Privacy Policy

This Privacy Policy explains how HTMLvault (“we,” “us,” or “our”) collects, uses, and shares information when you use HTMLvault (the “Service”). It also explains the difference between data we handle as a controller (your account) and data we handle as a processor on your behalf (the content you publish and the visitors who view your links). By using the Service, you agree to this Policy. If you do not agree, do not use the Service.

1. Two roles: controller and processor

As a controller, we determine how we handle information about you — our account holder. This includes your registration details, billing information, and how you use the Service. As a processor, we handle information on your behalf and under your instructions. This includes the HTML content you publish, any personal data contained in it (reports, lead lists, proposals), and analytics about the visitors who view your links. For that data, you are the controller and are responsible for having a lawful basis to collect and process it, and for honoring the privacy rights of those individuals. If you require a Data Processing Agreement, contact us at support@htmlvault.com.

2. Information we collect

Account information. Your email address and authentication details, organization name, and team members you add. Authentication is handled through our third-party identity provider; we do not store the passwords you use to sign in.

Sign-up attribution. If you accept analytics cookies on our website, we record how you first arrived there: the referring website and any campaign parameters in the link you followed (utm_source, utm_medium, and utm_campaign). If you then create an account, we classify that visit into a channel (such as search, social, email, a referral, or a campaign) and store the channel, with the campaign or referring website, with your account. If you create your account through an AI assistant integration or an invitation to an organization, we record that instead, with the name of the assistant or organization. If you publish links without an account and then sign in from the same browser within 30 days, we also store an identifier with your account that connects it to those links. See our Cookie Policy for the cookies involved.

Billing information. Paid plans are processed by Stripe. We receive limited billing details (such as plan, status, and the last four digits of a card and billing contact) but we do not store full payment card numbers — Stripe does.

Content you publish. The HTML files, assets, links, and configuration you create, including any tracking codes and PII-scanning settings you enable. This may contain personal data of third parties that you choose to include. If you protect a link with a password, we store a one-way hash of it, which we use to check the password when someone opens the link. For a password set on our website, we also keep a retrievable copy so that you can view and copy it from your dashboard. That copy is shown only to the link’s owner, and it is deleted when you remove the password or delete the link, or when the link’s content is deleted under Section 6.

Link analytics. When someone views a link you create, we collect interaction data such as view counts, unique and repeat views, time on page, scroll depth, the viewer’s IP address and the approximate geographic location derived from it, an identifier that our page generates and stores in the viewer’s browser so that repeat visits can be counted, device and browser type, screen size and browser language, referral and UTM parameters, and bot-detection signals. We collect this so you can measure engagement. The IP address is stored with each view record. We use it to recognize views of a link by the person who created it, to limit abuse and duplicate counting, and to estimate location. View records, including IP addresses, are deleted with the link’s content under Section 6, or when the link is deleted. You can also inject your own third-party tracking (Google, Meta, etc.), which is governed by those providers’ policies.

Usage and technical data. Log data, IP addresses, request metadata, and error information we use to operate, secure, and improve the Service.

3. How we use information

We use information to: provide, maintain, and improve the Service; create and manage your account and authenticate you; process payments and manage subscriptions; generate the link analytics you rely on; run safeguards such as PII scanning, malware and safe-browsing checks, and abuse prevention; communicate with you about your account, security, changes to the Service, and (where you have not opted out) product news; and comply with legal obligations and enforce our Terms and Acceptable Use Policy. We do not sell your personal data.

4. AI PII scanning and “bring your own key”

If you enable AI-powered PII scanning on a paid plan using your own AI provider key (BYOK), the content being scanned is transmitted to the AI provider you select, under your account with that provider, and subject to that provider’s terms and privacy practices. We facilitate the connection; we do not control the provider’s handling of that data. Our default regex-based scanning runs within the Service and does not transmit your content to an external AI provider.

5. How we share information

We share information only as follows: Service providers who help us operate the Service (for example, hosting, database, payment processing, authentication, email delivery, and security/safe-browsing), who process data on our behalf under contract; AI providers you choose for BYOK scanning, as described above; Legal and safety disclosures where required by law, to enforce our terms, or to protect the rights, property, or safety of HTMLvault, our users, or the public — including reporting illegal content such as CSAM to the appropriate authorities; and Business transfers in connection with a merger, acquisition, or sale of assets, subject to this Policy. See our Subprocessors page for the current list of providers.

6. Data retention

We retain account data for as long as your account is active. We retain each link, its content, and its view records until the link expires or its owner deletes it. The owner of a link sets its expiry. A link published from a Free account expires no later than 30 days after it is published, and a link published without an account expires no later than 7 days after it is published. A link with no expiry is kept until its owner deletes it. After a link expires, its HTML content, its view records (including viewer IP addresses), and any retrievable copy of its password are kept for the data retention window of the link’s account and then deleted. The default window, which also applies to links published without an account, is 90 days. You can choose a shorter window, and paid plans can choose a window of up to two years; for a Teams or Enterprise organization, the window is set for the whole organization. The link’s title, settings, and aggregate view counts are kept after that deletion. When data is deleted or an account is closed, we remove or de-identify it within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

7. Security

We use technical and organizational measures to protect information, including encryption in transit, encryption of the AI provider keys you store with us (BYOK), storage of API keys as one-way hashes only, access controls, and secret scanning in our development process. Link passwords set on our website are also stored in a retrievable form so that the link’s owner can view them, as described in Section 2. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise rights regarding the account data we control, contact us at support@htmlvault.com. If your request concerns personal data contained in a link or report created by one of our customers, we act as a processor — please contact that customer (the controller) directly. We will assist them as required. We honor applicable privacy laws including the GDPR and CCPA/CPRA. California residents have the right not to receive discriminatory treatment for exercising their privacy rights, and we do not sell or “share” personal information as those terms are defined under California law.

9. International transfers

We are based in the United States and process data there. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards for international transfers.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

11. Cookies

We use essential cookies to operate the Service and authenticate you, and limited analytics on our own marketing site. We minimize non-essential cookies. See our Cookie Policy for details. Tracking you inject into your own links is your responsibility and subject to your own cookie and consent obligations.

12. Changes to this Policy

We may update this Policy from time to time. Material changes take effect when posted, and we will update the “Last updated” date above. Continued use of the Service after changes take effect constitutes acceptance.

13. Contact

HTMLvault, 704 13th St East, Suite 600, Whitefish, MT 59937. support@htmlvault.com