Privacy Policy

The responsible party (as defined in POPIA) is My Global Vault (Pty) Ltd (Reg. No. 2026/641330/07), operator of MyGlobalVault™, of 29 Patrick Road, Charlo, Port Elizabeth, 6070 (registered, postal and legal address). The Service is available to users worldwide.

Our Information Officer is Jacques Allistar Nel, registered with the Information Regulator (South Africa) on 8 October 2026. No Deputy Information Officer has been appointed. Privacy, POPIA and PAIA requests: info@myglobalvault.com. General support: support@myglobalvault.com. Our PAIA Manual is available at myglobalvault.com/paia-manual.

• Account data: name, email address and password hash (or OTP verification records).
• Vault content: documents, notes and attachments you choose to store. These are encrypted in transit and encrypted at rest.
• Recipient data: the name and contact details of the person you nominate.
• Billing data: if you purchase Lifetime Premium, your app store (Google Play on Android, the Apple App Store on iPhone) shares a purchase or transaction reference with us so that we can verify the entitlement on our servers. We do not receive or store your card number, CVV or full billing address — those remain with the app store.
• Entitlement flag: a lifetime_access boolean on your profile indicating whether Lifetime Premium is active.
• Operational data: sign-in events, pulse check-ins and security logs.
• Usage and conversion statistics: a small, fixed set of first-party counters described in section 2A.

🔒 Lifetime Premium is a one-time US$14.99 purchase — there are no recurring charges, no stored payment methods, and no subscription data held by My Global Vault. Your app store displays the equivalent price in your local currency.

We record a limited set of first-party counters so that we can see where people get stuck while creating an account and starting to use the vault. These are stored in our own database and are not shared with any advertising or analytics company.

Each record contains only:

• which stage was reached — app or page opened, “create account” tapped, registration submitted, verification code sent, verification code confirmed, first document uploaded, or Premium purchase completed;
• the date and time;
• the platform (web, Android or iPhone);
• an anonymous visit reference, so that a single visit is not counted several times before you register;
• your account reference, once you have an account;
• which app store confirmed the purchase, for a completed Premium purchase only.

This system is first-party and is not used to collect your IP address for statistics, a browser or device fingerprint, your document names, or anything from inside your documents. We do not use Google Analytics, advertising pixels, advertising SDKs or cross-site tracking. The counters are visible only to our own administrators, in aggregate, and a completed-purchase counter is written only after our servers have verified the purchase with the app store.

When you arrive through one of our printed QR codes, we remember which campaign it was (for example a bag insert or a licence-renewal flyer) as a fixed label on your device for up to 30 days, and add that label to the counters above. No name, email address, IP address or device fingerprint is used for this.

We process your personal information to:

• provide and secure the Service (performance of contract);
• release vault content to your nominated recipient when triggered (your consent);
• meet our legal and regulatory obligations.

We do not sell your information. We use vetted processors (cloud hosting, email delivery, authentication, and your app store’s billing system — Google Play Billing on Android, Apple In-App Purchase on iPhone — for the optional Lifetime Premium purchase) that may store or process data outside South Africa under safeguards required by section 72 of POPIA. Because the Service is available internationally, your information may also be processed in the country where you use the Service. Each app store’s handling of payment information is governed by that store’s own privacy policy.

Hosting: our database, file storage and authentication run on managed cloud infrastructure in the European Union (Ireland, AWS eu-west-1). The website is delivered through a global edge network, so requests may be served from a location near you. Account and notification emails (including verification codes) are sent through our managed email delivery provider.

We retain vault content for as long as your account is active. On account deletion, vault content is erased within 30 days; minimal records required by law (e.g. billing) are retained for the legally required period. Deleting your account from inside the app removes your stored files first and then your account immediately; copies held in our hosting provider’s routine backups expire on that provider’s backup cycle.

Where a claim results in a recorded death determination and the claim is completed, a 30-day deletion countdown starts and vault content is then erased. We keep a minimal, non-content summary of the claim (dates, claim type and outcome) for accountability. An incapacity determination never starts a deletion countdown.

When someone opens a claim on an account, we collect and process the documentation they submit so that a person on our review team can verify it. This may include their own identity document, a death certificate, a medical or legal certificate of incapacity, or a court or executor authority. Where the claimant is not you, that information relates to them and, unavoidably, to you.

• It is stored in a private, access-controlled store and is never publicly reachable.
• It is used only to assess that one claim, and for the resulting audit record.
• It is deleted 90 days after a rejected, cancelled or closed claim, and 12 months after a completed claim.
• We keep an append-only audit trail of claim events. That trail records what was decided and when — it does not contain your vault content.

We do not disclose your vault contents, the number of items you store, or the existence of any document to a claimant. Only the specific documents you authorised in advance for that specific recipient can ever be released, and the default is none.

Wherever you are located, you may ask us to:

• access the personal information we hold about you;
• correct or delete that information;
• stop processing it, or withdraw a consent you previously gave.

Users in South Africa hold these rights under POPIA and may lodge a complaint with the Information Regulator (South Africa) — enquiries@inforegulator.org.za, https://inforegulator.org.za. Users in other countries may have additional or different rights under the privacy and data-protection laws that apply where they live, and may contact their local supervisory authority. We honour access, correction and deletion requests from all users regardless of location.

Vault content is encrypted at rest using AES-256—the same encryption standard trusted by banks, governments and healthcare providers worldwide—and in transit via TLS. Access is gated by authentication and per-user row-level security, with role-based controls limiting administrative access. We follow industry-standard practices but no system can be guaranteed 100% secure — see also our Disclaimer.

Information Officer: Jacques Allistar Nel — info@myglobalvault.com
General support: support@myglobalvault.com
My Global Vault (Pty) Ltd · Reg. No. 2026/641330/07 · 29 Patrick Road, Charlo, Port Elizabeth, 6070 · Proudly South African 🇿🇦