VaultX.hair

Legal

Privacy Policy

This policy explains what personal data VaultX.hair processes, why we use it, who may receive it, and the choices available to you.

Last updated: 2 August 2026

1. Scope and controller

This policy applies to the VaultX.hair website, accounts, newsletters, recommendations, story submissions, and related services that link to it. It does not govern third-party websites or services that publish their own privacy notices.

[Legal entity name and registered address] will act as the data controller or data fiduciary for the processing described here. Privacy and grievance requests may be sent to privacy@vaultx.hair once that mailbox is operational.

2. Information we collect

Information you provide

  • Account details such as name, email address, password credential, and authentication provider.
  • Hair preferences, saved stories, feedback, newsletter choices, and recommendation settings.
  • Information included in story enquiries, contributor submissions, support messages, correction requests, or rights requests.
  • Billing and subscription references if paid services are introduced. Full card or UPI credentials should be handled by the payment provider, not stored by VaultX.

Information collected automatically

  • Session identifiers, device and browser information, IP address, security events, and timestamps.
  • Interactions with stories and recommendations, such as views, saves, completion, and selected haircut interests.
  • Cookie or local-storage choices described in our Cookie Policy.

3. How and why we use information

PurposeBasis, where applicable
Create accounts, authenticate users, and provide requested featuresContract or steps requested before a contract
Personalise stories and AI-assisted recommendationsConsent, contract, or legitimate interests, depending on the feature and location
Send newsletters and product updatesConsent or another lawful marketing basis
Prevent abuse, protect accounts, and maintain reliabilityLegitimate interests and legal obligations
Respond to support, privacy, correction, and takedown requestsContract, legitimate interests, and legal obligations

Where consent is the basis, you may withdraw it as easily as you gave it. Withdrawal does not affect processing already carried out lawfully.

4. Sharing and processors

We may share information with service providers that support hosting, databases, authentication, email delivery, analytics, customer support, security, AI features, media delivery, and payments. Providers may use the information only for the contracted service and subject to appropriate safeguards.

If you choose Google or Microsoft sign-in, that provider processes the authentication request under its own terms and privacy notice. We may also disclose information when required by law, to protect rights and safety, during a corporate transaction, or with your direction or consent. We do not sell personal data or share it with advertising data brokers.

5. International transfers

Some providers may process information outside your country. Where required, we will use recognised transfer mechanisms, contractual protections, and provider assessments. We will also comply with any transfer restrictions notified under Indian law.

6. Retention

We retain personal data only for as long as needed for the purposes described above, including account operation, security, dispute resolution, accounting, and legal compliance. Authentication sessions are currently configured to expire after 14 days and may refresh during active use.

Before launch, VaultX will publish or internally approve specific periods for inactive accounts, story activity, support requests, contributor releases, marketing records, security logs, payment records, and backups. Data will then be deleted, anonymised, or securely isolated unless a longer period is legally required.

7. Your rights

Depending on where you live, you may have rights to access or obtain a summary of your data, correct or complete it, request erasure, withdraw consent, object to or restrict processing, receive portable data, and lodge a complaint with a regulator.

Under India’s Digital Personal Data Protection framework, eligible individuals may also use the applicable grievance process and nomination rights. EEA and UK residents may have the additional rights provided by the GDPR or UK GDPR, including review of certain automated decisions with legal or similarly significant effects.

Send requests to privacy@vaultx.hair. We may verify your identity and will not ask you to send a password or full payment credential.

8. Marketing and recommendations

You can unsubscribe from promotional email using the link in each message or by changing account preferences when available. Service messages needed for account security or requested transactions are not promotional.

AI-assisted recommendations are intended to help you discover stories and haircut ideas. VaultX will explain material recommendation inputs and provide practical preference controls as these features launch. They are not professional medical advice and should not be used as the sole basis for a significant decision.

9. Children

The service is not directed to children and does not knowingly collect children’s personal data without the consent or other authorisation required by applicable law. The final minimum account age and parental-consent process must be approved before public registration opens.

10. Security

We use administrative, technical, and organisational safeguards designed to protect personal data. No online service can guarantee absolute security. See our Security page for current controls and the responsible-reporting route.

11. Changes and contact

We may update this policy when the service, providers, or law changes. Material changes will be dated and, where appropriate, highlighted or sent to account holders.

Questions, grievances, and rights requests: privacy@vaultx.hair
Postal address: [Registered address]
Grievance or data-protection contact: [Name or role]