Your data at vvault, and your rights under the GDPR
vvault is run from Belgium, so the GDPR applies to it directly. Here is what vvault collects, why, where it's stored, how long it's kept, and how to get a copy or have it deleted.
This page sums up vvault's privacy policy in plain words. The policy is the text that applies.
Who is responsible for your data
vvault is run from Brugge, in Belgium. For your account, your uploads and your subscription, vvault is the data controller: it decides how that data is used, and it answers to you for it.
For your contacts and the emails you send them, the roles flip. You decide who gets contacted and why, and vvault only carries it out, as your processor. That part is covered by vvault's data processing agreement, which applies automatically, with nothing to sign.
For anything about your data, write to contact@vvault.app. It goes straight to the vvault team.
What vvault collects, and why
| What | Why | On what basis |
|---|---|---|
| Your account: name, email, handle, picture, language | To run your account | The contract with you |
| What you upload: beats, covers, titles, notes, BPM, key | To store it and share it the way you choose | The contract with you |
| Plays, downloads and opens on what you share | To show you who played what | Legitimate interest |
| Technical data: IP address, device, logs | Security, and fixing what breaks | Legitimate interest |
| Analytics and advertising cookies | Measuring how vvault is used and whether ads work | Your consent, only if you accept |
| Invoices and payouts | Tax and accounting | A legal obligation |
A summary of sections 2 and 3 of the privacy policy. vvault never asks for sensitive data like health or political opinions, and has no use for it.
Where it's stored
Your content is hosted in the European Union, with Supabase on Amazon Web Services. Some providers handle a limited part of it outside Europe: Resend delivers the emails you send from the United States, and Stripe handles payments from Ireland and the United States.
Each of those transfers rests on a mechanism the GDPR recognises, the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. The sub-processors page names every company and the mechanism for each.
- vvault doesn't sell your data
- Advertising partners get nothing unless you accept marketing cookies
When you send a beat, and when you receive one
The sender sees the play
When someone opens a vvault link or email and plays, downloads or saves a beat, the person who sent it sees it. That's what vvault is for, and the privacy policy says so plainly.
Listening needs no account
An artist can play your link without signing up. Only an invite-only link asks them to sign in, so vvault can check they are the person you invited.
Your contacts are yours
The contacts you import and the emails you write are used only to do what you ask. vvault doesn't use them for anything of its own.
“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay”
Your rights, and how to use them
Every one of these is free. vvault answers within one month, and tells you if it needs longer and why.
See or correct your data
Ask for a copy of what vvault holds about you, in a format you can take elsewhere, or for anything wrong to be fixed.
Delete your account
Do it yourself in Settings, Security & privacy, or ask us. Your data is deleted or anonymised, except the sales and payout records Belgian law makes us keep for up to ten years.
Object or withdraw consent
Refuse marketing at any time, turn cookies off from the cookie settings, or object to what vvault does on its legitimate interest.
Complain if it goes wrong
You can go to the Belgian Data Protection Authority, or to the authority where you live or work.
Questions
Does vvault sell my data?
No. vvault doesn't sell personal data or pass it to data brokers.
How long does vvault keep my beats after I delete them?
Deleted tracks and packs first sit in a state you can recover them from, then they are removed for good. Backups expire on their own cycle.
Can I use vvault if I'm under 16?
No. vvault is not for anyone under 16, and deletes a child's data as soon as it learns of it.
Where do I find the full texts?
The privacy policy, the data processing agreement, the sub-processors and the cookie policy.
Sources
Where the facts on this page come from.
Read next
How vvault protects your unreleased music
Private by default, sign in without a password, links that expire. And what we haven't done yet.
Read
How to keep unreleased music private
Send links instead of files, choose who can open each beat, and close access when you're done.
Read
How vvault protects your account
What already protects your account, and a five-minute checklist to lock it down.
ReadNever wonder who listened again.
Pro or Ultra, monthly or yearly. Cancel anytime.
Photos: Brett Sayles, panumas nikhomkhai, Nathan Thomas, Raul Ling and George Becker on Pexels