Privacy Policy
This policy explains what personal data Vaultly ltd (“Vaultly”, “we”) collects when you use Vaultly, why, and the rights you have. We are the data controller. We keep data collection to what the marketplace needs to work, stay safe and meet the law. We do not sell your data, show ads, or use analytics or tracking tools.
1. Data we collect
| Category | What |
|---|---|
| Account | Email address, username, and your password stored only as a salted scrypt hash (we never see or store the password itself). |
| Marketplace | Listings, orders, prices, quantities, the deposit address and cryptocurrency amount for each order, transaction IDs of deposits, and delivery details a seller provides (which may include game account logins for account sales). |
| Communications | Messages in order chats and support tickets. |
| Reviews | Reviews you leave (positive or negative, and your comment), and the order they relate to. They are shown publicly with your username partly hidden. |
| Photos | Listing photos sellers upload. We remove embedded metadata such as GPS location, camera details and comments before storing them. |
| Sellers | Your seller application answers and contact handle, your balance history, and the wallet addresses you ask us to pay out to. |
| Technical | Your IP address, which is processed to route traffic, limit abuse (for example login attempts) and keep the service secure; it is recorded only for administrator actions. A session cookie keeps you logged in (see Cookie Policy). |
We do not ask for your real name, address or ID documents during normal use. We may ask for identity documents if the law requires it or to investigate fraud, and will explain why at the time.
2. Why we use it
| Purpose | Legal basis |
|---|---|
| Running your account, processing orders, escrow, payouts and refunds, and delivering support | Performance of our contract with you |
| Preventing fraud, abuse and account takeovers; securing the service; resolving disputes with evidence | Our legitimate interest in a safe marketplace |
| Keeping accounting, tax and anti-money-laundering records; responding to lawful requests | Legal obligation |
| Service messages about your orders and account | Performance of contract |
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not send marketing.
3. Who can see it
- Other users: your username, your listings and approved listing photos, reviews of you as a seller, and (to the other party of an order) your order messages and delivery details. Your email address is never shown to other users.
- Our staff: administrators and moderators, only as needed to run the service and resolve disputes.
- Service providers: our hosting and network provider (Cloudflare, Inc.), which routes and protects traffic to the site and therefore processes IP addresses and request data on our behalf under a data processing agreement.
- Authorities: when we are legally required to, or to protect users from fraud.
- A buyer of our business: if Vaultly is sold or merged, subject to this policy.
4. Blockchain data
Cryptocurrency transactions are recorded on public blockchains. Anyone can see a transaction between two addresses. We cannot change or delete blockchain records. We never publish which person is behind which address.
5. International transfers
Our network provider operates globally, so data may be processed outside your country, including outside the European Economic Area. Where that happens we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Login sessions expire 14 days after your last activity.
- Account data is kept while your account is open. When you close it, we delete or anonymise what we no longer need.
- Order, payment, payout and ledger records, and the related chats, are kept for as long as accounting, tax and anti-money-laundering laws require (typically between five and seven years), and for as long as needed to handle disputes and legal claims.
- Seller applications are kept while you are a seller and for a reasonable period after a rejection, to prevent repeated abuse.
7. Security
Traffic to Vaultly is encrypted in transit. Passwords are hashed with scrypt. Money records are kept in an append-only ledger. Pages are served with strict security headers and never load scripts, fonts or images from third parties, so your browser only talks to us. Admin actions are logged. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
8. Your rights
Depending on where you live (including under the EU and UK General Data Protection Regulation), you can ask us to:
- give you a copy of your personal data;
- correct inaccurate data;
- delete your data, where we are not required to keep it;
- restrict or object to certain processing;
- give you your data in a portable format.
To make a request, open a support ticket or email [email protected]. We answer within one month. Some records (for example completed orders and the money ledger) must be kept for legal reasons even if you ask us to delete them. You also have the right to complain to your local data protection authority.
9. Children
Vaultly is only for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will close it.
10. Cookies
We use a single strictly necessary cookie to keep you logged in and protect forms. There are no analytics or advertising cookies. See the Cookie Policy.
11. Changes and contact
We will post any changes here and update the effective date. The data controller is Vaultly ltd, 68 Filokyprou 1011 Nicosia.
Questions about this document? Open a support ticket or email [email protected].