Privacy Policy

Last updated: October 22, 2026

This Privacy Policy describes what Vaulken ("we", "us", "our") collects, why, and how it is protected when you use the Vaulken cloud platform ("Service").

1. Data Controller

Vaulken is the data controller for your account and service data, and a data processor for the Customer Data in your Vaults. Our obligations as a processor are set out in the Data Processing Agreement.

Contact: privacy@vaulken.dev

2. Data We Collect

2.1 Account Data

When you create an account we collect:

  • Email address
  • Password, stored as a hash. We never store it in plaintext.
  • Workspace name

If you sign in with Google, we receive your email address and display name from Google. The Google access token is used once to read your profile, then discarded. We do not access Google Drive, Gmail or any other Google service.

2.2 Vault Configuration Data

When you create a Vault we store:

  • Vault name, type (plain or Obsidian), description and optional path prefix
  • Bucket connection details: endpoint, region, bucket name, access key ID
  • The bucket secret key, encrypted through a key management service. It is never stored in plaintext.

2.3 Search Index Data

To index a Vault we generate and store:

  • A full-text index (trigram sets per file). It is derived from your files and cannot be reversed into the original text.
  • Semantic search vectors, mathematical representations of text chunks used for meaning-based search. Also irreversible.
  • File metadata: paths, sizes, content fingerprints and modification dates.

We never store the text of your files in our database. The files stay in your bucket.

2.4 AI Extraction Data

To make PDFs and images readable by your AI, the Service sends them to our AI provider (see section 5) and receives text back. That text is written to your bucket, next to the source file, as a cache. We do not keep it.

2.5 Usage Data

We keep daily counters per Workspace and Vault: MCP requests, semantic search queries, pages and images processed by AI extraction, and embedding volume. They enforce plan limits and feed the usage page in the dashboard. They contain no file content.

2.6 Authentication Data

  • OAuth client registrations and refresh tokens for MCP clients, stored as hashes
  • Session tokens, in an encrypted cookie

2.7 Technical Data

We collect automatically:

  • IP addresses, for rate limiting and security. They are not kept long term.
  • Server logs (request paths, status codes, timestamps), kept for 30 days.

We measure audience with a self-hosted instance of Umami, running on our own infrastructure in the EU. It sets no cookie, stores no IP address and no identifier that could be linked to you. It records page views, referrers and anonymous interaction events, such as a click on the "I'm interested" button of the Pro plan, with no personal data attached. The only cookie set by the Service is the encrypted session cookie needed to keep you signed in.

3. How We Use Your Data

Purpose Data used Legal basis (GDPR)
Provide the Service Account, Vault configuration, indexes Contract (Art. 6(1)(b))
Authenticate users and MCP clients Email, password, sessions, tokens Contract (Art. 6(1)(b))
Index and extract file content File contents, in transit only Contract (Art. 6(1)(b))
Enforce plan limits Usage counters Contract (Art. 6(1)(b))
Rate limiting and security IP addresses, logs Legitimate interest (Art. 6(1)(f))
Measure audience Anonymous page views and events Legitimate interest (Art. 6(1)(f))
Send transactional emails Email address Contract (Art. 6(1)(b))

4. What We Do Not Do

  • We do not sell, rent or share your data with third parties for marketing.
  • We do not use Customer Data to train or improve any AI or machine learning model.
  • We do not serve ads, use third-party analytics, or set tracking cookies.
  • We do not profile your behavior.
  • We do not store your file contents in our database.

5. Subprocessors

Subprocessor Purpose Location
Scaleway SAS Infrastructure: compute, database, key management, backups Paris, France (EU)
Scaleway TEM Transactional email delivery Paris, France (EU)
Mistral AI Embeddings for semantic search; OCR of PDF pages; image description. Content is sent for processing and not retained by Mistral. Paris, France (EU)
Google LLC Sign in with Google only: email and display name United States

No Customer Data is ever sent to Google. Google's handling of your data during sign-in is covered by Google's Privacy Policy.

Your bucket provider (AWS, Scaleway, Cloudflare, Backblaze, your own MinIO, or another) is your own supplier, chosen and contracted by you. It is not a Vaulken subprocessor.

6. Data Storage and Security

  • Hosting in the EU (Paris, France)
  • Bucket credentials and tokens encrypted at rest through a key management service
  • TLS 1.2 or higher on every connection
  • Passwords hashed with an industry-standard algorithm
  • Each Vault connects only to the bucket you configured, and every query is scoped to your Workspace

7. Data Retention

Data Retention
Account data Until account deletion
Customer Data (files) Never held by Vaulken. They stay in your bucket; deleting a Vault only removes the connection.
Extraction caches Written to your bucket; you control them
Search indexes Until Vault deletion
Usage counters Until account deletion
Server logs 30 days
Password reset tokens 1 hour
Refresh tokens Until revoked or account deletion

8. Your Rights (GDPR)

You have the right to access, rectify and erase your personal data, to receive it in a portable format, to restrict its processing, and to object to processing based on legitimate interest. Write to privacy@vaulken.dev; we answer within 30 days.

9. Account Deletion

When you delete your account:

  • All Workspaces, Vaults, MCP URLs, tokens and usage counters are deleted
  • All search indexes are deleted
  • Your encrypted bucket credentials are deleted
  • Your email and account data are removed from our database
  • Your buckets are untouched. We simply lose access to them.

This cannot be undone.

10. International Data Transfers

Account data, indexes and usage data are stored and processed in the European Union. The only transfer outside the EEA is your email address and display name sent to Google during "Sign in with Google", covered by Google's Data Processing Terms and Standard Contractual Clauses. You avoid that transfer by signing up with email and password.

11. Children's Privacy

The Service is not intended for people under 16. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this policy. We notify you of material changes by email or in the dashboard. The date at the top shows the last revision.

13. Contact