Privacy Policy

1. Introduction

FlavorVault ("FlavorVault", "we", "us", or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you acquire a Technology Certificate, create a Vault, upload information, or otherwise use our Services.

FlavorVault provides secure artificial intelligence infrastructure, encrypted Vault technology, Technology Certificates and related software services.

This Privacy Policy applies to all personal data processed by FlavorVault in connection with the provision of its Services.

This Privacy Policy applies under both the EU General Data Protection Regulation (EU GDPR) and the UK General Data Protection Regulation (UK GDPR) read with the Data Protection Act 2018. Where this Policy refers to GDPR, this should be read as referring to both EU GDPR and UK GDPR unless the context specifies otherwise.

2. Data Protection Roles

2.1 FlavorVault as Data Controller

FlavorVault acts as a data controller in relation to:

• User account administration;
• Technology Certificate issuance and verification;
• Vault administration;
• Authentication and security monitoring;
• Service operation and maintenance;
• Customer support;
• Compliance with legal obligations;
• Fraud prevention and platform security.

2.2 Business Customers

Where FlavorVault provides Services to business customers, FlavorVault may act as a data processor under separate contractual arrangements where required by applicable law.

2.3 Relationship with Glacio Ltd

FlavorVault uses Technology Certificate infrastructure provided by Glacio Ltd (Company Registration No. 677497, Larnaca, Cyprus). In connection with the issuance and verification of Technology Certificates, limited certificate metadata may be shared with Glacio solely for certificate issuance, registration and validation purposes.

3. Categories of Personal Data Processed

FlavorVault may process the following categories of personal data.

3.1 Account Information

• Name
• Username
• Email address
• Contact details
• Account credentials.

3.2 Authentication Data

• Technology Certificate identifiers;
• Authentication records;
• Two-factor authentication information;
• Login activity.

3.3 Technical Data

• IP address
• Device identifiers
• Browser type and version
• Operating system
• Session timestamps
• Usage logs
• Error reports

3.4 Vault Content

• Documents uploaded by users
• Identity documents
• Financial records
• Medical information
• Legal documents
• Personal notes
• Files and data stored within a Vault.

3.5 Library Activity Data

• Recipes and collections viewed
• Saved recipes and cookbooks you create
• Search and browsing activity within the library.

3.6 Communications

• Customer support requests
• Correspondence
• Service-related communications.

3.7 Payment and Transaction Data

• Token pack purchase records
• Transaction reference identifiers
• Payment method type (card or bank transfer)
• Purchase amount and date
• Technology Certificate issuance records linked to payment.

4. Purposes of Processing

FlavorVault processes personal data for the following purposes:

1. Issuing and validating Technology Certificates
2. Creating and maintaining Vaults
3. Providing access to the Services
4. Personalising your experience based on Vault content
5. Authenticating users
6. Maintaining system security
7. Detecting fraud and abuse
8. Providing customer support
9. Monitoring and improving Service performance
10. Complying with legal obligations
11. Enforcing contractual rights
12. Responding to lawful requests from authorities
13. Processing token pack purchases and managing token balances
14. Issuing, recording and verifying Technology Certificates in the Certificate Registry
15. Account recovery via Technology Certificate.

FlavorVault does not sell personal data.

FlavorVault does not use personal data for behavioural advertising.

FlavorVault does not provide personal data to third parties for marketing purposes.

5. Legal Bases for Processing

Where required under applicable law, FlavorVault relies on one or more of the following legal bases:

5.1 Contractual Necessity

Processing necessary for:

• Providing Services
• Managing accounts
• Operating Vaults
• Delivering the Services
• Processing token pack purchases
• Issuing Technology Certificates.

5.2 Legitimate Interests

Processing necessary for:

• Security monitoring
• Fraud prevention
• Service improvement
• Infrastructure protection
• Business administration
• Maintaining the integrity of the Certificate Registry.

5.3 Legal Obligations

Processing necessary for compliance with:

• Applicable laws
• Regulatory requirements
• Court orders
• Law enforcement requests.

5.4 Consent

Where required by law, FlavorVault will obtain consent before processing personal data.

5.5 Explicit Consent for Special Category Data

Where users voluntarily upload special category personal data (including health information or identity documents) to their Vault, FlavorVault relies on explicit consent under Article 9(2)(a) EU GDPR and, for UK users, Article 9(2)(a) UK GDPR read with Schedule 1 of the Data Protection Act 2018. Users may withdraw this consent at any time by deleting the relevant content from their Vault or submitting a deletion request to FlavorVault.

6. Vault Content

Users may upload information and documents to their Vault.

Such information is processed solely for the purpose of providing the Services.

Users remain solely responsible for:

• The legality of uploaded content;
• The accuracy of uploaded information;
• Ensuring they have the right to upload such information.

FlavorVault does not claim ownership of user-uploaded content.

Users grant FlavorVault a limited licence to process such content solely for the purpose of providing the Services.

Vault content is retained for the duration of the user's account and is deleted following account closure or permanent token depletion, as described in section 9.

Recipes and culinary content are provided for general information and may be incomplete or unsuited to your needs.

This content is provided for informational purposes only and does not constitute:

• Legal advice
• Financial advice
• Medical advice
• Tax advice
• Professional advice of any kind.

Users should check recipes against their own dietary needs and allergies before relying on them.

7. Data Sharing

FlavorVault may share personal data with:

• Glacio Ltd (Company Registration No. 677497, Larnaca, Cyprus), solely for Technology Certificate issuance, registration and verification purposes
• Cloud hosting providers
• Infrastructure providers
• Cybersecurity service providers
• Technical support providers
• Professional advisers
• Auditors
• Regulators
• Government authorities where legally required.

FlavorVault does not sell personal data.

FlavorVault does not disclose personal data for advertising purposes.

All third-party service providers are required to implement appropriate security measures.

8. International Transfers

Personal data may be transferred outside the European Economic Area (EEA) and the United Kingdom where necessary for hosting, support or operational purposes.

Where such transfers occur, FlavorVault implements appropriate safeguards, including:

• Standard Contractual Clauses;
• Adequacy decisions;
• Encryption measures;
• Technical and organisational safeguards.

For transfers of personal data of UK users outside the United Kingdom, FlavorVault relies on the applicable UK transfer mechanism, which may include the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. EU Standard Contractual Clauses alone are not relied upon for transfers of UK personal data.

9. Data Retention

Personal data is retained only for as long as necessary to:

• Provide the Services
• Maintain Vault functionality
• Fulfil contractual obligations
• Comply with legal requirements
• Resolve disputes
• Protect legal rights.

Retention periods for the main categories of personal data are as follows:

• Account data: for the duration of the account and for a limited period after closure;
• Vault content: deleted after account closure or permanent token depletion;
• Assistant conversation history (where applicable): retained for a limited period;
• Technology Certificate records: permanent (public registry function);
• Payment and transaction records: up to 7 years (accounting and tax obligations);
• Security and audit logs: retained for a limited period.

When personal data is no longer required, it is securely deleted or anonymised.

10. Security Measures

FlavorVault implements appropriate technical and organisational measures designed to protect personal data.

Such measures include:

• Encryption in transit
• Encryption at rest
• Multi-factor authentication
• Access controls
• Network security controls
• Monitoring systems
• Audit logging
• Vulnerability testing
• Incident response procedures
• AES-256 encryption of Vault content
• Technology Certificate-bound access controls ensuring only the certificate holder can access their Vault.

While FlavorVault takes reasonable steps to protect personal data, no method of transmission or storage can be guaranteed to be completely secure.

11. Your Rights

Subject to applicable law, you may have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent
• Right not to be subject to solely automated decision-making with significant effects (Article 22 EU GDPR / UK GDPR).

Requests may be submitted by contacting FlavorVault at privacy@flavourvault.tech. FlavorVault will respond within one month of receipt of a valid request.

FlavorVault may require verification of identity before responding to requests.

12. Automated Processing

FlavorVault uses artificial intelligence systems to generate responses based on:

• User prompts
• Uploaded Vault content
• Available contextual information.

Where AI features are provided, this personalisation constitutes profiling under GDPR Article 4(4) in so far as it analyses personal information to generate personalised responses. It does not produce legal or similarly significant effects.

FlavorVault does not engage in automated decision-making that produces legal or similarly significant effects without appropriate safeguards.

You have the right to object to profiling under GDPR Article 21 by contacting FlavorVault at privacy@flavourvault.tech.

13. Children's Privacy

The Services are not intended for individuals under the age of 18.

FlavorVault does not knowingly collect personal data from children.

If we become aware that personal data has been collected from a child without appropriate authorisation, such data will be deleted promptly. If you are a parent or guardian and believe your child has provided personal data to FlavorVault, please contact us at privacy@flavourvault.tech.

14. Cookies and Similar Technologies

FlavorVault may use cookies and similar technologies for:

• Authentication;
• Session management;
• Security monitoring;
• Service functionality;
• Performance analysis.

Additional information may be provided in our Cookie Policy.

15. Complaints

If you believe your personal data has been processed unlawfully, you may:

• Contact FlavorVault;
• Lodge a complaint with the relevant supervisory authority;
• Contact your local data protection authority;
• If you are based in the United Kingdom: lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF | Tel: 0303 123 1113 | www.ico.org.uk;
• If you are based in the European Union: lodge a complaint with the supervisory authority of the EU member state in which you reside or work.

16. Changes to this Privacy Policy

FlavorVault may amend this Privacy Policy from time to time.

Updated versions will be published on our website and Platform.

Where changes materially affect how your personal data is processed or your rights, FlavorVault will notify you by email or in-Platform notification before the changes take effect. Where consent was the legal basis for processing, fresh consent will be sought.

17. Contact Information

For privacy-related enquiries, requests or complaints, please contact FlavorVault using the contact details published on our website, or email privacy@flavourvault.tech.

18. Clarification of Service Nature

For the avoidance of doubt, FlavorVault:

• Provides software services
• Provides encrypted Vault technology
• Provides access to the Services
• Issues Technology Certificates
• Operates secure digital infrastructure.

FlavorVault does not:

• Provide banking services
• Provide payment services
• Provide investment services
• Issue e-money
• Provide legal advice
• Provide medical advice
• Provide financial advice
• Act as a regulated financial intermediary.

Personal data processing by FlavorVault is limited to the operation and provision of its software services.