Privacy Policy

1. Who We Are

GemVault is operated by GemVault, established in Belgium, registered under enterprise number 1040.498.016. The operator is the data controller for the personal data described below.

Contact: info@gemvault.me

As the operator, we act as the data controller within the meaning of the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679).

2. Data We Collect

• Account data: your email address and password.
• Profile data: display name (optional).
• Collection data: gem and parcel details, photos, and certificates you upload.
• Technical data: server logs, including your IP address and the time of each request. Retained for a maximum of 90 days.

We do not collect payment card numbers directly. Payment data is handled by our payment processor (see Section 5).

3. Legal Basis for Processing (GDPR Art. 6)

• Account management and service delivery - Contract performance (Art. 6(1)(b)): processing is necessary to provide the GemVault service you requested.
• Security and fraud prevention - Legitimate interests (Art. 6(1)(f)): we process technical data to protect the service and its users.
• Billing records - Legal obligation (Art. 6(1)(c)): Belgian accounting law requires retention of financial records for 7 years.

We do not use your data for marketing, profiling, or advertising.

4. How We Use Your Data

• To provide and operate the GemVault service.
• To sign you in and keep your account secure.
• To store and display your gem collection.
• To process payments, if you are on a paid plan.

5. Data Sharing and Third-Party Processors (GDPR Art. 28)

We do not sell or share your personal data with third parties for their own purposes.

We use the following sub-processors, with whom we have signed (or are in the process of signing) Data Processing Agreements:

• Our VPS host - Hostinger International Ltd, servers located in France (EU). Processes all application data on our behalf. See their Data Processing Addendum.
• Stripe (stripe.com) - payment processor. Handles subscription payment data for paid plans. Stripe acts as an independent data controller for payment data. See Stripe's Privacy Policy.
• Resend (resend.com) - transactional email. Used to send account emails (verification, password reset, billing notifications). See Resend's Privacy Policy.
• Plausible Analytics (plausible.io) - cookieless, privacy-first web analytics hosted in the EU. Does not collect personal data or use cookies. See Plausible's Privacy Policy.

We do not use advertising networks or cross-site tracking pixels.

6. Cookies

We use strictly necessary cookies only: they keep you signed in and remember your interface preferences. Nothing more is stored on your device.

Our analytics are cookieless and EU-hosted, and report aggregate page views rather than individual visitors. Because nothing is stored on your device and no personal data is processed, no consent banner is required.

We set no advertising cookies and do no cross-site tracking. Every cookie we use is listed individually in our Cookie Policy.

7. Public Scan Pages

If you enable a public share link for a gem, certain gem details become accessible to anyone with that link, without authentication. You control what is public. You can disable public access at any time by removing the public token from the gem in your account settings.

Public scan pages do not collect visitor personal data beyond standard server logs (see Section 2).

8. Data Retention

• Account data: on deletion your account is deactivated immediately. Your personal data (account details, collection data, photos, and certificates) is permanently erased by an automated purge within 30 days of the deletion request.
• Payment records: retained for 7 years after the last transaction, as required by Belgian accounting law. This retention obligation overrides your right to erasure for billing records only.
• Server logs: maximum 90 days.
• Sign-in sessions: expire after 30 days, after which you are signed out and the session record is deleted.

9. Your Rights (GDPR Art. 15-22)

You have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): ask us to correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): request deletion of your account and all associated personal data.
• Right to restriction of processing (Art. 18): ask us to pause processing of your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent: where we rely on consent (currently none), you may withdraw at any time without affecting the lawfulness of prior processing.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with the Belgian Data Protection Authority (GBA / APD):

• Website: www.gegevensbeschermingsautoriteit.be
• Address: Rue de la Presse 35, 1000 Brussels, Belgium
• Phone: +32 2 274 48 00
• Email: contact@apd-gba.be

You may also lodge a complaint with the supervisory authority in your EU country of residence.

11. Data Security

We maintain technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. Your data is encrypted in transit, passwords are never stored in a readable form, and your collection - including photos and certificates - is private to your account and is not served to anyone without your permission.

No system is perfectly secure. If a breach ever affects your personal data, we will notify the Belgian Data Protection Authority within 72 hours and inform you directly where the law requires it.

12. Children's Privacy

GemVault is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you are under 13, please do not create an account. If we become aware that a child under 13 has provided personal data, we will delete it promptly. Contact us at info@gemvault.me if you believe this has occurred.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before the change takes effect. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the service after the effective date constitutes acceptance of the updated policy.

14. Contact

For any privacy-related questions or requests, contact us at: info@gemvault.me