Privacy Policy

1. Who we are

Vaulty is a cloud based finance tracking service developed and operated by Muhammad Afatyo Ikhsan, an individual in Indonesia. He acts as the personal data controller for the data described here.

2. Data we collect

• Account data: email address, name, and a password hash (we cannot read your password).
• Financial data you enter: income, expenses, categories, budgets, bills, savings, debts, goals, and attached files such as receipt photos.
• Organization data: organization name, member list, and their roles.
• Subscription and payment data: plan, status, period, order number, and transaction status and amount from Midtrans. We do not store card numbers.
• Technical data for security: login sessions, IP address and email used to limit repeated login attempts (stored as a hash), and access records.
• Preferences: language, theme, display currency, and notification settings.

3. What we use it for

We do not sell your personal or financial data and we do not use it for advertising.

• Running the service: showing records, calculating budgets, producing reports.
• Securing accounts and preventing abuse.
• Sending necessary emails: verification, password reset, member invitations, and reminders for bills, debts, budgets, and the trial.
• Billing and managing subscriptions.
• Answering questions and helping with problems.
• Meeting legal obligations.

4. Legal basis

We process your data based on your consent when you sign up, because it is needed to perform the service agreement, and for legitimate interests such as security. For legal obligations, we process it as required.

5. Who we share data with

Our team does not open the contents of your financial records, unless you ask for help and allow it, or the law requires it.

• Members of the same organization, according to the roles the organization owner gives.
• Midtrans, to process payments.
• The server and infrastructure providers Vaulty runs on (located in Singapore).
• A public CDN (jsDelivr) for exchange rates, and Google Fonts for fonts. Your browser contacts them directly, so they receive your IP address and those requests, not your data.
• Authorities, when the law requires it.

6. Cookies and browser storage

The app uses one required session cookie so you stay signed in. Preferences such as theme and language are kept in the browser's local storage. We do not use advertising or tracking cookies, and the landing site runs no analytics that use cookies.

7. Security

No system is completely immune. If an incident affects your personal data, we tell you and the authorities as the law requires.

• Passwords are stored as bcrypt hashes.
• Two step verification (2FA) is available on the Personal and Family plans.
• Each organization's data is kept separate, and access to another organization's data is denied.
• Connections to the service use HTTPS.
• We back up data regularly.

8. How long we keep data

Data is kept as long as your account exists. If you delete your account, your data is removed from our active systems. After a subscription ends, data stays stored and can be downloaded. Data you delete along with your account also disappears from backups no later than 1 month afterwards.

9. Your rights

Under the PDP Law you have the right to:

• access and receive a copy of your data (you can export it to PDF and Excel),
• correct wrong data,
• ask for your data to be deleted or your account closed,
• withdraw consent and object to certain processing,
• ask to restrict processing.

Write to the contact below. We respond within 3 x 24 hours of receiving the request and finish it as soon as we can.

10. Children

Vaulty is meant for users aged 18 and over. Users under 18 need our confirmation and a parent or guardian's consent. If you find a child's account that has not been confirmed, contact us so we can delete it.

11. Where data is stored

Data is stored on our servers in Singapore, so your data is sent outside Indonesia. Singapore has its own personal data protection law (PDPA). Connections to the service use HTTPS, and we do not share your data with anyone beyond what this page describes.

12. Changes to this policy

We update this page when the way the service works changes. For important changes we tell you by email or in the app. The date of the last update is at the top.