What we collect, and what we don't.

AssetVault operates this site and is the controller for the personal data described below. Provider identification, including the responsible legal person and postal address, is on the imprint page. You can reach us at the contact route published on the imprint.

Nothing that identifies you. Browsing these pages sets no cookies, writes nothing to local or session storage, and loads no third-party scripts, fonts or pixels. Fonts are served from our own domain.

The site contains a small internal event helper used to count interactions such as opening a pricing card. It dispatches an event inside your own browser only. Nothing is transmitted, and no analytics provider is connected. If we ever add one, this page will say so before it goes live.

The site is hosted by Vercel Inc. Like any web host, Vercel processes technical request data — including your IP address, the page requested, timestamp, and browser user-agent — in server logs, for the purpose of delivering the site and maintaining its security and stability.

Legal basis: our legitimate interest in operating a secure, working website (Art. 6(1)(f) GDPR). Vercel acts as our processor under a data processing agreement.

Checkout is handled entirely by Stripe. When you start a purchase you are taken to a Stripe-hosted checkout page and enter your details there.

We never see or store your card details. They are submitted directly to Stripe and never touch our servers. What we receive back is limited to what we need to fulfil the order: the product purchased, the email address you used, the amount and currency, and Stripe’s identifiers for the session and payment.

Legal basis: performance of the contract you enter when you buy (Art. 6(1)(b) GDPR).

We use Stripe’s Managed Payments, under which Stripe acts as Merchant of Record for the sale. Stripe is the seller of record to you, and handles payment processing, applicable sales tax and VAT, invoicing and fraud prevention.

For those activities Stripe is an independent controller of your data and processes it under its own privacy policy, not ours. Stripe Payments Europe, Ltd. is the relevant entity for customers in Europe.

If you email us, we receive your address and whatever you write, and we keep the thread so we can help and so there is a record of what was agreed. We do not run a newsletter, and we will not add you to a mailing list because you bought something.

Delivery of purchased files is sent to the address you used at checkout. No account is created and there is no password to manage.

Vercel and Stripe are US-headquartered and may process data outside the European Economic Area. Both rely on the European Commission’s Standard Contractual Clauses, and on the EU–US Data Privacy Framework where they participate in it, as the legal basis for those transfers.

Order records are kept as long as required by German commercial and tax law, which is generally six to ten years for records bearing on accounts. Support email is kept only as long as it is useful, and then deleted. Host request logs are retained on Vercel’s own schedule and are not aggregated into any profile by us.

Under the GDPR you may request access to your personal data, its correction or deletion, restriction of processing, and portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you can withdraw it at any time without affecting what happened before.

Contact us using the route on the imprint page and we will action it. Requests touching payment data may need to go to Stripe, since Stripe controls that data; we will tell you if so.

You also have the right to complain to a supervisory authority. In Germany that is the data protection authority for the federal state in which the provider is established.

If the stack changes, this page changes with it in the same release — adding a service without documenting it here is treated as a defect. The date at the top reflects the last substantive revision.