Privacy policy

What the app keeps, where it is kept, who else touches it, and what you can do about it. Written from what the app does.

What we keep

For a business: the records you put in the app — stock, purchases, orders, buyers' names and shipping addresses as the marketplaces send them, shows, consignors, the books — on a database of your own. For the people you add: name, email, role, sign-in events (device, date, whether two-factor was used).

For a sign-up or a demo request on this site: the business name, your name, email or phone, what you sell and the notes you wrote, and the referral code on the link you came from. For a collector on the waiting list: your name and email.

For billing: your email and the Stripe customer and subscription ids. Your card is held by Stripe; we never see the number.

Where it lives

Each business's database is its own Supabase project; Vaultman's own project (the hub) keeps only the business name, the app address, the publishable key and the billing state. Photos and documents are stored in that business's own storage. Everything travels over HTTPS and is encrypted at rest.

Who processes it

Supabase (database, authentication, storage, server functions), Cloudflare (serving the app and this site, DNS, TLS), Stripe (subscriptions), Resend (email the app sends when a business turns it on), and the marketplaces a business connects under its own consent (Whatnot, eBay, Shopify). Each is bound by its own security and privacy terms, linked from the Security page. We do not sell data, and we do not share it with anyone else.

A collector's data is the collector's

On the collector edition your pieces live under your own login on a database no dealer or other collector can read. Nothing leaves your account until you press Sell — and then only the pieces you picked go to Vaultman as an offer. Vaultman's own shop does not see your collection otherwise.

What you can do

Export everything from Settings at any time. Close the business, or ask us to remove a sign-up or a waiting-list entry, by writing to [email protected]; a closed business is kept 30 days and then removed. The site sets no tracking cookies; the app remembers your sign-in and your device's preferences in your own browser.

Changes and contact

A change to this policy is dated at the foot of this page. Vaultman LLC, Dallas, Texas — [email protected].

Last updated October 31, 2026. Questions: [email protected]. The legal pages read what the app does; they are not legal advice, and a change to them is dated here.