Privacy Notice

Version 2026-10-03 · Effective 3 October 2026

What VAULTIX collects about you, why, who receives it, how long it is kept, and how to see, correct or delete it.

What we collect

Your account: email address, display name and password. Your password is held by our sign-in provider; VAULTIX never sees it. If you sign in with Google, the link to your Google profile photo.
Your profile: picture or drawn character, bio and the date you joined.
Institution verification: your university email domain, or the evidence you upload for a Sheriff to check.
Payment details: your mobile number, bank, account holder name and account number, for refunds and payouts.
Payments: the amount, the bill reference and its status from the payment provider. Your card and online banking details stay with the payment provider.
What you post: Wanted requests, replies, claim files, reports, appeals and privacy requests.
Records of your agreement to these terms, including that you confirmed you are 18 or older.
Technical records: security and error logs (time, page and a request reference). Logs never contain your files, bank details or password.

Why we use it

We do not sell your data, show advertising, or use tracking or analytics cookies.

To run your account and show your public profile.
To check that you study at the institution you name, before you post, fund, claim or download.
To take payments, hold bounties, and pay payouts and refunds to the right bank account.
To review claims, handle reports and appeals, and keep VAULTIX safe.
To send you messages about your account and activity, in the app and by email.
To keep the records the law requires, such as payment records.

What others can see

Anyone who can browse sees your display name, picture, bio, joined date, badges and the requests you posted.
Your email address, verification evidence, bank details, claims and what you funded are never shown publicly.
Sheriffs see what they need to review claims, reports and verification. Only the Owner sees a full bank account number, and only to pay a payout or refund.

Who receives it

These services run parts of VAULTIX for us and receive only what that part needs. Some are outside Malaysia, so your data is transferred to them for that purpose.

Clerk: sign-in and account security (United States).
Supabase: the database and private file storage (Singapore).
Vercel: hosting the website (United States, with servers worldwide).
HitPay: taking payments (Singapore).
Brevo: sending email (France, European Union).
Google: only if you choose to sign in with Google.

How long we keep it

Account and profile: while your account exists. When you delete your account, your name, picture, bio and bank details are removed straight away.
Institution verification evidence: deleted 30 days after the decision and any appeal.
Claim files: a rejected claim's file is deleted 30 days after the final decision; a quarantined file after 90 days or when its investigation closes, whichever is later; an approved resource is kept while someone has access to it.
Replies on missing-item and discussion requests: deleted 7 days after the thread closes, unless a bounty, review or appeal still needs them.
Payment, payout, refund, moderation and audit records, agreements to these terms and privacy requests: 7 years. After you delete your account they are kept without your name.

Your rights

See and correct your data: most of it is on your profile, where you can change it yourself.
Ask for a copy of your data, a correction or a deletion: use “Privacy requests” on your profile. Only the Owner reads these requests, and the answer appears on your profile, normally within 21 days.
Delete your account from your profile, from 30 days after you created it, once no payment, payout, refund or claim of yours is in progress.
If you do not give the details a feature needs (for example bank details to receive a payout), that feature is not available to you.

Security

Files and verification evidence are stored privately, and every access is checked on our servers and in the database.
Your account number is shown back to you masked to its last four digits.

Changes

When this notice changes, you are asked to accept the new version on your next visit, together with the Terms of Use.

What we collect

Your account: email address, display name and password. Your password is held by our sign-in provider; VAULTIX never sees it. If you sign in with Google, the link to your Google profile photo.

Your profile: picture or drawn character, bio and the date you joined.

Institution verification: your university email domain, or the evidence you upload for a Sheriff to check.

Payment details: your mobile number, bank, account holder name and account number, for refunds and payouts.

Payments: the amount, the bill reference and its status from the payment provider. Your card and online banking details stay with the payment provider.

What you post: Wanted requests, replies, claim files, reports, appeals and privacy requests.

Records of your agreement to these terms, including that you confirmed you are 18 or older.

Technical records: security and error logs (time, page and a request reference). Logs never contain your files, bank details or password.

Why we use it

We do not sell your data, show advertising, or use tracking or analytics cookies.

To run your account and show your public profile.

To check that you study at the institution you name, before you post, fund, claim or download.

To take payments, hold bounties, and pay payouts and refunds to the right bank account.

To review claims, handle reports and appeals, and keep VAULTIX safe.

To send you messages about your account and activity, in the app and by email.

To keep the records the law requires, such as payment records.

What others can see

Anyone who can browse sees your display name, picture, bio, joined date, badges and the requests you posted.

Your email address, verification evidence, bank details, claims and what you funded are never shown publicly.

Sheriffs see what they need to review claims, reports and verification. Only the Owner sees a full bank account number, and only to pay a payout or refund.

Who receives it

These services run parts of VAULTIX for us and receive only what that part needs. Some are outside Malaysia, so your data is transferred to them for that purpose.

Clerk: sign-in and account security (United States).

Supabase: the database and private file storage (Singapore).

Vercel: hosting the website (United States, with servers worldwide).

HitPay: taking payments (Singapore).

Brevo: sending email (France, European Union).

Google: only if you choose to sign in with Google.

How long we keep it

Account and profile: while your account exists. When you delete your account, your name, picture, bio and bank details are removed straight away.

Institution verification evidence: deleted 30 days after the decision and any appeal.

Claim files: a rejected claim's file is deleted 30 days after the final decision; a quarantined file after 90 days or when its investigation closes, whichever is later; an approved resource is kept while someone has access to it.

Replies on missing-item and discussion requests: deleted 7 days after the thread closes, unless a bounty, review or appeal still needs them.

Payment, payout, refund, moderation and audit records, agreements to these terms and privacy requests: 7 years. After you delete your account they are kept without your name.

Your rights

See and correct your data: most of it is on your profile, where you can change it yourself.

Ask for a copy of your data, a correction or a deletion: use “Privacy requests” on your profile. Only the Owner reads these requests, and the answer appears on your profile, normally within 21 days.

Delete your account from your profile, from 30 days after you created it, once no payment, payout, refund or claim of yours is in progress.

If you do not give the details a feature needs (for example bank details to receive a payout), that feature is not available to you.