Privacy Notice

• Account data — email address, display name, hashed login credentials. Used to create and secure your account and to authenticate you. Legal basis: performance of our contract with you.
• Subscription data — subscription status, plan, billing period dates and the payment provider’s customer and subscription references. Used to grant and renew access to paid content. Legal basis: contract.
• Email delivery data — the address we send the newsletter to and delivery outcomes such as bounces, complaints and unsubscribes. Used to deliver the newsletter and to stop sending to addresses that reject mail. Legal basis: contract and legitimate interests in maintaining deliverability.
• Support messages — anything you send us. Used to answer you. Legal basis: legitimate interests.
• Technical and usage data — IP address, device and browser identifiers, pages viewed, and error logs. Used for security, fraud prevention, and improving the service. Legal basis: legitimate interests in running a secure and functional site.

We do not collect or store your card details. Payment information is collected directly by our Merchant of Record and never reaches our servers.

• Service providers / subprocessors — hosting, database and authentication infrastructure, and email delivery, acting on our instructions.
• Stripe, our payment processor, for the sale of the subscription, payment processing, subscription management, invoicing and tax compliance. Stripe acts as its own controller for that processing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where we are required to disclose by law.

We do not sell your personal data.

Account and subscription data is kept while your account is open and for up to seven years after closure where records are needed for tax and accounting. Technical logs are kept for up to 12 months. Support correspondence is kept for up to two years. When data is no longer needed it is deleted or anonymised.

Our providers may process data in the United States and other countries. Where data leaves the UK or EEA we rely on adequacy decisions or Standard Contractual Clauses with appropriate supplementary measures.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent where processing relies on consent. Email privacy@vault10capital.com and we will respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority.

You can unsubscribe from the newsletter at any time using the link in any issue or by cancelling your subscription.

We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest for our database, row-level access controls that scope data to the account that owns it, and least-privilege access for administrative operations. No system is perfectly secure, but we treat any incident affecting your data seriously and will notify you where required.

We use strictly necessary cookies and local storage to keep you signed in and to maintain your session; the site does not work without them. Our payment provider sets cookies needed to run checkout. We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings, but doing so will sign you out.