Privacy Policy
Vault AI Systems, LLC, a Minnesota limited liability company (“Vault”, “we”, “us” or “our”), respects your privacy. This Privacy Policy (the “Policy”) explains how we collect, use, protect, disclose and retain personal information, and the rights and choices you have.
This Policy applies when you: visit vaultaisystems.com or any other website, page or online tool that we operate and that links to this Policy (the “Sites”); ask for information, a quote or a demonstration; schedule a sales consultation; receive, accept or pay an invoice, or otherwise place or manage an order; receive onboarding, warranty service or Support Services; communicate with us by email, telephone, video call or social media; attend an event; or apply for a job with us. We call all of these, together, the “Services”.
Please read the whole Policy. By using the Services you agree to the collection, use and disclosure of your personal information as this Policy describes, and to the Vault Terms of Service. If you do not agree, please stop using the Services.
Vault sells to businesses, professional practices, schools, public entities and other organizations. Most of the personal information we handle is business contact information about the people who work for those organizations. If your organization gave us your details, for example as a purchasing contact, an administrator or an authorized support requester, this Policy applies to that information.
Changes. We may change this Policy at any time by posting a revised version with a new “last updated” date. We encourage you to check it from time to time. Your continued use of the Services after a change takes effect means you accept the revised Policy. If a change materially reduces your rights or materially changes how we handle personal information we already hold, we will give advance notice by email to the contacts on file or by a prominent notice on the Sites.
1. Your Cube and your data
What stays with you. An Alpha Cube, Alpha Cube Ion or Alpha Cube Pro (a “Cube”) runs on your premises, on your network and under your control. The documents, files, prompts, outputs, embeddings, fine-tuned models, user accounts and logs that you and your users create or store on a Cube (“Customer Data”) stay on the Cube. The Vault software is designed to operate without transmitting Customer Data to Vault. We do not host, access, monitor, back up or retrieve Customer Data, and we have no remote access to a Cube except during a support session that you start, supervise and end.
Vault is not your processor. Because we do not receive or handle Customer Data, we do not act as a data processor, service provider, business associate, school official or similar party for it. Your organization alone decides what goes onto a Cube and is responsible for that information under the laws that apply to it. If you are a client, patient, student or employee of an organization that uses a Cube and you have a question about your information, please contact that organization. We cannot help with those requests because we do not have the data.
What we may receive from you about a Cube. When you ask for support or warranty service you may give us the Cube’s serial number, software version, configuration details, error codes, a diagnostics bundle, screenshots and a description of the problem (“Diagnostic Information”). Our Terms of Service ask you to remove Customer Data before sending anything to us, and during a remote session to keep Customer Data off the screen. If personal information reaches us anyway, we use it only to handle your request and then delete it where practicable. Diagnostic Information is otherwise handled as Section 3 and the Terms of Service describe.
2. Personal information we collect
“Personal information” means information that identifies, relates to or could reasonably be linked with an individual. What counts depends on the law where you live. It does not include information that has been aggregated or de-identified so that it can no longer reasonably be linked to you. We may publish or share aggregated or de-identified information, for example statistics about how the Sites are used.
We collect personal information in three ways.
2.1 Information you give us
Inquiries and web forms. Name, work email address, telephone number, organization, role, location and the content of your message when you contact us, ask for a quote or demonstration, or use a form on the Sites. If you use the savings calculator, we may record the figures you enter.
Sales consultations. We schedule sales consultations through Calendly, a third-party scheduling service. When you book a consultation, Calendly collects your name, email address, telephone number if you provide it, the time you choose, your time zone and your answers to any booking questions, under Calendly’s own privacy policy, and passes that information to us. We use it to hold the consultation, prepare a quote or invoice, and follow up with you.
Orders. Name, organization, billing and shipping addresses, email address, telephone number, products and quantities ordered, deployment location, quote, invoice and purchase order details, tax-exemption certificates and the terms you accepted.
Payment. We accept payment only by ACH debit and wire transfer. Bank account details are collected by our payment processor, Stripe, or handled by your bank and ours. We receive the account holder’s name, the bank name, the last four digits of the account number, transaction identifiers, amounts and payment status. We do not accept payment cards.
Delivery and site readiness. The name and contact details of the person who will receive the shipment, delivery instructions and the answers on the site readiness checklist.
Onboarding, warranty and support. The names, work contact details and roles of your administrators and authorized support requesters; Cube serial numbers; the content of support requests and our replies; Diagnostic Information; records of remote sessions, such as date, duration and the engineer involved; and return and replacement records. We do not record remote support sessions. If we record a telephone or video call, we will tell you at the start of the call.
Security advisories and transfers. Contact details you give us so that we can send security advisories and release notices, including the details of a new owner when a Cube is transferred.
Vulnerability reports and policy reports. Your contact details and the content of any report you send us.
Marketing preferences, surveys, events and testimonials. Your subscription choices, survey answers, event registrations and any review or testimonial you agree to give.
Job applications. Your résumé or CV, work and education history, qualifications, references, work-authorization status, and anything else you choose to include.
Please do not send us sensitive information such as government identifiers, health information, client files, student records or account passwords. We do not need it and do not want to receive it.
2.2 Information we collect automatically
When you use the Sites, we and our hosting provider may automatically collect:
Log and device data. Internet Protocol (IP) address, browser type and settings, device type, operating system, language, referring and exit pages, pages viewed and their order, date and time of requests, and diagnostic and error data.
Approximate location. The general region that your IP address indicates. We do not collect precise location.
Interaction and conversion data. Page views, clicks on buttons and links, calculator interactions, questions opened in the FAQ, scroll depth, form submissions, and events such as a consultation booked, an invoice sent and a payment confirmed.
Attribution data. Campaign parameters in the link that brought you to the Sites, such as source, medium, campaign, term and content, and the referring website.
Email engagement. Whether an email we sent was delivered and opened and whether a link in it was clicked, where the email tool we use provides that.
Cookies. The Sites use analytics cookies and similar technologies, provided by a third-party analytics service, to understand how visitors use the Sites, such as which pages are viewed, how long they are viewed, how visitors arrive at the Sites and which links they follow. Our hosting provider also sets strictly necessary cookies to keep the Sites secure and working. The Sites do not use advertising cookies, and we do not use analytics data for targeted advertising. You can block or delete cookies through your browser settings; the Sites will still work, although some measurements will not be recorded. The Sites do not respond to “Do Not Track” browser signals.
2.3 Information from other sources
Your organization and your colleagues, who may name you as a contact, administrator or authorized requester.
Payment processors and banks, which confirm payments, returns and disputes.
Carriers and shipping insurers, which give us delivery status, signatures and claim information.
Authorized resellers and field-service partners, which may pass us order, registration and service information.
Fraud-prevention, sanctions-screening and export-screening providers, and public government lists.
Social media platforms, when you interact with our pages or mention us, according to your settings on those platforms.
Public and commercial sources, such as company websites, professional networking sites, business directories and event organizers, which we use to keep business contact information accurate and to identify organizations that may be interested in our products.
Recruiters, referees and background-check providers, for job applicants, where the law allows.
3. How we use personal information
We use personal information for the business and commercial purposes below, and for any other purpose we describe to you when we collect it.
To provide the Services. To answer inquiries; prepare quotes; screen, accept, build, ship and insure orders; take payment and handle returns of payment; confirm site readiness; deliver onboarding; and provide warranty service and Support Services, including remote sessions and on-site visits. We cannot do these things without the relevant information.
To send service communications. Order confirmations, shipping and delivery notices, invoices, security advisories, release and end-of-support notices, warranty and support messages, and notices about our terms and this Policy. Cubes are designed to run without an internet connection, so email is how these reach you. These messages are not marketing, and you cannot opt out of them while you own a Cube or have an open order.
To comply with the law. Tax, accounting and record-keeping duties; export control, sanctions and anti-fraud screening; responding to lawful requests from courts, regulators and law enforcement; and employment and recruitment laws.
To protect Vault and others. To detect, investigate and prevent fraud, abuse, security incidents, duplicate or unauthorized orders and technical failures; to protect the rights, property and safety of Vault, our customers and the public.
To enforce our agreements. To carry out and enforce the Terms of Service, the Support Services Terms and other agreements, including billing, collection, warranty eligibility, license compliance and the handling of disputes and claims.
To market our products. To send news about products, features, events and offers to business contacts, to identify organizations that may be interested in our products, and to measure the results. You can opt out of marketing at any time, as Section 7 explains.
To analyze and improve. To understand how the Sites and Services are used, to fix problems, to develop and secure our products and services, and to produce aggregated or de-identified statistics. This includes using Diagnostic Information and the content of support requests to improve our products and documentation.
To personalize. To remember your preferences and show content that is relevant to your organization or sector.
To recruit. To assess applications, communicate with candidates, and keep records of our hiring decisions.
For business transactions. To evaluate or carry out a financing, merger, acquisition, reorganization, or sale of some or all of our business or assets.
With your consent or at your direction. For any other purpose that we describe to you and that you agree to, including publishing a testimonial you have approved.
We do not use personal information to make decisions that produce legal or similarly significant effects about individuals by automated means alone. We may use automated tools to help screen orders for fraud, sanctions and export risk; a person reviews any order those tools flag before we decline it.
4. How we disclose personal information
We do not sell personal information, and we do not share it with third parties for cross-context behavioral advertising. We disclose personal information only as follows.
Service providers. Companies that help us run our business and that may use personal information only to provide services to us, under written terms that require them to protect it. They include providers of website hosting and security, payment processing, email delivery, business productivity and record-keeping tools, meeting scheduling, analytics, customer-relationship and help-desk tools, accounting and tax services, e-signature, fraud, sanctions and export screening, and recruiting.
Carriers, insurers and field technicians. UPS, FedEx or another carrier to deliver your order; our third-party shipping insurer to insure it and handle claims; and, where on-site service is provided, a field-service partner whose technician visits your site. They receive the contact and address details needed for that job.
Banks and payment networks, to take payment and to handle returns, reversals and disputes.
Authorized resellers and your own organization. If you bought through a reseller, we may exchange order, warranty and support information with it. We may share information about an order, a Cube or a support request with other contacts at your organization.
Professional advisers, such as lawyers, accountants, auditors and insurers, where reasonably necessary.
Legal and safety. We may access, preserve and disclose information if we believe in good faith that doing so is required or appropriate to: comply with the law or with legal process such as a subpoena, court order or government request, including export, sanctions and tax authorities; respond to auditors and regulators; enforce our agreements; investigate or defend claims; or protect the rights, property or safety of Vault, our customers or anyone else.
Business transfers. We may disclose and transfer personal information to buyers, investors, lenders, advisers and other parties in connection with a proposed or completed financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of our business or assets. By using the Services you acknowledge that such a transfer may occur.
Within our corporate group, if we have affiliates, for the purposes in this Policy.
With your consent or at your direction.
We may use and disclose aggregated or de-identified information for any lawful purpose. We will not try to re-identify de-identified information except to test that it is de-identified.
5. How we protect personal information
We use technical, administrative and physical safeguards designed to protect personal information against loss, misuse and unauthorized access, disclosure, alteration and destruction. We limit access to people and service providers who need it for their work.
No website, email system, cloud service or method of transmission is completely secure. We cannot guarantee the security of information you send to us or that we or our service providers hold. Email in particular may not be secure, so please think carefully about what you send and do not email us sensitive information. You are responsible for keeping any account credentials confidential. If you believe your interaction with us is no longer secure, contact us immediately as Section 16 describes.
The security of a Cube and of Customer Data on it is your organization’s responsibility, as the Terms of Service explain.
6. How long we keep personal information
We keep personal information for as long as we need it for the purposes in this Policy, including to provide the Services, keep business and tax records, provide warranty service and support for the life of a Cube, send security advisories, resolve disputes, establish or defend legal claims, prevent fraud, and meet our legal obligations. When we no longer need it, we delete it or remove the means by which it can be linked to you, unless the law requires us to keep it longer.
7. Your rights and choices
Rights under applicable law. Depending on where you live and whether the law in question applies to Vault, you may have the right to ask us to confirm whether we hold personal information about you, to give you access to it or a portable copy, to correct it, to delete it, to restrict or object to certain uses, and to opt out of certain processing. We will respond to a valid request as the applicable law requires. Some information is exempt, and we may keep information that we need to complete a transaction, provide warranty service, keep required records, detect security incidents, comply with the law, or establish or defend legal claims.
How to make a request. Email support@vaultaisystems.com with the subject line “Privacy request”, or contact us as Section 16 describes. Tell us which right you wish to exercise and which information your request concerns. We will take reasonable steps to verify your identity before acting, which may include asking you to confirm information we already hold. If we cannot verify your identity we may decline the request. An authorized agent may make a request for you if it provides written proof of its authority; we may still ask you to verify your identity directly. We do not charge for a request unless it is manifestly unfounded, excessive or repetitive.
Appeals. If we decline your request and the law where you live gives you a right to appeal, reply to our decision or email support@vaultaisystems.com with the subject line “Privacy appeal”. If we deny the appeal, we will explain how you may contact your state’s attorney general.
Marketing. You can opt out of marketing email at any time by using the unsubscribe link in the message or by emailing support@vaultaisystems.com. We may take up to 10 business days to process the change. You will continue to receive the service communications described in Section 3.
No retaliation. We will not discriminate or retaliate against you for exercising a privacy right.
Your organization’s records. If your organization named you as a contact and you no longer hold that role, ask your organization to update its contacts with us, or tell us directly.
8. Third-party sites and services
The Services may link to, or let you interact with, websites, payment pages, social media platforms and other services that we do not own or operate. This Policy does not apply to them, and we have no control over and take no responsibility for their content or privacy practices. Read the privacy policy of each site or service you use. The same applies to the makers of the third-party software and AI models that run on a Cube.
9. Children
The Services are intended for organizations and the adults who work for them. They are not directed to anyone under 18, and we do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us as Section 16 describes and we will take steps to delete it unless the law requires us to keep it.
10. Where information is processed; visitors from outside the United States
Vault is based in the United States, and we currently sell only to organizations located in North America. We and our service providers process personal information in the United States and in other countries where those providers operate. The data protection laws of those countries may differ from, and may be less protective than, the laws where you live.
If you use the Sites, place an order or contact us from outside the United States, including from Canada or Mexico, you understand that your personal information will be transferred to and processed in the United States. Where the law requires a safeguard for such a transfer, we rely on a mechanism that the law recognizes, such as standard contractual clauses approved by the European Commission or the United Kingdom, an adequacy decision, or an exception that the law permits. We require service providers that handle personal information for us to protect it under written terms.
11. Notice to California residents
This section applies only to California residents, and only to the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), applies to Vault. It describes the personal information we have collected in the past 12 months and the rights the CCPA provides. In this section “personal information”, “sell”, “share” and “sensitive personal information” have the meanings the CCPA gives them.
| CCPA category | Examples of what we collect | Sources (Section 2) | Purposes (Section 3) | Disclosed for a business purpose to (Section 4) |
|---|---|---|---|---|
| (A) Identifiers | Name, work email, telephone number, postal address, IP address, online identifiers | 2.1, 2.2, 2.3 | 1 to 11 | 1 to 9 |
| (B) Customer records (Cal. Civ. Code §1798.80(e)) | Name, address, telephone number, signature, bank account details received from the payment processor, employment | 2.1, 2.3 | 1 to 5, 9, 10 | 1 to 8 |
| (D) Commercial information | Products and services ordered, order and payment history, warranty and support history | 2.1, 2.3 | 1 to 8, 10 | 1 to 8 |
| (F) Internet or network activity | Log, device, interaction, attribution and email-engagement data | 2.2 | 1, 4, 6, 7, 8 | 1, 6, 7 |
| (G) Geolocation data | Approximate location from IP address | 2.2 | 1, 3, 4, 7, 8 | 1, 6 |
| (H) Audio or similar information | Call recordings, if we record a call after telling you | 2.1 | 1, 4, 5, 7 | 1, 6 |
| (I) Professional or employment information | Organization, role, and for job applicants work and education history | 2.1, 2.3 | 1, 2, 6, 9 | 1, 4, 5, 6 |
| (J) Education information | For job applicants only | 2.1 | 9 | 1, 6 |
| (K) Inferences | Likely interest in our products, drawn from the information above | 2.1, 2.2 | 6, 7, 8 | 1 |
We do not seek to collect sensitive personal information from visitors or customers, and we do not use or disclose it for purposes that would give rise to a right to limit its use. We keep each category for as long as Section 6 describes.
No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the past 12 months. We have no actual knowledge that we sell or share the personal information of anyone under 16.
Your rights. Subject to exceptions, California residents have the right to: know what personal information we have collected, used and disclosed, and receive a copy of the specific pieces we hold; delete personal information we collected from them; correct inaccurate personal information; opt out of any sale or sharing; limit the use of sensitive personal information; and not be discriminated or retaliated against for exercising these rights. To exercise a right, follow Section 7.2. We will verify your identity by matching information you provide with information we hold, and we will respond within the period the CCPA allows. An authorized agent must provide written proof of authority or a power of attorney.
Shine the Light. California Civil Code section 1798.83 lets California residents ask for a notice about personal information disclosed to third parties for their own direct marketing. We do not disclose personal information for that purpose.
12. Residents of other U.S. states
Several other states, including Minnesota, where Vault is organized, have privacy laws that give residents rights to confirm, access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. Some also give a right to a list of the specific third parties to which personal data has been disclosed, and a right to question the result of profiling. Those laws apply only to businesses that meet certain thresholds and generally do not cover people acting in a business or employment capacity.
We do not sell personal data, use it for targeted advertising, or profile individuals in ways that produce legal or similarly significant effects. Where one of these laws applies to us and to you, you may exercise your rights under Section 7.2 and appeal under Section 7.3. Nevada residents may email support@vaultaisystems.com to register an opt-out of any future sale of covered information, although we do not sell it.
13. Notice to residents of Canada and Mexico
We sell to organizations in Canada and Mexico as well as in the United States. This section applies to the extent that Canadian or Mexican privacy law applies to our handling of your personal information. If it conflicts with the rest of this Policy, this section controls for those individuals.
Canada. We collect, use and disclose personal information with your knowledge and consent, which may be express or implied depending on the circumstances and the sensitivity of the information, or as the law otherwise permits. Your personal information is transferred to, stored and processed in the United States and in other countries where our service providers operate. While it is there, it is subject to the laws of those countries and may be accessible to their courts, law-enforcement and national-security authorities. Subject to exceptions in the law, you may ask for access to the personal information we hold about you, ask us to correct it, and withdraw your consent, subject to legal and contractual limits and reasonable notice. To do so, or to ask about our practices or make a complaint, contact the person responsible for our privacy compliance at support@vaultaisystems.com and follow Section 7.2. You may also complain to the Office of the Privacy Commissioner of Canada or to the privacy regulator of your province.
Mexico. Vault AI Systems, LLC, which you can reach as Section 16 describes, is responsible for the personal information it collects from you. You have the rights of access, rectification, cancellation and opposition, and you may revoke your consent or ask us to limit the use or disclosure of your personal information, subject to the exceptions in the law. To exercise these rights, follow Section 7.2. By giving us your personal information you consent to its transfer to, and processing in, the United States for the purposes in this Policy.
14. Notice to individuals in the European Economic Area, the United Kingdom and Switzerland
We do not offer our products outside North America. This section applies only if, and to the extent that, the EU General Data Protection Regulation, the UK GDPR or the Swiss Federal Act on Data Protection (together, the “GDPR”) applies to our handling of your personal information, for example because you contacted us from one of those countries. If it conflicts with the rest of this Policy, this section controls for those individuals. Vault AI Systems, LLC is the controller. References to personal information in this Policy include personal data as the GDPR defines it.
| Purpose (Section 3) | Legal basis |
|---|---|
| 1 To provide the Services; 2 service communications; 5 to enforce our agreements | Performance of a contract with you or your organization, or steps at your request before entering one (Article 6(1)(b)); otherwise our legitimate interests in running our business (Article 6(1)(f)) |
| 3 To comply with the law | Compliance with a legal obligation (Article 6(1)(c)) |
| 4 To protect Vault and others; 7 to analyze and improve; 8 to personalize; 10 business transactions; 6 marketing to business contacts | Our legitimate interests in securing, improving, promoting and developing our business, where your interests and fundamental rights do not override them (Article 6(1)(f)) |
| 6 Marketing where consent is required; 11 other uses you agree to | Your consent (Article 6(1)(a)), which you may withdraw at any time without affecting earlier processing |
| 9 To recruit | Steps at your request before entering a contract (Article 6(1)(b)) and our legitimate interests (Article 6(1)(f)) |
Your rights. Subject to conditions and exceptions in the GDPR, you may have the right to: access your personal information and receive information about how we process it; have inaccurate information corrected; have information erased; restrict processing; object to processing based on legitimate interests and to direct marketing; receive information you gave us in a structured, commonly used, machine-readable format and have it sent to another controller; withdraw consent; and not be subject to a decision based solely on automated processing that has legal or similarly significant effects. To exercise a right, follow Section 7.2. We may limit a request where the law allows, for example where it would affect the rights of others or where we need the information for legal claims. You also have the right to lodge a complaint with the data protection authority where you live or work.
15. How this Policy fits with our other terms
The Vault Terms of Service govern your use of the Sites and your purchase and use of our products. The Vault Support Services Terms govern support plans. This Policy is incorporated into those terms. If this Policy and those terms conflict on how we handle personal information, this Policy controls. Nothing in this Policy creates contractual rights for anyone who is not a party to those terms, except where the law requires.
16. Contact us
If you have a question about this Policy, want to exercise a privacy right, or have a privacy complaint, contact us by email at support@vaultaisystems.com, Attn: Privacy.