Privacy Policy & GDPR

1. Overview

MyOwnVault is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and the Icelandic Data Protection Act. This policy explains how we collect, use, and safeguard your personal data.

2. Data We Collect

• Account data: name, email address, and authentication credentials.
• Vault content: documents, knowledge items, people, and assets you choose to store.
• Usage data: interaction logs, feature usage, and device information for service improvement.
• Beneficiary & approver data: contact information for individuals you designate, used solely for release notifications.

3. Legal Basis for Processing

We process your personal data based on: (a) your consent, (b) the performance of a contract (providing the Service), and (c) our legitimate interests in operating and securing the Service.

4. How We Use Your Data

• To provide and maintain your vaults and continuity features.
• To notify designated approvers and beneficiaries when release conditions are triggered.
• To secure, back up, and recover your data.
• To improve the Service and develop new features.

5. Data Encryption & Security

Your data is encrypted in transit and at rest. Access to your vault content is restricted to you and, upon release, to your designated beneficiaries. We do not scan, analyze, or process your vault content automatically. AI features are strictly opt-in and operate only on individual items you explicitly select.

6. Your GDPR Rights

Under the GDPR, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: withdraw consent for processing at any time.

To exercise these rights, contact us through your account settings or our support channels.

7. Data Retention

Your data is retained for as long as your account is active. Upon account closure, your data is permanently deleted within 30 days. Beneficiary and approver contact data is retained only for the purpose of release notifications and is deleted when the associated vault is deleted.

8. Data Sharing

We do not sell your personal data. We share data only with: (a) your designated beneficiaries and approvers as configured by you, (b) service providers who help us operate the Service (under strict data processing agreements), and (c) authorities where required by law.

9. International Transfers

Your data may be processed in countries outside the European Economic Area. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data in accordance with GDPR requirements.

10. Contact

For privacy inquiries or to exercise your GDPR rights, contact MyOwnVault through your account or our official support channels.