Privacy
Statement.

1. Encryption and Your Vault Key

Your backup data is encrypted on your own device using AES-256 before it is transmitted to your vault. What is written to storage is ciphertext — your file names, folder structures and file contents are not readable from the stored data.

The key used for that encryption is your Vault Key. It is held within your EndLock Vault account and is available to you from your client portal, so that access to your backups is never lost if you forget it. You may change your Vault Key at any time without affecting your existing backups.

Because your Vault Key is recoverable through your account, the security of your account — and of the email address used for password resets — is what protects your backups. We strongly recommend enabling two-factor authentication on both.

2. Information We Collect

We collect only the minimum information necessary to provide, operate and bill for our services:

• Account Data: Your name, email address and billing information collected at signup.
• Payment Data: Processed by our payment provider. We do not hold full card numbers — only a token reference, the card type, the last four digits and the expiry date.
• Vault Credentials: Your vault username and Vault Key, held so that your access can be restored if you forget them.
• Technical Logs: IP addresses and device identifiers used for security monitoring, fraud prevention and troubleshooting.
• Usage Metadata: Backup timestamps, device names and storage volume, used for billing and to display your usage in your portal.
• Support Communications: Any information you provide when contacting our support team.

We do not access, process or analyse the content of your backups. We do not index your files, scan them, or use them for any purpose.

3. Data Residency

You choose where your backup data is stored at signup. We operate vault regions in the following locations:

• AU · Sydney — Australia
• CA · Toronto — Canada
• EU · Frankfurt — Germany
• EU · London — United Kingdom
• EU · Paris — France
• JP · Osaka — Japan
• JP · Tokyo — Japan
• SG · Singapore — Singapore
• US · Oregon — United States (West)
• US · Virginia — United States (East)

Once you select a region, your backup data remains in that region. It is not replicated, moved or processed elsewhere.

Your account data — name, email, billing records and vault credentials — is held separately from your backup data. This is distinct from the region you select for your backups.

4. How We Use Your Information

We use the information we collect for the following purposes only:

• To provision and operate your vault
• To process payments and send invoices
• To provide technical support when requested
• To send essential service communications (billing, security alerts, service updates)
• To detect and prevent fraud and unauthorised access
• To comply with applicable legal obligations

We do not use your information for advertising, profiling or any purpose beyond operating the service you have subscribed to. We do not sell, rent or share your personal data with third parties for commercial purposes.

5. Third Party Processors

We engage a limited number of third-party processors to operate the service. Each is bound by data processing terms and handles only the data necessary for its function:

• Payment processing: Our payment provider handles card transactions under PCI-DSS. Your card details are held by them, not by us.
• Object storage: Your encrypted backup data is stored on object storage infrastructure in the region you select, with write-once object lock applied. The provider holds encrypted data only.
• Email delivery: Transactional email including invoices, password resets and service notices.

6. Lawful Requests

We may be required to disclose information in response to a valid and binding legal order. Where we receive such a request, we will disclose only what we are legally obliged to provide, and where we are permitted to do so, we will notify you before responding.

7. Cookies

Our website uses a minimal set of cookies necessary for the site to function correctly:

• Session cookies: Required to maintain your login session in the client portal.
• Preference cookies: Used to remember your region and currency selection.

We do not use advertising cookies, tracking pixels or third-party analytics that identify you personally. You can disable non-essential cookies in your browser settings without affecting core site functionality.

8. Data Retention

Backups are written with a 30-day object lock. Within that window, data cannot be deleted early — by you, by us, or by anyone else. This is the mechanism that protects your backups from ransomware, and it applies equally to deletion you request.

Account data is retained for the duration of your subscription and for the period required to meet financial and tax obligations after closure. When that period expires, it is permanently deleted from our systems.

9. Your Rights

Regardless of your location, EndLock Vault extends the following rights to all users:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Correct inaccurate personal data held on your account.
• Right to erasure: Request deletion of your account and associated personal data, subject to the object lock period described above and to legal retention obligations.
• Right to portability: Request your personal data in a machine-readable format. Your backup data can be restored by you at any time through the agent or web portal.
• Right to object: Object to processing of your personal data in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Security

The security of your data is the foundation of everything we do. Measures we take include:

• Backup data is encrypted on your device with AES-256 before transmission
• All data in transit is protected using TLS
• Backups are written with write-once object lock, so stored data cannot be altered or deleted within its retention period
• Two-factor authentication is available on your account and we recommend enabling it
• Access to account data by our staff is limited to what is strictly necessary for support operations

11. Changes to This Policy

We may update this privacy statement from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email and update the “Last Updated” date at the top of this page. Continued use of the service after notification constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions, data subject requests or concerns, contact us directly:

Email: [email protected]
Entity: EndLock LLC, trading as EndLock Vault
Registered office: Sheridan, Wyoming 82801, United States