DataVault — Privacy Policy

Draft — pending lawyer review. This document is a working draft based on Termly/iubenda boilerplate adapted to DataVault’s specific architecture. It must be reviewed by a qualified attorney before public deployment, especially for: Belgian/EU consumer protection clauses, GDPR data-subject-rights wording, and BYOAI third-party data flow disclosures. Effective date is the date this draft is published verbatim or with minor edits.

1. Who we are

Quillen Labs (“we”, “us”, “our”) is the studio that publishes DataVault (“the Service”), a personal knowledge management application for managing notes, notebooks, documents, CVs, cover letters, plot outlines, and personas (collectively, “Vault Content”), with optional client-side encryption and Google Drive–backed persistence.

• Controller: Quillen Labs.
• Address: [Belgian residential address — to be filled before publication].
• Contact for privacy questions: support@datavaultapp.com (or constantin.permiakov@gmail.com until provisioning completes).
• Jurisdiction: Belgium (EU member state).
• Data Protection Officer: None appointed at this scale (DataVault does not currently meet the GDPR Article 37 thresholds requiring one). The controller (Quillen Labs) responds directly to data-subject requests.

This Privacy Policy explains what personal data DataVault processes, why, where it is stored, and what rights you have.

2. Summary in plain words

• Your Vault Content lives in your own Google Drive, not on our servers. We never see your notes, documents, CVs, etc. We only see the metadata Google needs to authorize the connection (your name, email, profile photo) plus the technical session/key data described below.
• Optional client-side encryption can be turned on. When enabled, everything on Drive is encrypted before it leaves your device. We can’t decrypt it. Lose the encryption key and the data is unrecoverable.
• Bring Your Own AI (BYOAI): if you choose to use the AI Companion feature, you supply your own API key from Gemini, OpenAI, Anthropic, or OpenRouter. Your prompts (which include relevant context from the file you’re working on) go from your device directly to the AI provider you picked. We don’t see them.
• No third-party analytics or trackers in the application. The marketing site at datavaultapp.com may use cookieless analytics — see the Cookie Policy.

3. What data we collect, and why

3.1 Identity data (from Google sign-in)

When you sign in with Google we receive:

We do not request any other Google profile fields.

3.2 Authentication data

When you sign in we hold:

The session ID lets the device ask the backend for a fresh access token without you re-signing-in every hour. It’s the only piece of authentication state we keep on your device.

3.3 Vault Content (notes, documents, etc.)

Vault Content is stored in your own Google Drive, in a folder named DataVault that the app creates inside your Drive. We never receive, process, or store the contents of your Vault.

If you enable encryption, Vault Content is encrypted with AES-256-GCM client-side (on your device, in your browser or app) before it leaves your device on its way to Drive. We can’t decrypt it.

A local cached copy lives on your device (IndexedDB on web/PWA, SQLite on desktop) so the app works offline. It’s wiped when you sign out, reset your account, or clear your browser’s site data.

3.4 Encryption keys (only if you opt in)

If you turn on the encryption feature in Account → Security & Encryption, DataVault generates a 256-bit AES key. Where the key lives depends on your tier:

You can export your encryption key as a passphrase-protected .dvkey file at any time from Security & Encryption → “Export key.” Keep it somewhere safe — it’s the only way to recover your vault if both Drive and our backend become unavailable.

3.5 Subscription metadata

We keep one row per signed-in user in a subscriptions table on our backend, recording your tier (free or pro), status, and any expiration date. During the closed beta, all users are treated as Pro with the row auto-created on first request. No payment data lives on our backend at any point — payments (Phase 2 onwards) are handled by Lemon Squeezy as the merchant of record.

3.6 AI prompts (only if you use the AI Companion)

The AI Companion is a Bring-Your-Own-AI feature. You supply your own API key from your chosen provider (Gemini, OpenAI, Anthropic, OpenRouter), stored encrypted in IndexedDB on your device. When you send a prompt:

1. The app builds a context payload from the file you’re currently working on (or the page you’re on) — file content, structure, type-specific metadata. The exact shape is defined in src/ai/context/builders/.
2. The payload + your prompt is sent directly from your device to the AI provider you chose. It does not pass through our servers.
3. The provider’s response is returned to your device.
4. We don’t log, store, or otherwise see your prompts or the AI responses.

The provider may log your request per their own privacy policy. Your AI provider’s privacy policy applies to anything you send through the AI Companion. We recommend reading it.

3.7 Diagnostic / error data

In Phase 2 of the launch, DataVault will optionally send anonymized error reports to Sentry (a third-party error monitoring service) if you leave the opt-in toggle in Account → Privacy enabled. Vault Content is stripped from error payloads. You can opt out at any time. Until Phase 2 ships, DataVault does not send any error data anywhere.

3.8 Logs

The DataVault backend logs request method, URL, status code, and a timestamp for every API call, retained for up to 30 days for debugging and abuse prevention. These logs do not include request bodies, so they do not include refresh tokens, encryption keys, or any vault content.

4. Where your data is stored

5. Third parties / sub-processors

We do not sell your data to anyone. We do not share your data with advertisers, data brokers, or any party not listed above.

6. Your rights under GDPR

You have the right to:

1. Access — Ask us what personal data we hold about you. We’ll respond within 30 days. The bulk of “your data” is on your own Drive — you can inspect it directly there. The backend rows we hold are listed in §3.
2. Rectification — Ask us to correct inaccurate data. (Identity data comes from Google; correct it in your Google account.)
3. Erasure (“right to be forgotten”) — Ask us to delete your data. See §7 for what’s automatic and what requires a request.
4. Restriction — Ask us to stop processing your data while you contest accuracy or legitimacy.
5. Portability — Export your vault as a .dvault archive at any time from Account → Export Vault. The format is documented in the project’s supplemental architecture doc. The archive contains your vault JSON plus all binary assets in a portable ZIP.
6. Object — Object to processing based on legitimate interest. (We process the minimum data necessary to operate the service and don’t process for marketing without explicit consent.)
7. Withdraw consent — For any processing we ever ask consent for (e.g., the optional Sentry error reporting in Phase 2), you can withdraw consent at any time from Account → Privacy.
8. Lodge a complaint with your local supervisory authority — for EU residents, the Belgian DPA (gegevensbeschermingsautoriteit.be) or the authority of your country of residence.

To exercise any of these rights, email support@datavaultapp.com (or constantin.permiakov@gmail.com) with the subject “GDPR request: ”. We respond within 30 days.

7. Account deletion and data retention

What happens automatically

• Sign out: session ID is removed from the device. The backend session row remains until naturally expired (no automatic delete on sign-out; this is a known limitation we plan to tighten in Phase 3).
• Disable encryption (Account → Security & Encryption → Off): the encryption key is removed from the DataVault backend (server-managed mode) or from your Drive (drive-stored mode); your vault is re-saved unencrypted.
• Reset Account (Account → Reset Account): the entire DataVault folder on your Google Drive is deleted, the local cached vault is wiped, and you are signed out. Note (current limitation, planned fix in Phase 3 PR 3C): the backend session row and any server-managed encryption key are not yet deleted by Reset Account — they expire naturally or require an explicit deletion request from you. Until this is fixed automatically, please email us with subject “Delete my account” if you want a full backend wipe.

Retention

• Refresh tokens persist until you sign out, change your Google password, or revoke access in your Google account.
• Encryption keys persist until you disable encryption or request deletion.
• Subscription metadata persists for the lifetime of your account.
• Backend logs are kept for up to 30 days.
• Encryption-keys backup (Cloudflare R2): retained for 90 days (rolling). Backups are deleted automatically when older than 90 days.

8. Security

We protect your data with:

• TLS 1.2+ for every connection between your device and our backend.
• AES-256-GCM encryption at rest for refresh tokens and encryption keys in the backend database.
• AES-256-GCM client-side encryption (optional, but available to all users) for Vault Content on Drive.
• Limited access to the production backend (only operators with multi-factor authentication on their accounts).

No system is unbreakable. If we ever suffer a security incident affecting your data, we will notify you without undue delay (GDPR Article 34) and notify the Belgian DPA within 72 hours (GDPR Article 33).

9. Children

DataVault is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided personal data to us, contact us and we will delete it.

10. International data transfers

Your data is stored in the EU (Railway and Cloudflare R2 EU jurisdiction zones). The optional AI Companion sends your prompts to whichever AI provider you chose; some of those providers (e.g., OpenAI, Anthropic) are US-based and may process data outside the EU. We don’t control that flow — it goes directly from your device to the provider, governed by their privacy policy and your contract with them.

If we ever change the location of any data we hold on your behalf, we will update this Privacy Policy and (for material changes) notify existing users.

11. Changes to this policy

We will post material changes here, bump the version in the table at the top, and update the “Last updated” date. For substantive changes (e.g. adding a new sub-processor, expanding what we collect), we will also notify signed-in users in-app or by email.

12. Contact

• General privacy: support@datavaultapp.com (forwarder; in interim, reach us at constantin.permiakov@gmail.com).
• GDPR data-subject requests: same address, subject "GDPR request: <type>".
• Belgian DPA: https://www.gegevensbeschermingsautoriteit.be.