What we collect, and what we don't.

AssetVault operates this site and is the controller for the personal data described below. You can reach us at hello@assetvaults.co or through the contact form. That is the route for exercising any of the rights set out below.

There is no Google Analytics and no advertising pixel, and nothing here follows you to other websites. We use three things, and one of them sets cookies.

Microsoft Clarity shows us how pages are actually used: where people click and scroll, and replays of sessions on the site. To do that it sets its own cookies in your browser (named _clck and _clsk) so that it can tell one visit from another, and it records pointer movement, clicks, scrolling and the changing content of the page. Microsoft masks what you type into form fields by default, and we have not turned that masking off. Clarity does not run on the page where you download a purchase. Microsoft is the processor for this data; its own privacy statement covers what it does with it. If you would rather not be recorded, a browser that blocks third-party scripts or cookies, or private browsing, will stop it, and you can object or ask for deletion using the contact route above.

We use Vercel Web Analytics to count visits in aggregate: which pages are viewed, the referring website, and your approximate location, device type, browser and operating system, derived from the request as the page loads. It uses no cookies. To tell visits apart, Vercel uses a value derived from the incoming request that it discards after 24 hours, and we only ever see totals. Page addresses are shortened before they are sent: anything after “?” is removed except campaign tags such as utm_source, and the private download page is never reported at all.

We also keep a small record of the purchase journey on our own servers: that a visit arrived on one of our tagged campaign links, that the pricing section was viewed, that a buy button was pressed, and that a checkout was started, cancelled, failed or completed. Each record holds the product, the page path, the referring website’s domain, any campaign tags the link carried and, for checkouts, Stripe’s order reference and the amount; an arrival record holds the campaign tags and nothing else. These records contain no IP address, no device or browser identifier, no name and no email address, and they cannot be linked to one another or to you.

Legal basis: our legitimate interest in understanding how the site is used and whether its checkout works (Art. 6(1)(f) GDPR). Vercel processes the page analytics and Microsoft processes the Clarity data, both as our processors; the purchase-journey records are stored with Supabase, our database provider, under the data processing agreements described below.

The site is hosted by Vercel Inc. Like any web host, Vercel processes technical request data (including your IP address, the page requested, timestamp, and browser user-agent) in server logs, for the purpose of delivering the site and maintaining its security and stability.

Legal basis: our legitimate interest in operating a secure, working website (Art. 6(1)(f) GDPR). Vercel acts as our processor under a data processing agreement.

Checkout is handled entirely by Stripe. When you start a purchase you are taken to a Stripe-hosted checkout page and enter your details there.

We never see or store your card details. They are submitted directly to Stripe and never touch our servers. What we receive back is limited to what we need to fulfil the order: the product purchased, the email address you used, the amount and currency, and Stripe’s identifiers for the session and payment.

Legal basis: performance of the contract you enter when you buy (Art. 6(1)(b) GDPR).

We use Stripe’s Managed Payments, under which Stripe acts as Merchant of Record for the sale. Stripe is the seller of record to you, and handles payment processing, applicable sales tax and VAT, invoicing and fraud prevention.

For those activities Stripe is an independent controller of your data and processes it under its own privacy policy, not ours. Stripe Payments Europe, Ltd. is the relevant entity for customers in Europe.

To deliver what you bought and to keep the record the law requires, we store a small order record with Supabase, our database provider: the product, the email address used at checkout, the amount and currency, Stripe’s identifiers for the session and payment, and whether delivery succeeded. No card details are stored, and there is no browsing or behavioural data in it.

The delivery email itself is sent through Resend, our transactional email provider, which receives your email address and the contents of that message. It is used for delivery and support only, never for marketing.

The product files are held in private storage on Vercel, reachable only through a short-lived link issued after your order is verified.

Both Supabase and Resend act as our processors under data processing agreements. Legal basis: performance of the contract (Art. 6(1)(b) GDPR), and our legal retention obligations (Art. 6(1)(c) GDPR).

If you reach this site through a link we sent you in an Instagram direct message, that conversation runs on Manychat, Inc., the tool we use to handle comments and messages. The link carries your Manychat contact ID — a number Manychat assigns to your conversation with us — in the page address as mcid, so that if you buy, we can tell the purchase came from that conversation.

To keep the ID until you reach checkout, your browser holds it in sessionStorage under the name av_mcid. It stays with that one browser tab and is deleted when the tab is closed; it is not a cookie. When you start checkout it is passed to Stripe with your order, and if the payment succeeds we send it to Manychat to mark that contact as having purchased, so that you stop receiving follow-up sales messages about something you already bought.

We also use the ID to measure whether these messages work. When you open the site from the link, and each time a checkout is prepared for you, we store a record of the ID, which of the two happened, the time, and the country our host derives from your connection (your IP address itself is not stored). A checkout record also holds the product and Stripe’s order reference. These records are kept with Supabase, our database provider, and deleted after 12 months. Tagging purchases and this measurement are the only two things the ID is used for.

The ID is never added to the purchase-journey records described in clause 02, which stay free of identifiers. Because it is part of the page address, it can appear where page addresses are recorded: our host’s request logs (clause 03) and Microsoft Clarity (clause 02). If you open the site from a link without it, none of this is stored. The purchased mark stays on your Manychat contact until you ask us to remove it or the contact is deleted.

Legal basis: our legitimate interest in not sending sales messages to people who have already bought, and in knowing whether our messages lead to visits and checkouts (Art. 6(1)(f) GDPR). Manychat acts as our processor under its data processing agreement, and Stripe keeps the ID with your order. You can object at any time using the contact route above, and we will remove the mark and delete these records.

If you email us, we receive your address and whatever you write, and we keep the thread so we can help and so there is a record of what was agreed. We do not run a newsletter, and we will not add you to a mailing list because you bought something.

Delivery of purchased files is sent to the address you used at checkout. No account is created and there is no password to manage.

If you use the contact form, the name, email address and message you send are used to answer your enquiry and nothing else. You are not added to a mailing list and the details are not used for marketing.

If you use the withdrawal form, we record your name, the email address the order was placed with, any order reference you give, the address for your confirmation, and the date and time the declaration was submitted. That is processed only to handle the withdrawal and to meet the legal obligations that come with it. We do not ask why you are withdrawing and do not record a reason.

Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) for the contact form, and performance of the contract together with our legal obligations (Art. 6(1)(b) and (c) GDPR) for a withdrawal.

Vercel, Stripe, Supabase, Resend, Manychat and Microsoft (for Clarity) are US-headquartered and may process data outside the European Economic Area. They rely on the European Commission’s Standard Contractual Clauses, and on the EU–US Data Privacy Framework where they participate in it, as the legal basis for those transfers.

Order records are kept as long as required by German commercial and tax law, which is generally six to ten years for records bearing on accounts. Support email is kept only as long as it is useful, and then deleted. Host request logs are retained on Vercel’s own schedule and are not aggregated into any profile by us. Records of arrivals from an Instagram message (clause 07) are deleted after 12 months.

Under the GDPR you may request access to your personal data, its correction or deletion, restriction of processing, and portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you can withdraw it at any time without affecting what happened before.

Contact us at hello@assetvaults.co and we will action it. Requests touching payment data may need to go to Stripe, since Stripe controls that data; we will tell you if so.

You also have the right to complain to a supervisory authority. In Germany that is the data protection authority for the federal state in which the provider is established.

If the stack changes, this page changes with it in the same release. Adding a service without documenting it here is treated as a defect. The date at the top reflects the last substantive revision.