Privacy policy

Plain-language summary, not legal advice. This document is a template you can use to evaluate Univaultport. Enterprise customers should rely on their negotiated Master Services Agreement (MSA) and Data Processing Addendum (DPA) for contractual terms.

01 Overview

Univaultport is an enterprise digital-asset migration platform. We help organizations move media, documents, and other files between cloud storage, content management, and digital-asset-management systems. This policy describes the personal data we receive in connection with the service and what we do with it.

The service is designed for business use. We process two broad categories of data: (1) account & usage data about the people who sign in to the platform (you, your colleagues, and the admins who configure connectors), and (2) customer content — the assets and metadata you choose to migrate. We treat each category differently; see Sections 3 and 4.

Enterprise note. Where you have signed a Master Services Agreement (MSA) or Data Processing Addendum (DPA) with Univaultport, those documents control in case of conflict with anything written here.

02 Who we are

Univaultport, Inc. (“Univaultport”, “we”, “us”) is a Delaware corporation headquartered at 1 Embarcadero Center, Suite 1100, San Francisco, CA 94111, USA. We operate the website at univaultport.com and the migration service available through it.

For privacy inquiries: privacy@univaultport.com. For security disclosures: security@univaultport.com. For contracting matters: legal@univaultport.com.

Our EU representative under GDPR Article 27 will be appointed before we begin processing personal data of EU residents at scale and listed here. Until then, EU residents may contact us directly at the privacy address above.

03 Our role: controller vs processor

Under GDPR and equivalent laws, our role depends on the data category:

• Account & usage data. We are the controller. We decide what to collect, why, and how long to keep it. Section 4.1 covers this category.
• Customer content (your migrated assets & metadata). We are a processor acting on behalf of the customer organization that provisioned the workspace. We process this data only on documented instructions from the customer — typically via the connectors and migrations you configure in the app. Sub-processor and transfer rules in Sections 7 and 8 apply.

04 Data we process

4.1 Account & usage data (we are the controller)

4.2 Customer content (we are the processor)

When you configure a connector and run a migration, the platform handles whatever assets your source connector exposes — files, metadata, folder structure, and any custom fields. Connector credentials (API keys, OAuth tokens, SSH private keys) are encrypted at rest with AES-256 using keys derived per installation; they are never returned to the browser in plaintext.

We do not inspect, index, train models on, or otherwise look at your assets beyond what the migration pipeline requires to read from the source and write to the destination. Logs reference paths and sizes, not content.

05 How we use data

• Provide the service: authenticate users, run migrations, surface progress, send transactional email (invitations, password resets, job completion notices).
• Operate & secure the platform: rate-limit abusive traffic, investigate incidents, recover from failures, audit administrator actions.
• Improve the product: aggregate, pseudonymized telemetry to understand what features are used and where the platform underperforms.
• Communicate with you: respond to support requests, send security advisories, notify of material policy changes.
• Comply with law: respond to lawful requests, exercise legal rights, defend ourselves in disputes.

We do not sell personal data. We do not use customer content for advertising or model training. We do not share workspace data across customers.

06 Lawful basis (GDPR / UK GDPR)

For data subjects whose personal data is processed under GDPR / UK GDPR:

• Performance of a contract — to provide the service to the authenticated user and the customer organization (Art. 6(1)(b)).
• Legitimate interests — to operate, secure, and improve the service, defend the business, and prevent abuse (Art. 6(1)(f)).
• Legal obligation — to respond to lawful requests and retain records the law requires (Art. 6(1)(c)).
• Consent — where required, e.g. for non-essential cookies. You can withdraw at any time.

07 Sharing & sub-processors

We share data only with sub-processors that are bound by written agreements equivalent to our obligations to you. We notify customers in advance of new sub-processors and offer an objection right where the MSA provides one.

The current full sub-processor list with addresses, processing purpose, and data location is available on request from privacy@univaultport.com.

08 International data transfers

We primarily process data in the United States. For personal data originating in the European Economic Area, the United Kingdom, or Switzerland, transfers to the US or to a sub-processor in a third country are made under Standard Contractual Clauses (SCCs) issued by the European Commission (2021/914), including the UK International Data Transfer Addendum where applicable. We supplement contractual safeguards with encryption in transit (TLS 1.2+) and at rest (AES-256), strong access controls, and a publicly documented response procedure for government access requests.

On request, enterprise customers may execute a region-specific Data Processing Addendum and select an EU processing region where supported by their plan.

09 Retention & deletion

10 Security measures

We implement technical and organizational measures appropriate to the risk:

• Encryption. TLS 1.2+ in transit, AES-256 at rest for all databases, backups, and connector credentials.
• Identity & access. Workspace-scoped authorization on every API endpoint. Role-based access control (owner / admin / member). MFA support on the roadmap.
• Secret handling. Connector credentials are encrypted with an installation-scoped key and never round-trip to the browser in plaintext.
• Isolation. Per-workspace logical isolation; each query is scoped by workspace ID and verified by a guard before reaching the database.
• Hardening. Dependencies scanned continuously; CI gates on known vulnerabilities; production has restricted egress + intrusion detection.
• Personnel. Background checks for staff with production access; least-privilege provisioning; mandatory annual security training.
• Audits. SOC 2 Type II and ISO 27001 are in progress; reports will be available under NDA when complete.

11 Your rights (GDPR / UK GDPR)

If you are a data subject under GDPR or the UK GDPR, you have the right to:

• Access the personal data we hold about you and receive a portable copy.
• Request correction of inaccurate or incomplete data.
• Request deletion (“right to be forgotten”), subject to legal retention obligations.
• Restrict or object to certain processing, including profiling.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local supervisory authority — for the EU, the list is at edpb.europa.eu.

For customer content (where we act as processor), please direct rights requests to your workspace owner; we will assist them as required under the DPA. For account & usage data, email privacy@univaultport.com. We respond within 30 days.

12 Your rights (CCPA / CPRA)

California residents have additional rights under the CCPA/CPRA. In the preceding 12 months, Univaultport has not sold or shared personal information as those terms are defined under the CCPA/CPRA. You may exercise the following rights:

• Right to know what categories of personal information we collect and why.
• Right to access and receive a copy of your personal information.
• Right to delete, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising your rights.

Submit requests to privacy@univaultport.com. We verify identity proportionate to the sensitivity of the request. Authorized agents may submit requests with proof of authorization.

13 Children's privacy

The service is intended for business use and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will delete it.

14 Cookies & tracking

We use a minimal set of cookies and local storage:

• Essential. Authentication and session state (cannot be disabled without losing the ability to sign in).
• Preferences. Active workspace, sidebar collapse state, theme choice. Stored client-side in localStorage.
• Analytics (anonymous). Aggregated usage counters scoped by workspace; no third-party advertising profilers.

We do not deploy tracking pixels or third-party advertising cookies.

15 Breach notification

We maintain a documented incident-response procedure. In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify affected customer organizations without undue delay and within 72 hours of becoming aware, consistent with GDPR Article 33 and equivalent obligations. Notification will include the nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken or proposed.

16 Changes to this policy

We update this policy periodically. Material changes are announced at least 30 days in advance via in-app notification and email to workspace owners. The “Last updated” date at the top reflects the most recent revision.

17 Document change log