Who is responsible
Vault84Lab is the controller of the personal information described in this notice. You can contact us about privacy through our protected contact form.
What we collect
- Downloads: your email address and one summary per platform containing the latest requested VST version, latest request timestamp, and total request count. We also keep daily totals by platform and installer version, without email addresses in those totals. This records installer requests, not completed downloads or installations.
- Optional news: if you tick the separate marketing box, we also record that choice and when it was made. Marketing is never required to download MaxVRS.
- Support: if you contact us, we receive your email address and the message you choose to send. Please do not include passwords, payment information, health information, or other sensitive data.
Like nearly every hosted website, Microsoft Azure and Cloudflare may process an IP address and standard request or browser information to deliver the page, prevent abuse, and diagnose faults. Our application uses an IP address transiently for rate limiting but does not save it in the download or support database. Cloudflare’s short-lived verification token is not stored there either.
Why we use it
We use your email and download record to provide the requested release, measure adoption by platform and version, and support MaxVRS. Under the GDPR and UK GDPR, the legal basis is taking steps at your request and our legitimate interest in distributing, measuring, and supporting MaxVRS (Article 6(1)(b) and 6(1)(f)).
We use support information to answer you and improve the product on the same legal bases. Security information is processed under our legitimate interest in keeping the service reliable and preventing abuse.
We send product news only when you separately consent (Article 6(1)(a)). The privacy checkbox confirms that you received this notice; it is not marketing consent. You can withdraw marketing consent at any time, and every marketing email will include an unsubscribe method.
You are not legally required to provide an email address, but we require one for the download and support flows. Marketing remains optional. We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects.
Service providers and international transfers
We do not sell or rent your email address. We disclose only the information needed for these providers to run and protect the service:
- Microsoft: Azure hosts the website, database, API, and installer files.
- Cloudflare: Turnstile checks whether a form submission appears to come from a person rather than a bot. According to Cloudflare, Turnstile does not read form entries.
- Google: Google Fonts supplies the typefaces used by this site and may receive IP address and standard request data when the fonts load.
We plan to keep the primary Azure resources in the European Economic Area. A provider may process information in another country, including the United States. Where European law requires it, transfers will rely on an adequacy decision, the EU–U.S. Data Privacy Framework where applicable, or European Commission Standard Contractual Clauses and appropriate safeguards. See the Microsoft DPA, Cloudflare DPA, and Google Privacy Policy.
We use no advertising or analytics cookies. Cloudflare Turnstile may use browser signals or storage strictly to secure the forms. Blocking it may prevent form submission.
How long we keep information
- Download email addresses and their per-platform latest version, latest request time, and total request count: up to 24 months after the most recent request associated with that address.
- Support and feedback messages: up to 24 months after the last activity on the request.
- Marketing subscription information: until consent is withdrawn or the mailing list ends. A minimal suppression and consent record may be kept for up to three years where necessary to demonstrate and respect your choice.
- Routine technical and security logs under our control: normally up to 30 days, or longer when reasonably necessary to investigate a security incident.
We may retain specific information longer when required by law or reasonably necessary for a legal claim. When a period ends, information is deleted or irreversibly anonymized, subject to normal backup rotation.
Your European privacy rights
If the GDPR or UK GDPR applies, you may request access, correction, erasure, restriction, or portability of your personal data; object to processing based on legitimate interests or for direct marketing; and withdraw consent at any time. These rights can be subject to legal exceptions.
Submit a request through our protected contact form. Select Support and write “Privacy request” at the start of the message. We may request limited information to verify your identity and will normally respond within one month. You may also complain to the data-protection authority where you live, work, or believe an infringement occurred. The European Data Protection Board lists EEA authorities.
We do not use personal information for decisions based solely on automated processing that produce legal or similarly significant effects.
United States privacy disclosures
Where a U.S. state privacy law applies, you may have rights to access, correct, delete, or obtain a copy of your personal information and to appeal a denied request. We will not discriminate against you for exercising a privacy right.
For California notice-at-collection purposes, we collect identifiers (email address and technical online identifiers), download activity (platform, latest requested VST version, latest request time, and total request count), and customer records (a support message, if submitted) for the purposes and periods stated above. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or offer financial incentives for it. We have not done so during the preceding 12 months, and we do not knowingly collect sensitive personal information as defined by California law.
Submit a request through our protected contact form. We may verify that the email belongs to you or ask an authorized agent for proof of authority.
Security and changes
We use encrypted connections, short-lived private download links, rate limiting, and restricted administration. No internet service is completely secure, but we maintain safeguards appropriate to the limited information we hold.
We may update this notice when the service or law changes. We will post the revised date here and provide additional notice when a change materially affects how we use information.