IP Vault Logo

Privacy Policy

1. An Overview of Data Protection

This Privacy Policy explains how IP Vault handles your personal data when you visit our website or use our multi-user SaaS IP protection services. Personal data is any information that can personally identify you.

2. Zero Server Media Storage & GDPR Compliance

Privacy-First Architecture: IP Vault operates a strict zero-server-storage model for creative media assets and evidentiary documents. When you execute a protection run, uploaded files and generated ZIP archives are processed entirely in-memory and deposited directly into your connected personal cloud storage repository (Google Drive, Dropbox, or Microsoft OneDrive). No media files, documents, or ZIP packages are permanently stored on IP Vault servers, eliminating cloud hosting risks and indemnifying the platform of asset holding obligations. Users may also stream-download the master archive to their local device from their dashboard or sync it via their cloud provider's desktop application.

Minimal Account Data: We store only basic user account credentials (email, hashed password, token balance), creator identifiers (IPI/CAE, PRO IDs, ISNI numbers), and cryptographic submission metadata (SHA-256 digest, submission timestamp, Bitcoin OpenTimestamps proof headers, and eIDAS RFC 3161 Time Stamp Response hex) necessary to operate your account and verify your cryptographic assertions.

3. Third-Party Services & Cloud API Integrations

  • Stripe: Secure payment processing and subscription credit management.
  • Gmail SMTP: Transactional email delivery (account verification & password resets).
  • OpenTimestamps: Public Bitcoin calendar servers used to record cryptographic SHA-256 hashes of submitted IP packages.
  • eIDAS RFC 3161 TSA (Lleida.net / FreeTSA): Certified Time Stamping Authority used to issue an eIDAS Article 41(2) Qualified Timestamp (.tsr) automatically on every IP protection run. Only the SHA-256 digest is transmitted; no file content leaves IP Vault servers.
  • OpenRouter AI: Automated generation of AI authorship methodology declarations. Prompts are sanitized; no raw uploaded media files are transmitted to AI providers.
  • Personal Cloud Archiving APIs: User-authorized REST API OAuth tokens for Google Drive, Dropbox, and Microsoft OneDrive to sync your sealed asset archives, declarations, and proof files to your personal cloud repositories.

4. Your Data Rights

You have the right to request access to your stored personal data, correct inaccuracies, or request account deletion at any time by contacting us at [email protected].