
• A one-way hash of your IP address (never the raw IP), used only to limit signup attempts from a single network and prevent abuse.

Why we are allowed to process it

• Your consent (Art. 6(1)(a) GDPR) to hold your email on the waitlist and send you related email. You give it by submitting the form and confirming your address, and you can withdraw it at any time.
• Our legitimate interest (Art. 6(1)(f) GDPR) in preventing abuse of the form and in understanding, in aggregate, which channels reach interested people.

Storage and retention

Data is stored on infrastructure located in the European Union and is not transferred outside it. We keep your waitlist entry until you ask us to delete it or the waitlist closes, and analytics events for up to 24 months.

Content on the Vault42 service

This policy covers the website and the waitlist. When the Vault42 service opens, the repositories and other content that customers store on it are processed on the customer's behalf. For that content, Vault42 is a processor under the Data Processing Agreement, and the customer is the controller.

Vault42 will run two kinds of automated checks:

• Checks for malware and for known child sexual abuse material, and alerts about known vulnerabilities in dependencies, will run on all content stored on the service, including private repositories.
• A check for sexually explicit images will run on public repositories only.

To detect known child sexual abuse material, we will compare fingerprints of images, called hashes, with hash lists from European child-protection organisations or law enforcement authorities. For this comparison, we may send image hashes to the organisation that maintains the list. We will never send files from the service to third parties for any of these checks.

Vault42 staff do not read the contents of private repositories as a matter of routine. A person reviews specific content only when an automated check flags it, when we receive a report about it, or when the law requires it, and only to the extent needed to assess that case.

Where we process this data for our own purposes, such as the security of the service and the prevention of abuse, our legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Where we report content to the competent authorities, our legal basis is our legal obligation (Art. 6(1)(c) GDPR). The rules for content are in our Acceptable Use Policy.

Email

Incoming email to Vault42's shared mailboxes is hosted by Proton AG in Switzerland, covered by the EU adequacy decision for Switzerland. We send the confirmation email through Scaleway, a European provider. Our newsletter is sent through Keila Cloud, run by Keila GmbH in Germany, to the people who signed up for it. Waitlist addresses are stored with Scaleway. Before launch, we may send waitlist updates through Keila Cloud as well, and for that we copy the waitlist addresses to Keila. We do not sell or share your address. The full list of providers is on our sub-processor page.

Cookies and local storage

• i18n_locale, a functional cookie that remembers your chosen language. No consent is needed for it.
• sessionStorage, holding the random session id and first-visit attribution described above, cleared when the tab closes.

We do not use advertising or cross-site tracking cookies.

Other parties

Web fonts are self-hosted. The third parties that process data for this site, including hosting, backups and shared mailboxes, are listed on our sub-processor page.

Your rights

You can ask us to provide, correct, delete, or restrict your data, or object to its processing, and you can complain to your national data protection authority. The confirmation email also contains a removal link: it opens a page that asks you to confirm, and then permanently deletes your entry. For anything else, email us at the address below and we will respond within one month.

Changes

The "last updated" date above reflects the current version. Material changes will be emailed to people on the waitlist.

Contact

Email privacy@vault42.eu.