Legal

Privacy Policy

Last updated: July 5, 2026

This Privacy Policy explains what data VauntSpace (“we”, “us”) collects when you use vauntspace.com(the “Service”), how we use it, and the choices you have. Plain English. No dark patterns.

1. What we collect

We collect three broad categories of data:

a. Account data (from you)

Email address, display name, and profile photo.
Login credentials, managed by our identity provider (Clerk); passwords are hashed at their end, never stored by us in plaintext.
Business details you enter (Product info, listing content, Marketplace / Showcase / RFQ text, Boardroom messages, uploaded documents).
Payment details if you subscribe to a paid plan; card numbers are handled by Stripe and PayPal, not by us.

b. Usage data (automatic)

Pages you visit inside VauntSpace, when, and from what browser.
IP address and coarse geographic region (country/state).
Referring URL if you arrived from another site.
Errors and performance telemetry we need to keep the Service running.

c. Reader analytics (public pages)

When someone reads an article you published on VauntSpace, we count them once per day using an anonymous fingerprint: a one-way hash of their IP, user agent, a rolling daily salt, and a private server salt. We don't set cookies for this, and we can't reverse the fingerprint back to a person. Same shape for outbound-click tracking on your Product URLs.

2. How we use it

To run and improve the Service.
To generate the AI content you request (articles, images, social drafts, code suggestions).
To show honest reader-count analytics on your listings and public creator profile.
To bill you if you're on a paid plan.
To send transactional emails (receipt, password reset, security alert, plan changes).
To send product emails only if you opted in (Syndicate updates, feature announcements). Unsubscribe anytime.
To detect abuse, protect the Service, and comply with law when legally required.

We do not sell your personal information. We do not share your content with advertisers. We do not use your account data to train the models that write your marketing.

Only these categories of third parties, only for the reasons listed:

Identity provider (Clerk) to authenticate you.
Payment processors (Stripe, PayPal) to charge you and handle refunds.
Cloud infrastructure (Vercel for hosting, Neon for the database, Cloudflare for CDN + email routing, R2 for file storage, Fly.io for video processing) to serve the Service.
AI providers, only if you opt into paid AI managed tier, or you connect BYOK. Model requests you trigger route through the provider you chose.
Social platforms you connect, content you tell us to post ends up on them.
Integrations you connect, data flows only in the directions and to the tools you explicitly authorize.
Legal recipients, if we're legally required to (subpoena, court order, applicable law).
An acquirer, in the event of a sale of VauntSpace. You'd be notified before any material change of hands.

Every third party we share with is bound by a contract that restricts what they can do with your data.

4. Cookies and similar

We use a small number of first-party cookies to keep you signed in and remember your preferences. We do not use third-party advertising cookies. You can clear cookies from your browser at any time; you may need to sign in again.

5. AI processing and BYOK

By default, AI operations run on our own infrastructure using local models. When you use a paid tier, AI operations may route through a third-party AI provider we use under contract. Your content is processed only to answer your request; it is not shared with the provider for their own training, per our contract.

If you connect your own AI provider account (BYOK), your API key is encrypted at rest (AES-256-GCM). We only use it to fulfill AI requests you personally trigger. Your requests go directly to your provider under their privacy terms; we do not intercept or retain the AI outputs beyond what's needed to display them to you and any collaborators you authorize.

6. How long we keep data

Account data: while your account is open, plus a reasonable period after closure for finalizing billing, satisfying legal obligations, and defending claims (typically up to 3 years).
Reader-analytics fingerprints: 30 days rolling. We keep aggregated counts (readers per day per article) longer.
Boardroom content: as long as the Boardroom is open plus 7 years after close, to protect against later legal disputes about deals that closed there.
Server logs: 90 days for security and debugging.

On account deletion, we delete or anonymize personal data within 30 days, except where we're legally required to keep it longer.

7. Your rights

You have the right to:

See the data we hold about you.
Correctit if it's wrong (most of it you can edit yourself in the dashboard).
Delete your account and its data. Ask us at privacy@vauntspace.com.
Exportyour data. We'll send you a JSON archive within 30 days of your request.
Opt out of product emails at any time via the unsubscribe link in each email.
Objectto processing based on our legitimate interests. Contact us and we'll respond.

If you're a California resident, you have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what data we collect, the right to deletion, and the right to opt out of “sale” or “sharing” of personal information (we don't do either). To exercise those rights, contact us; we'll respond within 45 days.

If you're in the EEA/UK, we process personal data under contract (to run the Service you signed up for) and legitimate interest (running the platform safely and improving it). You have the standard GDPR/UK-GDPR rights; exercise them via privacy@vauntspace.com.

8. Security

We use TLS for data in transit and encryption at rest for sensitive credentials (OAuth tokens, BYOK API keys). Passwords are hashed by our identity provider. We audit access to production data.

No system is perfectly secure. If we learn of a breach that affects your data, we'll notify you and any authorities as required by law.

9. Children

VauntSpace is not intended for anyone under 18. If we learn we've collected personal data from someone under 18, we'll delete it.

10. International visitors

VauntSpace is operated from the United States. If you use the Service from outside the US, your data will be transferred to and processed in the US and other countries where our providers operate. Where required, we use appropriate transfer mechanisms (like Standard Contractual Clauses).

11. Changes

We'll update this Privacy Policy from time to time. Material changes get an email or a prominent in-app notice before they take effect.

12. Contact

Privacy questions or requests: privacy@vauntspace.com.

For the rules of the Service itself, see the Terms of Service.