Privacy Policy

1. Introduction & Identity of Data Fiduciary

Vault ("Platform", "we", "us", "our") is operated as a digital platform accessible at https://paper-vault.app. For the purposes of the Digital Personal Data Protection Act, 2023, Vault acts as a Data Fiduciary in relation to the personal data collected from users of this Platform.

This Privacy Policy describes what data we collect, why we collect it, how we use and protect it, and what rights you have as a Data Principal under Indian law.

2. Data We Collect

2.1 Data You Provide Directly

• Email address and name (on account registration).
• Educational information (university, course, semester) - provided voluntarily.
• Files and documents you upload to the Platform (exam papers, study material).
• Communication you send us (support emails, reports).

2.2 Data Collected Automatically

• IP address, browser type, device type, and operating system.
• Pages visited, time spent, and navigation patterns.
• Referring URLs and search terms used to find our Platform.
• Cookies and similar tracking technologies (see Section 7).

2.3 Data We Do NOT Collect

We do not collect sensitive personal data such as financial account details, biometric data, health information, sexual orientation, or government-issued ID numbers. We do not knowingly collect data from persons under 13 years of age.

3. Purpose & Legal Basis for Processing

We process your personal data for the following purposes under the DPDP Act, 2023:

• Account creation and authentication - to provide you access to the Platform.
• Platform functionality - to enable browsing, uploading, saving, and accessing exam papers.
• Communication - to send you account-related notifications and respond to support requests.
• Safety and compliance - to investigate abuse, enforce our Terms of Service, and comply with legal obligations.
• Analytics and improvement - to understand how users interact with the Platform and improve features (processed in aggregate/anonymised form wherever possible).

The legal basis for processing is primarily your consent (obtained at registration) and our legitimate interest in operating a lawful, functional educational platform.

4. User-Generated Content - Critical Disclosure

IMPORTANT: All exam papers and documents on Vault are uploaded exclusively by users. Vault does not create, own, verify, or endorse any content uploaded by users. Vault operates as an intermediary platform under Section 79 of the Information Technology Act, 2000, and is not liable for user-uploaded content provided it acts on notice as required by law.

By uploading content to the Platform, you represent that:

• You have the right to share the content, or the content is in the public domain, or fair dealing under Section 52 of the Copyright Act, 1957 applies to the use.
• The content does not violate any applicable law or third-party rights.
• You grant Vault a non-exclusive, royalty-free licence to host, display, and make the content accessible to other registered users on the Platform.

Vault reserves the right to remove content at its sole discretion upon receiving a valid complaint or upon forming a reasonable belief that the content is unlawful.

5. Sharing of Personal Data

We do not sell, trade, or rent your personal data to third parties. We may share data in the following limited circumstances:

• Service Providers: Third-party vendors who help us operate the Platform (hosting providers, email delivery services, analytics tools) - bound by confidentiality and data processing agreements.
• Legal Compliance: Where required by law, court order, or government authority, including responses to valid legal process from Indian authorities.
• Safety: To protect the rights, safety, or property of Vault, our users, or the public.
• Business Transfer: In the event of a merger, acquisition, or sale of assets, user data may be transferred - users will be notified in advance.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy:

• Account data: Retained for the duration of your account and for 2 years following account deletion (for legal compliance purposes).
• Uploaded content: Retained until removed by admin or upon a valid takedown request.
• Usage logs: Retained for up to 90 days for security and debugging purposes.
• Legal holds: Retained for longer periods if required by ongoing legal proceedings.

7. Cookies

We use cookies and similar technologies to:

• Maintain your session and authentication state.
• Remember your preferences.
• Analyse Platform usage through privacy-respecting analytics tools.

You may disable cookies through your browser settings; however, this may affect Platform functionality. We do not use tracking cookies for advertising purposes at this time.

8. Data Security

We implement reasonable technical and organisational security measures as required under the SPDI Rules, 2011, including:

• HTTPS encryption for all data in transit.
• Access controls limiting who can access user data internally.
• Periodic review of security practices.

However, no method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in risk to users, we will notify affected Data Principals and the Data Protection Board of India as required under the DPDP Act, 2023.

9. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access: Request a summary of your personal data processed by Vault. Email: legal@paper-vault.app
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to Nominate: Nominate an individual to exercise these rights on your behalf in the event of your death or incapacity.
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer (see Section 11) or the Data Protection Board of India.

We will respond to verifiable requests within a reasonable time, not exceeding 30 days.

10. Cross-Border Data Transfers

Our servers and service providers may be located outside India. Any transfer of personal data outside India is conducted in compliance with the DPDP Act, 2023, and applicable rules notified by the Central Government. By using the Platform, you consent to such transfers subject to appropriate safeguards.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the details of our Grievance Officer are:

• Name: Grievance Officer, Vault
• Email: legal@paper-vault.app
• Response Time: Complaints will be acknowledged within 48 hours and resolved within 30 days.

12. Children's Privacy

The Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us personal data, we will promptly delete it. Parents or guardians who believe their child has submitted data should contact us at legal@paper-vault.app.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top and, where changes are material, notify registered users via email or an in-app notice. Continued use of the Platform after such notice constitutes acceptance of the updated Policy.

14. Contact Us

For any questions about this Privacy Policy, contact us at:

support@paper-vault.app

Vault Platform | https://paper-vault.app