Privacy Policy

Vault Zero CRM is an acquisition CRM with an integrated research agent. The hosted service at crm.vaultzero.dev is operated by Vault Zero (vaultzero.dev). Questions about this policy can be sent to privacy@vaultzero.dev.

Vault Zero CRM is open source. If you run your own copy, the operator of that deployment is responsible for privacy on that instance. This policy applies only to the service we host.

Account information. When you create an account, we collect your name, email address, and authentication credentials. If you sign in with Google or Microsoft, we receive basic profile information from that provider.

Google data. If you connect Google, we request access to Gmail and read-only access to Google Calendar so meetings and email threads can appear on the right company in your workspace. We store metadata and message content only for conversations tied to companies in your CRM. Personal mail that does not relate to a tracked company is not saved. We use Gmail send access only when you explicitly approve a message with its exact recipients, subject, and body.

CRM content. We store the records you and your workspace create or import, including companies, contacts, deals, tasks, notes, research results, and related files.

Usage and technical data. We collect standard service logs, device and browser information, IP address, and product telemetry needed to operate, secure, and improve the service.

We use the information above to:

• provide, maintain, and secure the CRM and research agent
• authenticate you and manage your workspace membership
• sync email and calendar data you choose to connect
• run automated research tasks you or your workspace trigger
• respond to support requests and enforce our terms
• measure reliability and improve the product

We do not sell your personal information.

The research agent may read CRM records and, when you connect Google, email and calendar data needed to enrich companies and contacts. When optional third-party research keys are configured for your workspace, the agent may send names, domains, employers, and similar business context to those providers to answer a research task. We configure the hosted service to minimize outbound data and to write only verified findings back to your records.

We share information only as needed to run the service, including:

• infrastructure providers that host the application and database
• authentication providers you choose, such as Google or Microsoft
• AI, search, or enrichment providers invoked by a research task you start or schedule
• professional advisers or authorities when required by law or to protect rights, safety, and security

Other members of your workspace can access records inside that workspace according to your workspace membership.

We keep account and CRM data while your account or workspace is active. If you delete your account or ask us to remove hosted data, we delete or anonymize it within a reasonable period, except where we must keep limited records for security, billing, or legal compliance.

We use encryption in transit, access controls, and industry-standard hosting practices. No method of transmission or storage is completely secure. Report security issues through the process described in our open-source security policy.

You can:

• update workspace and profile information in the product
• disconnect Google or Microsoft from workspace settings where available
• request access, correction, export, or deletion by emailing privacy@vaultzero.dev

Depending on where you live, you may have additional privacy rights. We will respond to verified requests within the time required by applicable law.

The service is not directed to children under 16, and we do not knowingly collect personal information from them.

We may process information in the United States and other countries where we or our service providers operate. We take steps designed to protect information when it is transferred internationally.

We may update this policy from time to time. If we make material changes, we will post the updated policy on this page and revise the effective date above.