Privacy Policy

1.1 Personal Data You Provide

We collect the following personal data that you voluntarily provide when using our Service:

• Account Information Email address, username, and master password (encrypted) for account creation and authentication
• Stored Data Passwords, documents, notes, and other content you choose to store in WhiteVault, all of which are encrypted using AES-256 encryption
• Support Communications Information you provide when contacting our support team at support@whitevaultapp.com

1.2 Automatically Collected Information

When you use WhiteVault, we may automatically collect:

• Usage Data Device information, browser type, operating system, IP address, and general location data
• Log Data Access times, pages viewed, and actions taken within the Service for security and operational purposes

We use your personal data for the following legitimate purposes:

• Service Provision To provide, maintain, and improve the WhiteVault Service, including secure storage and retrieval of your encrypted data
• Account Management To authenticate your identity, manage your account, and provide customer support
• Security To detect, prevent, and respond to fraud, security incidents, and other harmful activities
• Legal Compliance To comply with applicable laws, regulations, and legal processes
• Communications To send you important updates about the Service, security alerts, and respond to your inquiries

We implement industry-leading security measures to protect your data:

• AES-256 Encryption All passwords and documents you store are encrypted using Advanced Encryption Standard (AES) with 256-bit keys, ensuring your data remains secure even if unauthorized access occurs
• Zero-Knowledge Architecture We employ a zero-knowledge security model, meaning we cannot access, view, or decrypt your stored data. Only you have the encryption keys necessary to unlock your information
• Secure Transmission All data transmitted between your device and our servers is protected using TLS/SSL encryption
• Regular Security Audits We conduct regular security assessments and vulnerability testing to maintain the highest security standards

Please Note: While we implement robust security measures, no system is completely impenetrable. You are responsible for maintaining the confidentiality of your master password and should choose a strong, unique password that you do not use elsewhere.

In compliance with the DPDP Act, 2023 and Rules, 2025:

• Active Storage We retain your personal data for as long as your account is active or as needed to provide you with the Service
• Immediate Deletion Upon Request When you request account deletion or withdraw your consent, all your personal data, including encrypted passwords and documents, is immediately and permanently deleted from our active systems
• Backup Systems Deleted data may remain in backup systems for up to 90 days before permanent removal, but will not be accessible or used during this period. This retention in backups is solely for technical and disaster recovery purposes
• No Extended Retention Unlike many services, we do NOT retain your data for extended periods after deletion. Once you delete your account, your data is gone immediately, reflecting our commitment to your privacy and data control

As a user in India, you have the following rights regarding your personal data:

• Right to Access You can request a copy of the personal data we hold about you
• Right to Correction You can update or correct inaccurate personal data through your account settings or by contacting us
• Right to Erasure You can request deletion of your personal data at any time, and it will be immediately and permanently removed from our active systems
• Right to Withdraw Consent You can withdraw your consent for data processing at any time by deleting your account
• Right to Grievance Redressal You can lodge a complaint with us or with the Data Protection Board of India if you believe your data rights have been violated
• Right to Nominate You may nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act

To Exercise Your Rights: Contact us at support@whitevaultapp.com with your request. We will respond within 30 days of receiving a valid request.

No Sale of Data

We do not sell, rent, trade, or otherwise share your personal data with third parties for their marketing purposes.

We may share your data only in the following limited circumstances:

• Service Providers We may engage trusted third-party service providers to assist with hosting, infrastructure, and technical support. These providers are contractually obligated to protect your data and may only use it to perform services on our behalf
• Legal Requirements We may disclose your information if required by law, court order, or governmental authority, or to protect our legal rights, prevent fraud, or ensure user safety
• Business Transfers In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections

In compliance with the DPDP Act, 2023 and Rules, 2025:

• Breach Detection We maintain systems to detect and respond to security incidents promptly
• Mandatory Reporting In the event of any data breach, regardless of scale, we will notify both the Data Protection Board of India and all affected users as required by law
• Notification Content Breach notifications will include the nature of the breach, data affected, potential consequences, and remedial actions we are taking
• Timeline We will notify affected parties without undue delay after becoming aware of the breach

Your data is primarily stored on servers located in India. If we transfer data outside India, we will ensure appropriate safeguards are in place as required by the DPDP Act, including obtaining your explicit consent for such transfers and ensuring the receiving country or entity provides adequate data protection.

WhiteVault is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you are under 18, please do not use our Service or provide any personal information. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@whitevaultapp.com, and we will delete such information immediately in accordance with the DPDP Act’s provisions for verifiable parental consent.

We use cookies and similar tracking technologies to:

• Functions Maintain your login session and remember your preferences
• Analysis Analyze usage patterns to improve our Service
• Security Enhance security and prevent fraudulent activity

You can control cookies through your browser settings. However, disabling certain cookies may affect your ability to use some features of the Service.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website and updating the “Last Updated” date. Your continued use of WhiteVault after such changes constitutes your acceptance of the updated Privacy Policy.

In accordance with the DPDP Act, 2023, we have established a grievance redressal mechanism:

• Grievance Officer WhiteVault Grievance Officer
• Email support@whitevaultapp.com
• Response Time We will acknowledge your grievance within 72 hours and work to address your concerns within 30 days
• Your Rights If you believe your data protection rights have been violated, you have the right to file a complaint directly with the Data Protection Board of India established under the DPDP Act, 2023. You are not required to exhaust our internal grievance process before approaching the Board.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email support@whitevaultapp.com
• Website https://whitevaultapp.com