Privacy notice

1. What we hold

• People on an account: name and e-mail address; when they last signed in; whether they use a second factor (never the seed in a readable form). Held to run the account and to send sign-in links, receipts and notices. Basis: the contract with your organisation.
• The organisation: name, billing address, tax id, the billing e-mail. Basis: the contract, and tax law.
• Payments: handled by Stripe; we hold the invoice and its status, not the card. Basis: the contract.
• Sign-in, checkout and enquiry attempts: the e-mail address asked for and the network address it came from, kept for two days to limit abuse. Basis: our legitimate interest in a secure service.
• Enquiries from the site: what you wrote, your name and e-mail address, the organisation you named, and the network address it came from, which we clear after thirty days. Basis: your request, and our legitimate interest in a secure service.
• Appliances: an instance id, the version and channel, the licence digest, the times seen. Basis: the contract.
• Support conversations: what you write to us. Basis: the contract.
• The audit trail: every act on the account, by whom and when, kept as long as the account exists and seven years after for the financial records. Basis: the contract and our legal obligations.

2. What we do not do

No analytics, no advertising, no cookies, no third-party scripts on this site. We never sell or share personal data for others' purposes. The product on your machine sends us no personal data of your users.

3. Where

In Microsoft Azure's West US 2 region, United States. If you are in the United Kingdom or the European Economic Area, the transfer rests on the standard contractual clauses with Microsoft and Stripe and the contract with you; write to us for a copy.

4. Who else

Microsoft (hosting, e-mail delivery) and Stripe (payments), each under a data-processing agreement. No one else.

5. How long

Account data for as long as the account exists; then the financial records for seven years, the rest deleted within ninety days of closure. Sign-in, checkout and enquiry attempts for two days. An enquiry's network address for thirty days. Mail delivery records for two days after delivery.

6. Your rights

You may ask for a copy of your data, its correction or its deletion, and object to processing on our legitimate interests; you may complain to your supervisory authority. Write to privacy@vertexlake.com; we answer within a month.

7. Changes

We publish a new version here with its date and tell account owners by e-mail when a change is material.