Privacy Policy

Last updated: 20 July 2026. Effective from: 20 July 2026.

1. Who controls your data

VaultPouch Ltd (Company No. 17300631) is the data controller for all personal data processed through the VaultPouch platform. Contact: hello@vaultpouch.com.

2. What data we collect

We collect the following categories of personal data:

Account data: your name, email address, password (stored as a secure hash, never in plaintext), and phone number.

Identity data: your date of birth, nationality, and the results of your identity verification check (verification status and document type). We do not store images of your identity documents. We store a cryptographic hash (one-way fingerprint) of your identity details for fraud prevention purposes.

Right to Rent data: your Right to Rent status, the type of document used (passport, BRP, or share code), and the date the check was performed.

Usage data: your IP address, browser type, pages visited, and actions taken within the platform, collected via server logs and analytics.

Payment data: Founder Pass purchase records. Card details are processed and stored by Stripe. VaultPouch does not store full card numbers.

Communications: emails and other communications you send to us.

3. How we use your data

We process your data for the following purposes:

To provide the VaultPouch service and manage your account. Legal basis: performance of a contract with you (UK GDPR Article 6(1)(b)).

To verify your identity and Right to Rent status as required for account creation. Legal basis: performance of a contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)).

To detect and prevent fraud and money laundering, including the use of cryptographic identity hashing to identify duplicate accounts. Legal basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is the prevention of fraud and the protection of other users.

To send you transactional emails such as OTP verification codes, onboarding confirmations, and payment receipts. Legal basis: performance of a contract (Article 6(1)(b)).

To send you product updates and news about VaultPouch, if you have opted in. Legal basis: consent (Article 6(1)(a)). You may withdraw consent at any time.

To comply with our legal and regulatory obligations. Legal basis: compliance with legal obligations (Article 6(1)(c)).

4. Who we share your data with

Persona (withpersona.com): identity verification and biometric processing. Persona acts as a data processor on our behalf.

Stripe (stripe.com): payment processing. Stripe is an independent data controller for payment card data.

Resend (resend.com): transactional email delivery.

Twilio (twilio.com): SMS delivery for verification codes.

We do not sell your personal data to third parties. We do not share your data with landlords or letting agents except where you have explicitly shared your Deposit Passport with them.

5. How long we keep your data

Account data: for as long as your account is active, and for up to 7 years after account closure for financial record-keeping purposes.

Identity verification results: for the duration of your account and up to 6 years after closure, to comply with anti-money laundering regulations.

Right to Rent records: for the duration of the tenancy and up to 12 months after the tenancy ends, as required by UK law.

Cryptographic identity hashes: retained indefinitely for fraud prevention. These hashes cannot be reversed to reveal your original identity details.

6. Your rights

Under UK GDPR, you have the following rights:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate data.
• Right to erasure: request deletion of your data, subject to legal retention obligations.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: receive your data in a machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: withdraw any consent you have given at any time.

To exercise any of these rights, email hello@vaultpouch.com. We will respond within one calendar month.

7. Cookies

VaultPouch uses a single session cookie (vp_session) to keep you logged in. This cookie is httpOnly, Secure, and SameSite=Lax. It does not track you across other websites. We do not use advertising or third-party tracking cookies.

8. ICO registration

VaultPouch Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. The date at the top of this page shows when the policy was last updated.

10. Contact

For any privacy-related questions, contact our data controller at: hello@vaultpouch.com or VaultPouch Ltd, Flat 173, Uncle Apartments, 3 Park Lane, Wembley, England, HA9 7FN.