Privacy policy

Last updated: 3 November 2026. VaultZero is in private beta; this policy describes what the service does today.

What we never receive

• The plaintext of your memories. Encryption happens in code you run.
• Your payload encryption keys. They never leave your device.
• Your embedding provider credentials.

What we do receive

• Vector embeddings. Stored so retrieval can work. Embeddings are not encryption: published inversion methods can partially reconstruct text from a vector.
• Encrypted payloads (ciphertext envelopes), which we cannot read.
• Metadata: tenant and principal identifiers, scope labels, record sizes, and timestamps.
• Usage records: which route template was called, the response status, and how long it took. We do not log payloads, ciphertext, or concrete record identifiers.
• Operational data from our infrastructure providers, described under sub-processors.

Legal basis and role

For customer data we act as a processor on your instructions; for account and billing data we act as a controller. Our legal bases are performance of contract, our legitimate interest in operating and securing the service, and compliance with legal obligations.

Retention

• Memories are deleted when they expire (TTL) or when you delete them.
• Erasure requests are recorded in an append-only journal so a database restore cannot resurrect erased data. Journal entries are retained for 400 days, which exceeds the life of any restorable backup.
• Usage records are retained for billing reconciliation.

Your rights

You can request access, correction, export, or erasure of your data, and you can object to processing. Email privacy@vaultzero.cc. We respond within 30 days, which is the statutory deadline. Erasure requests are honoured through the purge pipeline described in our documentation, including after a backup restore.

Location

Customer data is stored in the London region (europe-west2). Backups are pinned to the same region.

Contact

Privacy: privacy@vaultzero.cc. Security: security@vaultzero.cc.