Privacy policy

This privacy policy explains how Business Vault collects, uses, stores and shares personal information when you use businessvault.space and the Business Vault platform. It is written for customers and website visitors. It is not a substitute for independent legal advice.

Who we are. Business Vault is operated from the contact address businessvault@businessvault.space. If you need a formal entity name, registered address or privacy officer details for a contract, request them through that address before relying on this notice for procurement.

Information we collect. We collect account details such as name, work email and authentication data. We collect organisation and business records you enter, including business names, locations, ABN or ACN where provided, asset records, ownership and access records, evidence files you upload, monitoring results, alerts, incidents, support messages, billing status and PayPal subscription references. We also collect technical logs needed to operate and secure the service, such as sign-in events and audit entries.

How we use information. We use this information to provide the service, authenticate users, enforce organisation permissions, run supported monitoring checks, store and retrieve evidence, operate incident and recovery workflows, process subscriptions through PayPal, respond to support requests, prevent abuse and improve reliability. We do not sell personal information.

Payments. Subscription payments are processed by PayPal. Business Vault receives subscription and payment status needed to activate, suspend or cancel access. Card details are handled by PayPal according to PayPal's own terms and privacy information.

Where information is hosted. The Business Vault application and database currently run on Contabo GmbH infrastructure in Germany. Evidence files are stored on encrypted local application storage on that host. Transactional email is sent using the Business Vault mail configuration for businessvault@businessvault.space. See the subprocessors page for the current provider list.

Sharing. We share personal information with infrastructure and payment providers listed on the subprocessors page, with people you invite into your organisation or agency, and where required by law. Agency users only see client organisations they are authorised to manage.

Retention and deletion. Account, organisation, asset, evidence, monitoring and incident records are retained while your organisation remains active. You can export business data and close an organisation. Closing an organisation deletes its records and stored files. Some audit entries may remain without the organisation identifier so the platform can show that the closure happened.

Security. Passwords are hashed with Argon2id. Sessions use HTTP-only cookies. Evidence and integration secrets are encrypted before storage. Important access and administrative actions are written to an audit log. No method of transmission or storage is completely secure.

Your choices. You can update account details, invite or remove users according to your role, export organisation data where the product provides export, and request support through businessvault@businessvault.space. If you believe we hold inaccurate personal information about you, contact us so we can review it.

Children. Business Vault is a business service and is not directed at children.

Updates. We may update this policy as the service or providers change. The current version will be published on this page with the date of the latest material update when that date is maintained in the product content.

Contact. Privacy questions: businessvault@businessvault.space.