Vaultiqo logoVaultiqo

Privacy Policy

Last updated: October 7, 2026

1. Introduction

Welcome to Vaultiqo ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our team password manager service integrated with Google Workspace™. The data controller is Ing. Jiří Psota, Company ID (IČO) 76072266, registered at Zborovská 1200/6, 150 00 Praha 5 - Smíchov, Czech Republic.

By using Vaultiqo, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

2. Information We Collect

We collect several types of information to provide and improve our service:

2.1 Information You Provide

  • Account Information: When you sign in through Google Workspace™ SSO, we receive your name, email address, and profile picture from your Google account.
  • Vault Data: Passwords, credentials, API keys, notes and other sensitive information you choose to store in Vaultiqo. Secret fields are encrypted in your browser before they leave your device and are encrypted again on our servers.
  • Group and Team Information: Information about groups, teams, and access permissions you configure within the application.

2.2 Automatically Collected Information

  • Usage Data: Information about how you interact with our service, including features used, actions performed, and time spent.
  • Audit Logs: Records of who accessed or modified credentials, timestamps, and actions performed for security and compliance purposes.
  • Device Information: Browser type, operating system, IP address, and device identifiers.
  • Cookies and Similar Technologies: We use cookies and similar tracking technologies to maintain your session and improve user experience.

3. How We Use Your Information

We use the collected information for the following purposes:

  • To provide, maintain, and improve our password management service
  • To authenticate users through Google Workspace™ SSO
  • To enable team collaboration and access control features
  • To maintain audit logs for security and compliance
  • To detect, prevent, and address technical issues and security threats
  • To communicate with you about service updates, security alerts, and support
  • To comply with legal obligations and enforce our terms of service
  • To analyze usage patterns and improve our service

4. Legal Bases for Processing

We only process personal data when we have a legal basis under Article 6 of the GDPR:

  • Performance of a contract: providing the service, Google sign-in, and managing your account, vault and subscription (Art. 6(1)(b)).
  • Legitimate interests: securing the service, the audit log, preventing abuse, handling incidents and improving the service (Art. 6(1)(f)).
  • Legal obligation: keeping accounting and tax records (Art. 6(1)(c)).
  • Consent: non-essential communications, which you can withdraw at any time (Art. 6(1)(a)).

For the content and data your organization puts into Vaultiqo (vault items, users and groups imported from Google Workspace, the audit log), your organization is the controller and we act as a processor under Article 28 of the GDPR. This processing is governed by the Data Processing Addendum, which is part of the Terms and applies automatically. We are the controller only for customer account data, billing, communication with customers, and operational and security logs. The list of sub-processors is on the Sub-processors page.

5. Data Security and Encryption

Security is our top priority. We implement industry-standard security measures to protect your data:

  • Client-Side Encryption: Sensitive data (passwords, notes and other secret fields) is encrypted in your browser with AES-256-GCM using your organization's own key before it leaves your device. On our servers it is wrapped in a second, server-side layer of encryption.
  • Managed Keys: Encryption keys are managed by Vaultiqo and protected by a master key held in Google Secret Manager, with strictly restricted access. Because keys are managed, the team vault is not zero-knowledge: the service can technically decrypt vault data, which is what allows your administrators to restore access. Public share links are zero-knowledge: the decryption key stays in the link and is never sent to our servers.
  • Secure Storage: Data is stored with enterprise-grade security in the Vaultiqo hosted database on Google Cloud (default) or, depending on your configuration and plan, in your own Google Firestore™ project or Google Drive™ (Shared Drive). With your own storage, encrypted secrets and attachments are stored there, while metadata and keys remain with Vaultiqo. Item names, usernames, URLs, audit logs and group membership are stored as unencrypted metadata.
  • Transport Security: All data transmission uses TLS/SSL encryption.
  • Access Controls: Strict access controls and authentication mechanisms protect your account.

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

  • With Your Team: Information you choose to share within groups and vaults is accessible to authorized team members.
  • Service Providers: We use Google Cloud Platform™ to host and operate our service and Stripe to process payments and billing. These providers are bound by strict confidentiality and data protection obligations. To check passwords against known data breaches, your browser queries Have I Been Pwned using k-anonymity: only the first 5 characters of a password hash are sent, never the password itself.
  • Legal Requirements: We may disclose information if required by law, court order, or governmental request, or to protect our rights and safety.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. You may request deletion of your account and associated data at any time. Upon deletion request, we will remove your data within 30 days, except where retention is required by law or for legitimate business purposes (such as audit logs for compliance). We keep accounting and tax records for the period required by law, up to 10 years.

8. Your Rights and Choices

You have the following rights regarding your personal information:

  • Access: You can access and review your personal information within the application.
  • Correction: You can update or correct your information at any time.
  • Deletion: You can request deletion of your account and data.
  • Export: Administrators can export group items to CSV at any time.
  • Opt-Out: You can opt out of non-essential communications.
  • Restriction: You can ask us to temporarily restrict the processing of your data.
  • Objection: You can object at any time to processing based on legitimate interests.
  • Portability: You can receive the data you provided to us in a structured, machine-readable format.
  • Withdrawing consent: You can withdraw consent at any time, without affecting the lawfulness of earlier processing.

To exercise these rights, please contact us at the email address provided below. We respond without undue delay, within one month at the latest, free of charge. We do not carry out automated decision-making or profiling.

You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or the authority in the EU country where you live or work.

9. Google Workspace™ Integration

Vaultiqo integrates with Google Workspace™ and uses Google's authentication services. When you use our service, you also agree to Google's Privacy Policy and Terms of Service. We only request the minimum necessary permissions to provide our service.

10. Browser Extension

The Vaultiqo browser extension is another way to use the same vault. It reuses your existing Vaultiqo session, fetches your items from the Vaultiqo backend, and decrypts a secret only when you reveal, copy or fill it. It fills a login field only when you explicitly choose to. It stores no secrets or tokens on your device, adds no analytics or third-party requests, and sends data only to your Vaultiqo backend.

11. International Data Transfers

We store service data in Google Cloud data centers in the European Union (region europe-west1, Belgium). If you choose your own Google Drive or Firestore, the encrypted data is stored in the location your organization decides. Where a processor (such as Google LLC or Stripe, Inc.) transfers data outside the European Economic Area, it does so on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

12. Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us, and we will take steps to delete such information.

13. Cookies and Local Storage

This website does not use analytics or advertising cookies. It only stores your chosen language in your browser’s local storage. The Vaultiqo app uses only strictly necessary cookies for sign-in and session security, which do not require consent.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Significant changes will be communicated via email or prominent notice within the application.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: hello@vaultiqo.app
Website: www.vaultiqo.app
Operator: Ing. Jiří Psota, Company ID (IČO) 76072266, Zborovská 1200/6, 150 00 Praha 5 - Smíchov, Czech Republic

We have not appointed a Data Protection Officer, as we are not required to under Article 37 of the GDPR. Please send any data protection questions to hello@vaultiqo.app.