Privacy Policy

1. What we collect

Information you give us

• Account information: name, email address, mobile phone number (if you provide it), password (stored as a salted hash), and marketing preferences.
• Vault content: documents, images, notes, tags, folder names, and any other content you upload or create in your Vault.
• Legacy Vault choices: the people you designate, the documents you share with them, and the verification steps you configure.
• Support and correspondence: messages you send us, including attachments.

Information from connected accounts

If you connect a financial account through our data-connection provider (Plaid), we receive from that provider the account balances, transactions, statements, account and routing numbers (where you authorize retrieval), account owner names, and related metadata for the accounts you connect ("Connected Data"). Plaid's own privacy notice describes how they handle information; see plaid.com/legal.

Information collected automatically

• Device and log data: IP address, device identifiers, operating system, browser type, referring URLs, and pages viewed.
• Cookies and similar technologies: see our Cookie Policy.
• Usage data: feature use, session duration, error reports, and diagnostic events.

Information from payment processing

When you subscribe, our payment processor (Stripe) collects your payment card details on our behalf. We receive a token, the last four digits of the card, the card brand, the expiration month/year, and the billing ZIP code. We do not receive or store your full card number or CVC.

2. How we use personal information

We use personal information to:

• provide, maintain, and improve the Services;
• create and secure your Account, including authentication and fraud prevention;
• process subscriptions, payments, refunds, and renewals;
• retrieve and display Connected Data you have authorized;
• generate payoff scenarios, reminders, and other Outputs you have enabled;
• deliver Legacy Vault materials to the people you have designated, under the rules you set;
• communicate with you about the Services, security, and important changes;
• send marketing communications where you have opted in, which you can turn off at any time;
• monitor and enforce our Terms of Use and Acceptable Use Policy; and
• comply with legal obligations and respond to lawful requests.

We do not use Connected Data or Vault content to train artificial-intelligence models. We do not sell your personal information. We do not use your data to make credit decisions about you.

3. Legal bases (for California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia residents)

Our use of personal information under U.S. state privacy laws is based on our contract with you (to provide the Services you signed up for), your consent (for marketing communications and non-essential cookies), our legitimate interests (to secure and improve the Services and prevent fraud), and legal obligation (to comply with applicable law).

4. When we share information

We share personal information only in these situations:

• With service providers that help us run the Services under written agreements limiting their use of the data. Current providers are listed on our Subprocessor List.
• With people you designate through the Legacy Vault or ordinary sharing features, under the rules you set.
• With payment and account-connection providers to process payments (Stripe) and connect accounts (Plaid).
• To comply with law or a valid legal request, or to protect the rights, property, or safety of Mortgage Vault, our users, or others.
• In a business transaction such as a merger, acquisition, financing, or sale of assets, subject to a confidentiality obligation and a commitment that the acquirer honors this Policy.
• With your consent for any other purpose you approve.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. Your choices and rights

• Access and update. You can view and update your Account information in settings.
• Delete Vault content. You can delete individual items or your entire Vault at any time. Deletion removes items from active systems; backups are purged on a rolling schedule.
• Disconnect accounts. You can disconnect any linked financial account at any time; this stops future retrieval.
• Marketing opt-out. Every marketing email includes an unsubscribe link. You can also email privacy@mymortgagevault.com.
• Cookies. See the Cookie Policy and the Cookie Preferences link in the footer.
• State privacy rights. If you are a resident of a U.S. state with a privacy law that grants access, correction, deletion, or opt-out rights, you can exercise those rights by emailing privacy@mymortgagevault.com. We will verify your request through your Account credentials or, if needed, additional identity checks proportionate to the sensitivity of the data.
• Do Not Track and Global Privacy Control. We honor the Global Privacy Control (GPC) signal as an opt-out of the "sale" or "sharing" of personal information under California law. We do not currently respond to Do Not Track headers because there is no consensus standard.
• Appeals. If we deny a rights request, you may appeal by replying to our decision email. We will respond within a reasonable time.

6. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, email privacy@mymortgagevault.com and we will delete it.

7. How long we keep information

We keep personal information for as long as your Account is active and for a limited period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Vault content: kept until you delete it, then removed from active systems within 30 days and from backups within 90 days.
• Connected Data: stopped on disconnect; historical data kept until you delete it.
• Account records: kept for the life of the Account plus a reasonable period afterward for tax, audit, and legal purposes.
• Consent logs: kept for at least one year for fraud and dispute resolution.
• Security and access logs: kept for 90 days.

8. How we protect information

We use administrative, technical, and physical safeguards to protect personal information, including:

• encryption of personal information in transit (TLS 1.2+) and at rest;
• least-privilege access to production systems and multi-factor authentication for administrator accounts;
• vendor due diligence and written data-protection commitments with our service providers;
• audit logging of sign-ins, administrator actions, payment events, and Legacy Vault access events, retained for 90 days; and
• monitoring, alerting, and a written Incident Response Plan that assigns roles, defines severity levels, and specifies containment, investigation, remediation, and notification steps.

You may request the access log for your own Account by emailing security@mymortgagevault.com; we will provide the prior 90 days of logs within 30 days of the request.

No method of transmission or storage is completely secure. You are responsible for keeping your credentials safe and for the security of the devices you use to access the Services.

9. California residents (additional disclosures)

The categories of personal information we collect are described in Section 1. The purposes of collection and use are in Section 2. The categories of sources are described throughout Sections 1 and 4. We do not sell personal information and do not share it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA). California residents have the right to know, delete, correct, and limit the use of sensitive personal information; to opt out of any future sale or sharing; and to be free from retaliation for exercising these rights. To exercise these rights, email privacy@mymortgagevault.com.

10. Data location

We store personal information on servers located in the United States. Our service providers may process data in the United States and, where noted in the Subprocessor List, in other locations that meet our security requirements.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with an updated Effective Date and, where appropriate, announced by email or in-product notice.

12. Contact us

Mortgage Vault Corp. · Attn: Privacy · 2810 N. Church St., Unit 558336, Wilmington, DE 19802
Email: privacy@mymortgagevault.com