Privacy Policy

Last updated: September 2026

Vaultr is operated by 1001541506 Ontario Inc., doing business as "Vaultr," a corporation incorporated in the Province of Ontario, Canada (the "Company"). References in this Privacy Policy to "Vaultr," "we," "us," or "our" mean 1001541506 Ontario Inc. We are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use vaultr.pro. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable Canadian privacy laws.

Cross-border processing. Several of our service providers — including Coinflow Labs Limited (a Delaware corporation headquartered at 406 N. Sangamon Street, Chicago, IL 60642), Persona (identity verification), and Cloudflare — are based outside of Canada and may process your personal information on servers located in the United States or other jurisdictions. Information processed outside Canada may be subject to the laws of those jurisdictions, including lawful access by foreign authorities. By using Vaultr, you acknowledge this cross-border processing.

1. Information We Collect

We collect the following categories of personal information:

• Account information: Email address, username, and password (stored as a bcrypt hash — we never store your plain-text password)
• Payment information: Payment details are collected and processed exclusively by Coinflow Labs Limited. Vaultr does not store your credit card numbers, bank account details, or full payment card information on our servers
• Identity verification: If you request a withdrawal, identity verification is handled by Persona (Coinflow's KYC provider). Vaultr does not store your ID documents, selfies, or government-issued identification — Persona processes and retains these
• Transaction data: Purchase history, pack openings, buyback transactions, marketplace activity, wallet balance and deposit/withdrawal history
• Shipping information: Name and shipping address, only if you request physical card redemption
• Technical data: IP address, browser type, device information, and session data for security and fraud prevention
• Communication data: Support inquiries and correspondence

2. What We Do NOT Store

To be clear about what stays off our servers:

• Credit card numbers — handled entirely by Coinflow Labs Limited (PCI-DSS compliant)
• Bank account details — handled entirely by Coinflow
• Full ID documents — handled entirely by Persona
• Selfies or biometric data — handled entirely by Persona

3. How We Use Your Information

We use your personal information for:

• Account management: Create and maintain your account, process authentication, manage your wallet balance
• Payment processing: Facilitate deposits, purchases, marketplace transactions, and withdrawals through Coinflow Labs Limited
• Fraud prevention: Detect and prevent fraudulent transactions, unauthorized access, chargeback abuse, wash trading, and platform manipulation
• Email communications: Send order confirmations, pack opening results, shipping notifications, withdrawal confirmations, and account security alerts via Resend
• Card pricing: We use eBay's API to fetch recent completed sales data for pricing cards. This does not involve your personal information
• Tax compliance: Calculate and remit applicable sales taxes
• Service improvement: Analyze usage patterns to improve the experience (aggregated, non-identifying data only)
• Advertising and measurement: Measure the performance of our advertising, understand which ads lead to sign-ups and deposits, and reach people likely to be interested in Vaultr. This is described in detail in Section 5A

4. Marketing Communications

We will never send you marketing or promotional emails without your explicit opt-in consent. You may withdraw consent at any time by clicking "unsubscribe" in any marketing email or contacting us. Transactional emails (order confirmations, security alerts, etc.) are not marketing and will be sent as needed to operate your account.

5. Third-Party Services

We share personal information only with the following third-party providers, solely for the purposes described:

• Coinflow Labs Limited (payment processing and payouts): A Delaware corporation headquartered at 406 N. Sangamon Street, Chicago, IL 60642. Processes your card and bank-account details for wallet deposits, marketplace transactions, and withdrawals (ACH and Real-Time Payment). Coinflow's Privacy Policy
• Persona (identity verification): Used by Coinflow to handle KYC verification when you request a withdrawal. Receives and retains your ID documents, selfies, and biometric data — Vaultr does not. Persona's Privacy Policy
• Resend (email delivery): Receives your email address to deliver transactional emails. Resend's Privacy Policy
• Cloudflare (CDN, security, DNS, inbound email routing): Provides website security, DDoS protection, DNS, and routes inbound mail sent to [email protected] to our team. Cloudflare may process your IP address, request data, and (for support inquiries) the contents of email you send to our support address. Cloudflare's Privacy Policy
• Tawk.to (live support chat): Powers the chat widget on our support pages. Sets its own cookies in your browser and receives your IP address, browser and device information, the pages you view while the widget is loaded, and anything you type into the chat. Tawk.to's Privacy Policy
• eBay API (pricing data): We query eBay's completed sales data to determine fair market values for cards. No personal information is shared with eBay
• Shipping carriers: Receive your name and shipping address when you redeem a card for physical delivery
• Meta Platforms, Inc. (advertising and measurement): Receives website activity and a hashed email address via the Meta Pixel; the same sign-up and deposit events sent directly from our server (Conversions API); and a hashed email address if you are included in a customer list audience. Described in full in Section 5A, including how to opt out. Meta's Privacy Policy

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

5A. Advertising & Measurement (Meta)

We advertise Vaultr on Meta's platforms (Facebook and Instagram). To understand which of our ads actually lead to sign-ups and deposits — rather than just clicks — we share limited information with Meta Platforms, Inc. in the three ways described below. Meta's Privacy Policy

a) Meta Pixel (automatic, from your browser). Our website loads the Meta Pixel, which reports the following to Meta as you use the site:

• Your IP address, browser and device information
• The pages you view on vaultr.pro, and the page you arrived from
• Meta advertising cookies (_fbp, _fbc) that let Meta recognise a returning visitor and connect a visit to an ad you clicked
• Three events: that a page was viewed, that an account was created, and that a deposit completed — the deposit event includes the amount and currency
• Your email address — but only when you type it into a form on our site, such as signing up or logging in. It is irreversibly hashed (SHA-256) inside your own browser before it is sent, so Meta cannot read the original address; it is used only to check whether it matches an existing Meta account, so that a sign-up or deposit can be credited to the ad that led to it. This is Meta's "advanced matching" feature, and we have deliberately limited it to your email address — no other field is enabled

The Pixel does not send Meta your name, phone number, home or shipping address, password, payment card or bank details, identity-verification data, wallet balance, or which specific cards you bought, pulled, or own.

b) Conversions API (from our server). Browsers increasingly block advertising scripts, and Apple's tracking rules stop many events on iPhones and in Safari from ever reaching Meta. So when you create an account or a deposit of yours settles, our server also reports that event to Meta directly. It is the same event as the one your browser reports, sent with a shared identifier so Meta counts it once rather than twice — this does not create additional conversions, it recovers ones that would otherwise be lost. What the server sends:

• Your email address, irreversibly hashed (SHA-256) before it leaves our servers — the original is never sent
• The Meta advertising identifiers (_fbp, _fbc) described above
• Your IP address and browser information, as recorded when you signed up or made the deposit
• Which event happened, when, and — for a deposit — the amount and currency
• The page you first arrived on

The server sends no name, phone number, address, payment or bank details, identity-verification data, wallet balance, or information about which cards you bought, pulled, or own. A refund or chargeback is reported too, so a reversed deposit is not left standing as a conversion.

c) Customer list audiences (periodic, from us). We may upload a list of our customers to Meta to measure our advertising and to let Meta find new people with similar characteristics ("Lookalike Audiences"). What we upload is limited to:

• Your email address, irreversibly hashed (SHA-256) before it leaves our servers — Meta cannot read the original address, and uses it only to check whether it matches an existing Meta account

That is the only thing we upload. Each list covers customers in a single country, so which list you appear in reflects your country, but no country field — and no other field about you — is sent.

We do not upload your name, date of birth, home address, city, phone number, identity-verification data, or any information about your transactions, balance, or collection. Information you provided for identity verification or for shipping a physical card is used only for those purposes and is never used for advertising.

Under Meta's terms for customer lists, Meta acts as our service provider: it uses the list to build the audiences we create, and states that it deletes the hashed records once matching is complete.

Your choices. You can opt out of this at any time and it will not affect your account or your ability to use Vaultr:

• Email [email protected] and ask to be excluded from advertising measurement and audiences. We will stop reporting your events to Meta, remove you from any existing customer list, and exclude you from future ones
• Use your browser's cookie controls, or an ad or tracking blocker, to stop the Pixel loading. Vaultr works normally with the Pixel blocked. Note that this stops what your browser reports but not what our server reports (section b) — to stop that as well, email us as above
• Adjust your ad preferences directly with Meta at facebook.com/adpreferences

Meta is based in the United States, so this involves the cross-border processing described at the top of this policy.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service:

• Account data: Retained while your account is active. Account deletion is immediate and permanent: once you delete your account it cannot be recovered. Records we are legally required to keep (such as the transaction records below) are retained for the periods stated even after deletion
• Transaction records: Retained for a minimum of 7 years as required by Canadian tax and financial reporting laws
• Technical logs (IP, session data): Retained for up to 90 days for security and fraud prevention, then automatically purged. Where an IP address forms part of a transaction or administrative record we are required to keep, the record itself is retained for the period stated above but the IP address is erased from it on the same 90-day schedule
• Support correspondence: Retained for up to 2 years after resolution

7. Your Rights

Under PIPEDA and applicable privacy laws, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information, subject to our legal retention obligations
• Withdraw consent: Withdraw your consent to the processing of your personal information at any time, subject to legal or contractual restrictions
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Data Security

We implement industry-standard security measures to protect your information:

• Passwords are hashed using bcrypt and never stored in plain text
• Sessions use secure, httpOnly cookies with appropriate expiration
• All data transmitted between your browser and our servers is encrypted via TLS/SSL
• Payment processing is handled entirely by Coinflow Labs Limited (PCI-DSS compliant)
• Access to personal data is restricted to authorized personnel on a need-to-know basis

9. Cookies & Sessions

We use essential cookies required for the operation of the Service:

• Session cookie: Maintains your login session and authentication state
• Security cookies: CSRF protection and rate limiting

Our support pages also load the Tawk.to live-chat widget, which sets its own third-party cookies so it can recognise a returning chat visitor and keep a conversation going. It is not loaded on the homepage.

We also use advertising cookies set by the Meta Pixel:

• _fbp — identifies your browser to Meta so a later sign-up or deposit can be connected to the ad that brought you here
• _fbc — records the Meta ad click that brought you to the site, when you arrive from one

These are described in Section 5A, along with how to opt out. Vaultr works normally if you block them. We do not use any other third-party analytics or ad-tracking product, and we do not use advertising cookies to build profiles of what you buy, pull, or own.

10. Children's Privacy

Vaultr is not intended for individuals under 18. We do not knowingly collect personal information from minors. If we learn that we have collected information from a person under 18, we will promptly delete it.

11. PIPEDA Compliance

Vaultr adheres to the ten fair information principles set out in PIPEDA:

• Accountability: We are responsible for personal information under our control
• Identifying purposes: We identify the purposes for collection at or before the time of collection
• Consent: We obtain meaningful consent for the collection, use, and disclosure of personal information
• Limiting collection: We collect only the information necessary for the identified purposes
• Limiting use, disclosure, and retention: Personal information is used only for the purposes for which it was collected and retained only as long as necessary
• Accuracy: We keep personal information as accurate, complete, and up-to-date as necessary
• Safeguards: We protect personal information with appropriate security measures
• Openness: We make our privacy policies and practices readily available
• Individual access: Upon request, we inform you of the existence, use, and disclosure of your personal information and provide access to it
• Challenging compliance: You may challenge our compliance with these principles by contacting us

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Service. The "Last updated" date at the top indicates when the policy was last revised.

13. Contact

If you have questions or concerns about this Privacy Policy or our data practices, contact us:

Email: [email protected]

Legal entity: 1001541506 Ontario Inc.
Registered address: 100 Harbour St, Toronto, ON M5J 0B5, Canada
Jurisdiction: Province of Ontario, Canada
Doing business as: Vaultr

You may also contact the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.