Privacy Notice

1. Who we are

This Privacy Notice is issued by Randolph IT Consulting ("we", "us", "our"), the operator of the VerentraVault service. Randolph IT Consulting acts as the data controller for the personal data described in this notice. You can reach us at the contact address on our website.

2. Personal data we collect

• Account data — name, email address, hashed password, and authentication identifiers.
• Vault content — the passwords, financial records, documents, contacts, bills, and other information you choose to store. This content is stored encrypted.
• Support and communications — messages you send us, including email and in-app support requests.
• Usage and telemetry — logs, device identifiers, browser type, IP address, and product analytics used to operate and secure the service.
• Cookies and similar technologies — session cookies required to keep you signed in and to prevent abuse.

3. How we use personal data and our legal basis

• To create and manage your account and provide the service — performance of a contract.
• To secure the service, prevent fraud, and investigate abuse — legitimate interests.
• To provide customer support — performance of a contract and legitimate interests.
• To improve our product — legitimate interests.
• To send transactional emails (receipts, security alerts, verification) — performance of a contract.
• To comply with legal obligations — legal obligation.

4. Who we share data with

We share personal data only with the following categories of recipients:

• Service providers / subprocessors — hosting, database, storage, email delivery, and analytics providers that operate on our behalf under contract.
• Payment processor (Stripe) — Stripe processes payments, subscription billing, invoicing, and tax compliance for us. Stripe collects and processes the personal and payment data needed to complete your purchase; we never store your card details.
• Professional advisers — legal, accounting, and compliance advisers where necessary.
• Authorities — where required by law, court order, or to protect rights and safety.

5. International transfers

Some of our providers may process data outside your country of residence. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Data retention

We keep personal data only for as long as needed to provide the service and to meet legal, tax, and accounting obligations. When you delete your account, your vault content is deleted or anonymised, subject to backup retention windows and any records we must keep by law.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. You may also have the right to lodge a complaint with your local data protection authority. To exercise these rights, contact us using the details on our website. We aim to respond within one month.

8. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and least-privilege administration. No system is perfectly secure, but we work to protect your data and to notify you and regulators if a qualifying incident occurs.

9. Cookies

We use strictly necessary cookies to keep you signed in and to secure the service. We do not use advertising cookies. Where we use analytics cookies, you can manage them through your browser settings.

10. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be communicated by email or through the service.