This Privacy Policy explains how Stratonix Systems LLP (LLPIN ACT-8303), a limited liability partnership registered in India with its registered office at 1 Shivaji Marg, Hewett Road, Lucknow, Uttar Pradesh 226018, India ("VaultBro", "we", "us", or "our"), collects, uses, shares, and protects your personal data when you use the VaultBro service at www.vaultbro.com (the "Service").

This Policy forms part of, and should be read together with, our Terms and Conditions. We are the data controller for the personal data described here.

If you do not agree with this Policy, please do not use the Service.

1. Who This Policy Covers

This Policy applies to everyone who visits our website, creates an Account, or subscribes to the Service, wherever you are located. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to you, this Policy is written to meet those requirements, and we identify the legal basis for each use of your data in Section 4.

2. The Data We Collect

2.1. Account data. When you register, we collect your email address and authentication details. If you sign in with Google, we receive your email address and basic profile information from Google; we do not receive your Google password.

2.2. Your documents and the data extracted from them ("Content"). When you upload documents, we store the files and process their contents to extract structured information (such as document type, dates, names, categories, and expiry dates), to organise them, and to power search. Your documents may contain sensitive information — for example identity, financial, tax, insurance, or medical documents. Where this includes special categories of personal data under Article 9 of the GDPR, we process it only on the basis of your explicit consent, which you give by choosing to upload it (see Section 4).

2.3. Payment data. Payments are handled by Paddle as merchant of record. Paddle collects and processes your card or payment details directly; we do not receive or store your full card details. We receive limited billing information from Paddle, such as your subscription status, billing country, transaction identifiers, and renewal dates.

2.4. Usage and technical data. We collect technical data needed to run and secure the Service, such as IP address, device and browser information, log data, and timestamps of actions you take.

2.5. Support data. If you contact support, we collect the information you provide (such as your email and the contents of your message) through our support tool.

3. How We Collect It

We collect data directly from you (when you register, upload documents, or contact us), automatically (technical and usage data as you use the Service), and from third parties who act on our instructions or as independent providers (such as Google sign-in and Paddle for payments).

4. Why We Use Your Data, and Our Legal Basis

What we use it for Legal basis (GDPR / UK GDPR) Creating and running your Account; storing, organising, and letting you search your documents; providing core features Performance of our contract with you (Art. 6(1)(b)) Processing the contents of documents that contain special-category data (e.g. health, identity) Your explicit consent (Art. 9(2)(a)), given by uploading them Taking payment and managing your subscription Performance of our contract with you (Art. 6(1)(b)) Keeping billing and tax records Compliance with a legal obligation (Art. 6(1)(c)) Securing the Service, preventing fraud and abuse, enforcing usage limits, and operating our refund-abuse safeguard Our legitimate interests in protecting the Service and our users (Art. 6(1)(f)) Sending you service and transactional emails (e.g. confirmations, cancellation notices, security alerts) Performance of our contract with you (Art. 6(1)(b)) Responding to legal requests and complying with law Compliance with a legal obligation (Art. 6(1)(c))

You can withdraw consent at any time by deleting the relevant documents or closing your Account. Withdrawing consent does not affect processing that already took place.

5. AI Processing of Your Documents

5.1. To provide its core features, the Service must read the contents of your documents in a readable (unencrypted) form. Document contents are sent to and processed by our AI provider, Google (Gemini), to extract information, generate search indexes, and answer your queries.

5.2. We are not a "zero-knowledge" service. Operating the AI features necessarily requires this access, so we do not claim that no party can ever access your document contents. We limit access to what is needed to run and support the Service.

5.3. Training. We use Gemini on a paid tier under which Google does not use your document contents to train its general models. Google may still process and briefly retain content as needed to operate its service, prevent abuse, and meet its own legal obligations. We do not control Google's infrastructure.

6. Who We Share Your Data With

We do not sell your personal data. We share it only with service providers ("sub-processors") that help us run the Service, and only as needed. Key sub-processors are:

Provider Purpose Primary region Supabase Database, file storage, authentication Singapore Google (Gemini) AI extraction, search, and embeddings Google infrastructure (may include EU/US) Vercel Application hosting Global edge / US Upstash Background job queue and cache Regional (as configured) Paddle Payment processing (merchant of record) UK / EU / US Resend Transactional email delivery US / EU Sentry Error monitoring US / EU Zoho Customer support desk Regional (as configured)

We may also disclose data where required by law, to enforce our Terms, to protect the rights or safety of our users or others, or in connection with a business transfer (such as a merger or sale), subject to this Policy.

7. International Data Transfers

Your data is stored primarily in Singapore and may be processed by sub-processors in other countries, including the EU, the UK, and the US. Where we transfer personal data out of the EU/EEA or UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or transfers to countries covered by an adequacy decision. You can ask us for more information about these safeguards using the contact details in Section 12.

8. How Long We Keep Your Data

8.1. We keep your Account data and Content for as long as your Account is active.

8.2. When you close your Account or use the 90-day money-back guarantee, we delete your Account and Content, as described in our Terms and Conditions. Note that stored files are not recoverable from database backups once deleted, and backups expire on their normal cycle.

8.3. We retain limited records after deletion only where necessary, including billing and tax records (as required by law) and a normalised, hashed reference to your email used to operate our one-refund-per-customer safeguard. These records do not allow us to reconstruct your documents.

9. How We Protect Your Data

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, envelope encryption of stored files, access controls and row-level security on user data, authentication and authorization checks on requests, rate limiting, and error monitoring. No system is perfectly secure, and you are responsible for keeping your login credentials confidential and for keeping your own copies of important documents.

10. Your Rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — get a copy of the data we hold about you.

• Rectification — correct inaccurate or incomplete data.

• Erasure — have your data deleted ("right to be forgotten").

• Restriction — limit how we process your data.

• Portability — receive your data in a portable format.

• Objection — object to processing based on our legitimate interests.

• Withdraw consent — where processing relies on consent.

You can exercise most of these rights directly in your Account (including exporting and deleting your documents) or by contacting us at support@vaultbro.com. We will respond within the time required by law (generally one month under the GDPR / UK GDPR).

If you believe we have mishandled your data, you have the right to complain to your local data protection authority. In the EU this is the supervisory authority of your country; in the UK it is the Information Commissioner's Office (ICO).

11. Our EU and UK Representative

We have appointed Prighter as our representative under Article 27 of the GDPR and the UK GDPR. You may contact our representative on any data-protection matter using the details below.

EU Representative: Prighter — [INSERT PRIGHTER EU ADDRESS] [INSERT PRIGHTER EU CONTACT / ONLINE FORM]

UK Representative: Prighter — [INSERT PRIGHTER UK ADDRESS] [INSERT PRIGHTER UK CONTACT / ONLINE FORM]

(Details to be inserted once Prighter appointment is complete.)

12. Cookies and Similar Technologies

We use only the cookies and local storage needed to run the Service, including:

• Essential cookies for signing you in and keeping your session secure.

• Checkout cookies set by Paddle during payment.

• Error and performance data collected by Sentry to keep the Service reliable.

We do not use advertising cookies. If we introduce analytics or other non-essential cookies in future, we will update this Policy and, where required, ask for your consent.

13. Children

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

14. Changes to This Policy

We may update this Policy from time to time. If a change is material, we will give reasonable notice (for example, by email or an in-Service notice). Your continued use of the Service after the effective date of an updated Policy means you accept it.

15. Contact Us

Stratonix Systems LLP LLPIN: ACT-8303 Registered office: 1 Shivaji Marg, Hewett Road, Lucknow, Uttar Pradesh 226018, India Email: support@vaultbro.com Website: www.vaultbro.com

For EU/UK data-protection matters, you may also contact our representative, Prighter, using the details in Section 11.