Privacy Policy

Vaalti ("Vaalti", "we", "us", "our") provides a data vault and enrichment platform that lets businesses store, filter and enrich the contact data they already own. Our registered office is 30 Riverhead Close, London, England, E17 5PY, United Kingdom.

We are established in the United Kingdom, so we handle personal data under the UK GDPR and the Data Protection Act 2018. For the data described in this policy we are the data controller, except where the section on your vault says otherwise.

Questions about anything on this page go to support@vaalti.com. We are not required to appoint a statutory Data Protection Officer, but privacy requests are owned by a named member of our team and answered from that address.

Vaalti touches two very different categories of personal data. Keeping them apart is the key to understanding the rest of this policy.

• Site and account data: information about you as a visitor, an early-access sign-up, or a customer using the platform. We decide how and why it is used, so we are the controller for it.

• Vault data: the contact records our customers import, enrich and store in their own vault. Our customers decide what goes in and what it is used for, so they are the controller and we act as their processor.

The next two sections are about site and account data. The section on your vault sets out how we handle customer data, and the section on business contact data explains where enrichment results come from.

We collect what we need to run the service and nothing we cannot justify.

• Directly from you, when you fill in a form, create an account, buy a plan or contact us.

• Automatically, as you use the site and the platform, through server logs and the cookies described below.

• From your colleagues, when a workspace administrator invites you to their team.

• From our service providers, such as our payment processor confirming that an invoice was paid.

• From public and licensed sources, for the business contact database behind our enrichment tools. That is set out in its own section below.

When you upload an export, run a bulk job or enrich a record, the result sits in your vault. You choose what to collect and what to do with it, so for that data you are the controller and Vaalti is your processor.

Our Google Maps Scraper, Website Finder, Website Extractor, Email Finder and Verifier, and LinkedIn Phone Finder return business contact details. Those details are compiled from publicly accessible sources, such as company websites, business directories and public professional profiles, and from third-party data we license under contract.

• We hold business-context data only: work email address, work telephone number, job title, employer, company website, business address and public professional profile links.

• We do not build profiles of anyone's private life, and we do not collect special category data.

• Results are checked against your existing records so the same contact is not stored twice.

• Where a verification is uncertain we say so, with a confidence score. Where we have no match at all, we tell you that rather than inventing one.

Our lawful basis for maintaining this database is legitimate interests: helping businesses reach the right suppliers, partners and candidates. We have carried out a legitimate interests assessment weighing that against the rights of the individuals concerned, and you can request a summary of it.

We do not make decisions about you by automated means alone that produce legal effects or similarly significant consequences.

If you join the early-access list or become a customer, we may email you about the product, new tools and your place in the queue. We keep it infrequent and relevant.

• Every marketing email carries a one-click unsubscribe, and we act on it immediately.

• You can also opt out at any time by emailing support@vaalti.com.

• Service messages such as invoices, security notices and changes to these policies are not marketing, so they continue while you hold an account.

• We do not pass your details to third parties for their own marketing.

We keep this deliberately light. There are no advertising cookies and no cross-site tracking pixels on this site.

• Strictly necessary: keeping you signed in, protecting forms against abuse and routing traffic. These cannot be switched off without breaking the service.

• Preferences: a small cookie that remembers whether you chose the light or dark theme, so the page renders correctly the moment it loads.

• Analytics: aggregated statistics about which pages and features are used, so we can improve them. These are only set where you allow them, and they are not used to identify you.

You can clear or block cookies in your browser settings. Blocking the strictly necessary ones will stop you signing in.

We do not sell personal data, and we never will. We share it only with the following, and only as far as each one needs.

• Infrastructure providers who host the platform, store data and run backups.

• Email delivery providers who send transactional messages such as invites, invoices and password resets.

• Payment processors who take card and bank payments. They handle card details directly; we only see the outcome.

• Analytics and error-monitoring providers who help us find faults and understand aggregate usage.

• Support tooling used to answer your tickets and emails.

• Professional advisers such as accountants, auditors and lawyers, under a duty of confidence.

• Authorities and regulators, where we are legally required to disclose, and only to the extent required.

• An acquirer or successor, if the business is sold, merged or restructured. We will tell you before your data becomes subject to a different policy.

Every provider works under a written contract, processes data only on our instructions, and is held to appropriate security and confidentiality terms. Ask support@vaalti.com for our current sub-processor list, and we will tell you when it changes if you are a customer.

We are based in the United Kingdom and some of our providers are not. Where personal data leaves the UK or the EEA, we make sure it stays protected by relying on one of the following.

• UK adequacy regulations, where the destination country has been recognised as offering equivalent protection.

• The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

• Additional technical and organisational measures, such as encryption and access restrictions, where a transfer risk assessment shows they are needed.

You can ask for a copy of the safeguards in place for a specific transfer by emailing support@vaalti.com.

We keep personal data only as long as it is doing a job, then delete or anonymise it.

• Data is encrypted in transit with TLS, and encrypted at rest on our infrastructure.

• Passwords are hashed with a modern algorithm and are never readable by our staff.

• Access follows least privilege, with multi-factor authentication on administrative systems.

• Workspaces are logically isolated so one customer's vault is never exposed to another.

• We log and monitor access to production systems, and review those logs.

• Backups run regularly and restores are tested.

• New providers go through security due diligence before they touch personal data.

• Staff are bound by confidentiality obligations and trained on handling data.

No system is perfectly secure. If a personal data breach occurs and it is likely to result in a risk to people's rights, we will notify the Information Commissioner's Office within 72 hours where required, and tell affected customers and individuals without undue delay.

Under the UK GDPR you have the right to:

• Be informed about how your data is used, which is what this policy is for.

• Access a copy of the personal data we hold about you.

• Rectify data that is inaccurate or incomplete.

• Erase your data where we no longer have a good reason to keep it.

• Restrict how we use it while a concern is being resolved.

• Port the data you gave us to another provider in a structured, machine-readable format.

• Object to processing based on legitimate interests, and to direct marketing at any time and without giving a reason.

• Withdraw consent where our basis is consent, without affecting anything done beforehand.

To exercise any of these, email support@vaalti.com. We answer within one month. If a request is complex we may take up to two further months, and we will tell you why within the first month. Requests are free unless they are manifestly unfounded or excessive. We may need to verify your identity first, and we will only ask for what is necessary to do so.

If your details sit in a customer's vault, that customer is the controller. We will pass your request to them promptly and support them in answering it, and we will suppress your details in our own database as described above.

Vaalti is a business tool for professional use, and it is not directed at children. We do not knowingly collect data about children, and customers must not upload it. If you believe a child's data has reached us, tell us and we will delete it.

We update this policy as the product and the law change. The date at the top of the page always reflects the current text.

Where a change materially affects your rights, we will tell customers by email or an in-app notice at least 14 days before it takes effect. Earlier versions are available on request from support@vaalti.com.