Privacy Policy

IOR Vault (“we”) provides IOR Vault at iorvault.com to businesses. This policy explains what personal data we process when you visit the site or use the service, and the choices you have.

What we collect

• Account details: your name, work email address and a salted hash of your password. We never store your password itself.
• Sign-in sessions: a session cookie, plus the IP address and browser user agent recorded when you sign in, so you can stay signed in and we can protect your account.
• Brokerage profile: the brokerage name and contact email your clients see, your team members and their roles, and the trial and subscription status.
• Client records and documents: the client details your team enters, and the answers and documents your clients upload through client links. These may include personal data about a client’s owners and officers. We process them only on your company’s instructions, to provide the service.
• Client-link access events: when a link is opened, what was uploaded or changed, with the visitor’s IP address stored only as a keyed hash.
• The access history of each client: who on your team viewed, downloaded, reviewed, exported or decided, and when.
• Our private email outbox: the recipient and contents of messages the service prepares, such as password reset links, team invitations, payment links and submission notices.
• Product events that tell us which steps people complete or where they get stuck. They contain no document content and no client names.
• Error reports from the server and your browser, so we can fix problems.

How we use it

We use this data to create and secure your account, provide the service, send messages you request, answer support requests and meet legal obligations. We do not sell personal data and do not use it for advertising. We use no advertising or analytics trackers.

Security

Each brokerage’s workspace is isolated from every other. Uploaded files are encrypted at rest. Client links are random, stored only as a keyed hash, cover one request, and can be revoked at any time.

Cookies

We use a strictly necessary cookie to keep you signed in. Client links use no cookies. We do not use advertising or cross-site tracking cookies.

Sharing

We share personal data only with service providers that host and operate the service for us, under contracts that limit their use of it, or when the law requires it. Your company’s workspace is visible only to its members.

Retention and deletion

We keep account and workspace data while your account is open. The service never deletes your records automatically. When an owner deletes a client or the workspace, its data is deleted at once. If you ask us to delete your data, we delete it within 60 days of your request, as section 5.5.b of the Standard Terms provides.

Your rights

You can ask to access, correct, export or delete your personal data, or object to how we use it, by emailing [email protected]. If you use the service through your employer, your employer controls the workspace data and we will help it respond to your request.

Contact

Questions about this policy go to [email protected]. If we change it materially, we will update this page before the change takes effect.