Privacy Policy

Effective October 10, 2026. DataVault is an unregistered founder project operated by Gonzalo Javier Corral Marchan. Privacy requests can be sent to gonzalojcorralm@gmail.com. This policy describes the current services and does not certify blanket GDPR or CCPA compliance.

Information we process

We process account email and profile information, business descriptions, submitted verification documents, dataset titles and descriptions, uploaded business records during cleaning, encrypted dataset files and associated keys, bids, payment identifiers, transaction records, support messages, security logs and processing-limit counters. Stripe collects card, identity and bank information through its own interfaces; full card numbers and bank credentials are not stored in DataVault.

Suitability and buyer inquiries

The suitability and buyer-brief pages prepare drafts locally in your browser. They do not submit lead details to a DataVault form endpoint or retain answers in browser storage. If you send an email, your email provider processes it and DataVault receives your business contact and general requirements to respond to the inquiry. Do not include raw records or sensitive information. Inquiry messages are reviewed manually; request correction or deletion through the contact address. Sending an inquiry does not subscribe you to marketing email or establish dataset rights, suitability, availability or a purchase.

Purpose and legal basis

We use necessary information to create and authenticate accounts, process datasets, review seller businesses, run auctions, deliver licensed files, process payments and refunds, prevent abuse, answer support requests and meet legal obligations. Where applicable, processing relies on performing the service contract, legal obligations, legitimate interests in security and service operations, or consent for optional processing. We do not sell account contact details or use them for a marketing mailing list.

What happens to an upload

The browser sends plaintext data over HTTPS to the processing function. Common identifiers are initially redacted; the normalized accepted table is sent to Google Gemini for review and description generation. Further flagged columns are redacted. The browser encrypts the resulting CSV using AES-256-GCM before storage. DataVault verifies the processed result and retains the key for controlled buyer delivery. This is not zero-knowledge encryption: the service processes plaintext and can access stored keys. Automatic review is imperfect. Never upload prohibited personal or sensitive information; review the entire cleaned result and description before listing it.

Service providers and transfers

Netlify provides hosting, authentication, functions and encrypted-file object storage. Netlify Database, backed by Neon, stores authoritative financial and verification state. Google Gemini processes dataset content through a billing-enabled project; Google’s paid-service data terms apply. Stripe processes payments, seller verification, transfers and payouts. Google Fonts and the Netlify Identity and Stripe browser libraries receive network requests needed to provide the interface. These providers may process information outside your country under their applicable terms and safeguards. Supabase is not the database provider for this deployment.

What other users see

Approved public listings show the seller’s business name and industry, dataset description, schema, category, general location, record count and auction information. Raw preview records, verification documents, secret reserve prices and decryption keys are not public. The winning buyer receives the licensed processed dataset after capture. Authorized owner reviewers may see business documents; the operator may inspect transaction and dispute records. Never put personal information into public listing fields.

Retention and security

Dataset files and transaction records are retained while needed for the service, purchased licenses, disputes and legal recordkeeping. Verification records and decision history support ongoing review and fraud prevention. Processing-limit counters become eligible for removal after two days and are cleared by scheduled maintenance. Contact us to request deletion of unused uploads or your account; records required by law, unresolved disputes, security investigations or existing purchase rights may need to be retained. Requests are reviewed manually; submitting a request does not immediately erase files or transaction records. Access controls, signed download links, encrypted storage and authenticated requests reduce risk, but no system guarantees perfect security.

Your choices and requests

You can request access, correction, deletion, an account-information export or restriction of processing by emailing gonzalojcorralm@gmail.com. We will verify your identity before releasing private information or deleting an account. Requests are handled manually under the rights and deadlines applicable to your location; deletion is subject to lawful exceptions. If applicable, you may object to legitimate-interest processing, withdraw optional consent prospectively, or complain to your local data-protection authority. The site does not currently offer an automatic account-deletion interface.

AI and human decisions

AI assists with dataset structure, potential identifier detection and descriptions; it does not establish legal permission or guarantee privacy. Business verification is a human owner decision. Financial settlement follows funded bids and the published auction rules. You may request human review of a processing, verification or transaction problem through support.

Children and updates

DataVault is intended for adults acting for a business or professional research purpose. Do not upload information about children. Material policy updates will be dated on this page.