Privacy Policy
Last updated: 27 September 2026
This policy explains how Techmek LLC, postal address available on request from devopsplus11@gmail.com ("we", "us") handles personal data about visitors to our website, people who use the Vaultless Guard console at vguard.techmek.io, and our customers' administrators and business contacts. Questions: devopsplus11@gmail.com.
1. The short version
- The Vaultless Guard gateway runs on your own machines. Your prompts, code, files and the sensitive values it protects are processed there and are not sent to us.
- The optional hosted console receives only content-free operational data (counts, versions, health) plus the account data needed to sign people in.
- We use no analytics, advertising or tracking cookies. We do not sell or share personal information for advertising.
2. Our role
- Controller: for website visitors, people who sign up for a trial, customer billing and business contacts, support correspondence, security reports, and the activation records of air-gapped licences.
- Processor (service provider): for the personal data a customer's organisation puts into the hosted console (its users' accounts, device labels and so on). The customer is the controller and decides how that data is used; our Data Processing Addendum governs it. If you are a user of a customer's console, contact your organisation first about your data; we will help them respond.
3. What we collect and why
| Who | Data | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|---|
| Website visitors | IP address and request details, processed transiently to deliver pages, rate-limit and protect the service. Our application does not write access logs. | Deliver and secure the website | Legitimate interests (security and operation) |
| People who sign up for a trial | Organisation name, work email, password (stored only as a one-way digest), number of seats, sign-up code | Create the trial organisation and first administrator account | Contract (steps at your request); legitimate interests |
| Console users | Name, email, roles, password digest, MFA seed (encrypted), session records, sign-in events with a short tag derived from your IP address (not the address itself), SSO or SCIM identifiers from your organisation's identity provider, actions you take in the console | Sign you in, enforce your organisation's access policy, keep the audit trail your organisation relies on | Processor for the customer; for our own security of the service, legitimate interests |
| Gateway users (through their organisation) | Device identifier and label, the user label a gateway enrolled with, content-free counts, versions and health | Show your organisation its fleet and protection statistics | Processor for the customer |
| Customer administrators and billing contacts | Name, work email, job title, company, order and invoice details, communications | Contract management, invoicing, service notices, renewals | Contract; legal obligation (tax and accounting); legitimate interests |
| Support and security contacts | What you send us | Answer you; fix problems; handle vulnerability reports | Legitimate interests |
| People who contact us through the website form | Name, work email, company, role, team size, the AI tools and operating systems you tick, deployment preference, your message, the date, and a keyed tag derived from your IP address (for abuse prevention; not the address itself) | Answer your request (demo, trial, security review, pricing) | Consent (you tick the box) and legitimate interests (answering a business enquiry) |
| Air-gapped activations (Enterprise) | Installation public key, a keyed machine fingerprint we cannot reverse, product version and platform, an optional label, renewal chain data. Never host names, user names, addresses or content. | Issue and renew licences, detect copied installations | Contract; legitimate interests |
We do not use personal data for automated decision-making with legal or similarly significant effects. We do not use it to train AI models.
Service emails. We do not currently send email from the service (for example invitations). If we add an email delivery provider, it will be listed on our Subprocessors page first.
Payments. We invoice manually and do not currently use a payment processor or collect card details. If we add online payment, this policy will be updated to name the processor before it is used.
4. Cookies and similar storage
We use only strictly necessary cookies and browser storage. See our Cookie Notice.
5. Who we share data with
- Subprocessors and service providers who host and back up the service, listed on our Subprocessors page.
- Your organisation, for data in its console (administrators can see users, roles and the audit trail).
- Professional advisers (lawyers, accountants, auditors) under confidentiality.
- Authorities, when the law requires it. We will push back on requests that are not legally valid and, where lawful, tell the affected customer.
- A buyer or successor if we are involved in a merger or acquisition, under this policy's protections.
We do not sell personal information and do not "share" it for cross-context behavioural advertising (as those terms are defined in the CCPA).
6. International transfers
Our hosted service and its backups are in the United States. When we transfer personal data from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and their Swiss equivalent, together with the technical safeguards described in our Security Overview. You can request a copy of the relevant safeguards at devopsplus11@gmail.com. Customers who want no transfer can self-host the console in their own environment.
7. How long we keep it
| Data | Retention |
|---|---|
| Console sessions | Valid for up to 12 hours; deleted 1 day after expiry (revoked sessions 7 days after creation) |
| Single sign-on browser cookie | 15 minutes |
| Console audit trail, including sign-in events | 13 months |
| Daily count rollups | 13 months (or as the customer's Order Form sets) |
| Audit-chain anchors | All for 7 days, then one per gateway per day for 13 months |
| Webhook delivery records and device commands | 30 days |
| Console user accounts | Until removed by the customer, or until the organisation is deleted (within 30 days after the subscription ends) |
| Trial organisations not converted | Deleted on request at any time; otherwise reviewed and deleted within 6 months after the trial ends |
| Website contact requests | 24 months after our last exchange, or sooner on request |
| Encrypted database backups | Deleted within 90 days of creation |
| Activation records (air-gapped licences) | For the life of the licence |
| Contracts, orders and invoices | As long as tax and accounting law requires |
| Support and security correspondence | As long as needed to resolve the matter and keep a reasonable record, then deleted |
8. Your rights
EEA, UK and Switzerland. You have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent where we rely on it. You may complain to your local supervisory authority, though we would like the chance to help first.
California and other US states. Residents of California and other states with comprehensive privacy laws have the right to know what personal information we collect, use and disclose; to access and receive a copy; to correct it; to delete it; and to opt out of its sale or sharing and of targeted advertising and profiling (we do none of these). We use no sensitive personal information for purposes that would trigger the right to limit. We will not discriminate against you for exercising your rights. You may use an authorised agent; we may ask for proof of the agent's authority and to verify your identity.
How. Email devopsplus11@gmail.com. We will verify your request (usually by confirming control of the email address on the account) and respond within one month (GDPR) or 45 days (CCPA), extendable where the law allows. If your data is in a customer's console, we will refer your request to that customer and help them respond. If we decline a request, we will explain why and, where applicable, how to appeal.
Categories under the CCPA (last 12 months). Identifiers (name, email, IP-derived tag, device identifiers); commercial information (orders, invoices); internet or network activity (sign-in events, console actions, content-free usage counts); professional information (job title, company). Sources: you, your organisation and your organisation's identity provider, your gateways. Purposes and recipients: sections 3 and 5.
9. Security
We protect personal data with the measures in our Security Overview, including encryption in transit and at rest for secrets, database row-level isolation between customers, MFA, and encrypted backups.
10. Children
Our services are for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact devopsplus11@gmail.com and we will delete it.
11. Changes
We will post changes here with a new "Last updated" date. For material changes we will also notify customer account owners by email or in the console before they take effect.
12. Contact
Techmek LLC, postal address available on request from devopsplus11@gmail.com. Privacy: devopsplus11@gmail.com. Security reports: devopsplus11@gmail.com.