Privacy Policy

This notice explains how Vault Africa handles information through its website and account interface. The entity responsible for a contracted financial service is identified in that service’s agreement and privacy notice. Contact vault.africa@vault.africa for privacy questions or to identify the responsible entity for your account.

We process account and contact details to provide sign-in, maintain your profile, respond to enquiries and support your account. Your chosen display name and card finish personalise your experience; they do not establish your legal identity or an issued financial product.

Identity verification through DIDIT may require identity documents, an image or liveness check and verification results. The verification journey provides information about its collection and processing. Corporate or financial-service onboarding may require additional information under a separate provider notice.

Technical information such as request logs, device and connection information may be used to operate the service, investigate errors and protect accounts. A wallet connection displays the public address and network shared by your wallet; it does not expose your private keys. Any additional wallet-data use is explained by the relevant service.

Depending on the processing and applicable law, information is used to perform an agreement or take requested steps before it, meet legal obligations, pursue proportionate operational and security interests, or act on consent where required. Browsing the website is not blanket consent to unrelated processing.

Where identity verification involves biometric processing or other sensitive information, the collection notice explains the applicable basis, safeguards and any consent requirement. We do not ask you to email identity documents, passwords or recovery phrases.

Technology providers support hosting, authentication, storage and communications. Supabase supports account infrastructure, Vercel supports hosting, and DIDIT supports the identity-verification journey. Access is limited to the work required for their role.

A financial-service provider may act as an independent controller for its own regulatory duties. Its notice explains those responsibilities before activation. Information may also be shared with professional advisers or competent authorities where necessary and lawful. We do not sell personal information.

Information is retained for the purpose for which it was collected, relevant contractual obligations and applicable legal or regulatory requirements. Identity, financial and security records may need to be retained after account closure. We review deletion requests against those obligations.

Providers may process information outside your country. Where required, appropriate transfer safeguards apply. Contact us for information about the processing and safeguards relevant to your account. Public blockchain records are outside our ability to erase; avoid placing personal information on-chain.

Access controls, authenticated sessions and restricted profile permissions help protect account information. No online service can guarantee absolute security. Use a strong, unique password, secure your email and wallet, and report suspected unauthorised access promptly.

Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to certain processing, or withdraw consent without affecting earlier lawful processing. We may need to verify your identity before responding. You can also complain to the relevant data-protection authority.

Our cookie notice explains browser storage and preferences. Third-party wallet and verification applications have their own notices. We publish a revision date when this notice changes and provide additional notices where a new service requires them.