How we handle your data.

01Overview

Vaultrix Tech Solutions Private Limited ("Vaultrix", "we", "us") operates Vaultrix Diligence, an AI diligence analyst for data rooms used in M&A, private equity, investment banking, credit, and corporate development work.

This policy explains what personal data we collect, how we use it, and the choices you have. We aim to handle personal data in line with India's Digital Personal Data Protection Act 2023 (DPDPA).

02What we collect

Account data

• Name, email address, and the organisation you sign up under.
• If you sign in with a password, a salted hash of it, never the password itself.
• If you use "Continue with Google," your Google account identifier and the email Google confirms is verified for it. We don't require or store a password for accounts created this way.

Deal and document data

• The documents you upload to a deal room, and the text extracted from them for search and analysis.
• The diligence questions you ask the AI Analyst, and the answers and citations it returns.
• Requisition list items you import, their review status, and reviewer decisions.

Activity data

• Who did what and when within a deal: uploads, questions asked, document views, and review decisions.

What we don't collect

• Payment card or bank details. Paid plans aren't self-serve checkout yet; Enterprise plans are arranged directly by email.
• Browsing activity outside this site, or any data unrelated to your account and your deals.

03How we use it

• Providing the service: authenticating your account, retrieving the right evidence for a question, and returning a cited answer.
• Audit trail: keeping a dated activity history for accountability on every deal.
• Access control: enforcing which deals you can see and which of your requests are honoured.
• Plan limits: tracking usage against your plan's question and storage allowance.
• Support and sales: responding to questions you send us, including through the Enterprise contact form.
• Abuse prevention: rate-limiting sign-up, sign-in, and contact-form submissions to deter automated abuse.

04What we don't do

We do not sell or rent personal data. We do not use your deal documents or questions to train our own models.

Answering a question calls Anthropic's API, and optionally OpenAI's for a limited rewrite pass. Under their standard API terms, neither trains on your inputs or outputs by default. We haven't signed a separate zero-retention addendum with either provider yet. If that's a hard requirement for your deal, contact us before uploading anything sensitive.

05Data storage and security

Vaultrix runs on Microsoft Azure. Application data (accounts, deals, document metadata, activity logs) lives in a dedicated Azure Postgres database. Uploaded files are stored on Azure Blob Storage in our production deployment.

Document indexing and embedding happen on our own infrastructure, not a third-party embeddings API. Only the specific evidence needed to answer a question, never a whole document or the whole data room, is sent to an AI provider.

Data is encrypted at rest and in transit using standard cloud-provider encryption. We don't yet issue dedicated per-deal encryption keys.

Every deal is a separate access boundary enforced server-side: a user needs an explicit membership on a deal to query it, upload to it, or view its documents. Org membership alone grants nothing.

06Your rights under DPDPA 2023

Under India's Digital Personal Data Protection Act 2023, you have the following rights:

• Right to access: request a copy of the personal data we hold about you.
• Right to correction: request correction of inaccurate personal data.
• Right to erasure: request deletion of your personal data, subject to any legal retention obligations.
• Right to grievance redress: raise a complaint with us if you believe your data was mishandled.
• Right to nominate: nominate another person to exercise your rights in the event of death or incapacity.

To exercise any of these rights, contact admin@vaultrix.ai. We aim to respond within 30 days.

07Retention

We retain personal data for as long as your account and organisation are active. Activity-log entries are kept as long-lived audit records for dispute resolution.

Deleting a deal removes its files from storage and its rows from the database, permanently. This is a real deletion, not a soft delete, and it can't be undone, so there's no separate deletion certificate beyond the deletion itself.

You can request deletion of your account, or a copy of the data we hold, at any time by emailing admin@vaultrix.ai.

08Cookies

Vaultrix sets one essential cookie, vaultrix_session, to keep you signed in. It's httpOnly, so page scripts can't read it. Signing in with Google briefly sets a second, short-lived cookie to protect that sign-in flow; it's deleted immediately afterward.

This site does not load advertising trackers or third-party marketing analytics.

09Third-party services

• Anthropic (Claude): powers the AI Analyst's core reasoning and citation checking.
• OpenAI: an optional step that rewrites an already-cited draft into clearer prose. It never introduces a new fact or citation, that's verified before the rewrite is trusted.
• Google: only if you choose "Continue with Google" to sign in. We receive your name, email, and Google account ID, nothing else.
• Resend: delivers transactional email, such as replies to Enterprise inquiries submitted through this site.
• Microsoft Azure: hosts our application, database, and file storage.

10Contact

For privacy questions, data requests, or complaints:

• Email: admin@vaultrix.ai
• Company: Vaultrix Tech Solutions Private Limited
• Address: Pune, Maharashtra, India
• Response time: within 30 days of receipt

If you're not satisfied with our response, you may raise a complaint with the Data Protection Board of India once it is constituted under the DPDPA 2023.