Privacy Policy

Information You Provide Directly

• Account registration: Full name, email address, and password (stored as a secure hash).
• Profile information: Display name, profile photo, biography, location, website URL, and church or organisation affiliation where applicable.
• Creative content: Posts and content of any type — stories, poems, songs, lyrics, audio files, sermons, devotionals, prayers, notes, cover images, and attached documents — that you create, organize, upload, and publish, along with the folders, projects, categories, and tags you use to organize them.
• Payment information: When upgrading to a paid plan, billing details are collected directly by Stripe and/or PayPal. We do not store full card numbers or PayPal credentials on our servers.
• Folder profiles: If you create a folder profile, the name, description, and photo you add to that folder.
• Comments: When you comment on a post, your display name, the comment text, and the time it was posted.
• Communications: Messages sent via our contact form, support requests, or email correspondence.

What Is Visible to the Public

• Published posts and any files, audio, images, or links attached to them.
• Your public profile: display name, photo, and bio, or the folder profile name, photo, and description for posts filed in that folder.
• Approved comments: the commenter’s display name and comment text. Comments stay hidden until the post’s author approves them.
• Your contact email: Each published post has a “Contact” button. When a visitor clicks it, their email app opens a new message addressed to the email on your account. The address is hidden from simple scraping tools, but anyone who uses the button can see it.

Information Collected Automatically

• Log data: IP address, browser type and version, operating system, referring URLs, pages visited, and time of access.
• Device information: Device type, unique device identifiers, and mobile network information.
• Usage data: Features used, content viewed, share actions taken, and interaction patterns within the Platform.
• Cookies: Session cookies, authentication tokens, and preference data. See Section 6 for full details.

Information from Third Parties

• Payment processors: Stripe and PayPal share transaction confirmation, subscription status, and billing cycle data to activate or manage your plan.
• Analytics providers: Aggregated, anonymised usage statistics from services such as Google Analytics.

• Providing the service: Creating and managing your account, hosting your published content, and making it accessible to you and your audience.
• Processing payments: Verifying subscriptions, activating paid plan features, managing renewals, and processing cancellations through Stripe and PayPal.
• Communicating with you: Sending transactional emails (account confirmation, password reset, payment receipts) and responding to support requests.
• Platform security: Detecting and preventing fraud, abuse, unauthorised access, and violations of our Terms of Service.
• Improving the Platform: Understanding how features are used to improve user experience, fix bugs, and develop new functionality.
• Legal compliance: Meeting obligations under applicable law, including tax reporting, fraud prevention, and responding to lawful authority requests.

What We Store

• Your chosen plan level (Starter, Creator Pro, Advanced Pro+)
• Subscription status and expiry timestamp
• Stripe Customer ID and/or Stripe Subscription ID
• PayPal Subscription ID (where applicable)
• Payment method indicator (Stripe or PayPal — not card details)
• Date and status of last payment attempt

What We Do NOT Store

• Full credit or debit card numbers
• Card CVV / security codes
• PayPal login credentials or linked bank account details
• Billing addresses (held by Stripe/PayPal per their policies)

Stripe's Data Practices

PayPal's Data Practices

Subscription Renewals & Webhooks

Optional Outside AI & Design Tools

Author-Vault may provide ordinary links to outside AI and graphic design services. These optional tools open outside Author-Vault. Opening a link does not send your Vault content to the service or give that service access to your private Vault.

Anything you choose to enter or upload there is handled under that provider’s terms and privacy policy, including its rules for storage, processing, and AI training. You decide what to share. You may create work in an outside tool and then upload the finished work to Author-Vault.

These links do not automatically connect your Author-Vault account to the outside service. The outside website may collect information about your visit under its own privacy policy.

Publicly Published Work

Publicly published work can be viewed and copied by others. Author-Vault’s commitment not to train AI on your content does not guarantee that other people or services will never collect or use content you make public.

Essential Cookies (Always Active)

• Session cookies: Authenticate your login and keep you signed in. Expire when you close your browser.
• Security tokens: Protect against CSRF attacks on form submissions.
• Preference cookies: Remember your dashboard settings and workspace preferences.

Analytics Cookies (Optional — only with your consent)

• Google Analytics: Anonymised cookies that help us understand traffic patterns. No personally identifiable information is included. IP addresses are anonymised before storage.

Payment Cookies

• Stripe & PayPal: When you visit their hosted checkout pages, these processors may set their own cookies, governed by their respective privacy policies.

• Encryption in transit: All data transmitted between your browser and our servers uses TLS (HTTPS) encryption.
• Password hashing: Passwords are never stored in plain text. We use WordPress's salted hashing mechanism.
• Access controls: Only authorised personnel with a legitimate operational need can access user data.
• Regular backups: Your content and account data is backed up regularly to prevent accidental loss.
• Payment security: No raw payment credentials are transmitted to or stored on our servers. All payment handling is delegated to PCI-DSS certified processors.

• We do not claim any intellectual property rights over your content.
• Author-Vault does not use your creative content to train machine learning or AI models. We do not send your private Vault content to outside AI or design tools unless you specifically choose to share it.
• We do not sell, license, or redistribute your content to third parties without your explicit consent.
• By publishing content, you grant us a limited, non-exclusive, royalty-free licence to display, host, and deliver that content to your intended audience as part of the Platform's normal operation.
• You can delete your content at any time from your dashboard, or delete a single post from its own page. Deleted content is removed from our servers within 30 days.
• You can export a full backup of your vault at any time from your dashboard.

GDPR (European Users)

• Contract performance: Processing necessary to provide the services you signed up for.
• Legitimate interests: Platform security, fraud prevention, and service improvement — balanced against your rights.
• Legal obligation: Compliance with applicable laws and regulations.
• Consent: Where we ask for consent (e.g., optional analytics), you may withdraw it at any time.

CCPA (California Residents)

• Account data: Retained for the duration of your account, plus 90 days after deletion for recovery and dispute resolution.
• Published content: Retained until you delete it, or until your account is deleted.
• Payment records: Retained for 7 years to comply with tax and financial reporting obligations.
• Server logs: Retained for 90 days for security purposes, then automatically deleted.
• Support communications: Retained for 2 years to resolve ongoing issues and improve our service.