Privacy Policy

1. Who we are

This policy explains what personal data we collect when you use Value Vault, why we collect it, how long we keep it, and what rights you have over it. It covers the website at thevaluevault.uk, your dashboard, and the agent software we license to you.

The data controller is TheValueVault Digital Limited (company number 17388291), trading as "Value Vault", registered in the United Kingdom at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. You can contact us about anything in this policy at thevaluevaultdigital1@gmail.com.

We are registered with the Information Commissioner's Office (ICO) as a data controller. If you are unhappy with how we handle your data you can complain to us first, and to the ICO at ico.org.uk or 0303 123 1113.

2. The short version

We hold your email address, your subscription status, the settings you choose, and a record of the bets your agent placed. We do not hold your bookmaker usernames or passwords — by design they never leave your own machine, and this is a deliberate architectural choice, not a promise about how careful we are. We do not use advertising, analytics or tracking cookies of any kind, and we never sell your data.

3. What we collect, and why

Account data. Your email address and an encrypted (hashed) password, held by our authentication provider when you register. Lawful basis: performance of our contract with you — we cannot give you an account without it. Kept for as long as your account exists.

Subscription data. Which product you hold, your subscription status, and the identifiers our payment provider gives us to link you to your payments. We do not store your card number, which never reaches our systems — see "Payments" below. Lawful basis: performance of our contract, and our legal obligation to keep business and tax records.

Configuration data. The settings you enter in your dashboard: which bookmakers you use, your bankroll and unit sizes, your mug-bet setting, which optional bet types you switch on, a nickname you may give each account, and the Multilogin browser-profile identifier for each account. Lawful basis: performance of our contract — this is what tells your agent how to behave. Note that a bookmaker account nickname is free text: if you type your own name into it, we will hold that.

Betting activity. A record of the bets your agent placed or attempted: the event, market, selection, odds, stake, whether it succeeded, and when. This is sent to us by your agent so your dashboard can show it. Lawful basis: performance of our contract, and our legitimate interest in diagnosing faults in our own software. This data concerns your gambling activity and we treat it accordingly — it is never shared, sold, or used for marketing.

Agent and connection data. A hashed copy of your access token, when your agent last contacted us, and which version it is running. Lawful basis: performance of our contract, and our legitimate interest in keeping the service secure and working.

Support data. If you contact us or raise a ticket, we keep your name, email address and what you wrote, so we can reply and keep a record of the issue. Lawful basis: performance of our contract, and our legitimate interest in running a support function. You can raise a ticket without an account, in which case this is the only data we hold about you.

Server logs. Our servers keep ordinary technical logs, which include IP addresses, for security and fault diagnosis. Lawful basis: our legitimate interest in protecting the service against attack and abuse.

4. What we deliberately do NOT collect

Your bookmaker credentials. The agent runs on your own machine and reads your bookmaker usernames and passwords from a file that stays there. They are never transmitted to us and we have no way to retrieve them. We are a software vendor, not an operator of your accounts.

Because software can leak data by accident as well as by design, the agent also strips anything that looks like a credential out of every diagnostic report before it is sent to us. On one occasion in August 2026 a bookmaker password did reach our server inside an error message from a browser automation failure; we found it in testing, removed it, and added that scrubbing so it cannot recur.

Your card details. See "Payments".

Tracking. We use no advertising networks, no analytics products, no social media pixels and no tracking cookies. The only cookies we set are the ones that keep you logged in; without them the dashboard cannot work, so we do not ask for consent to them and you cannot turn them off while staying signed in.

5. Payments

Payments are handled by a regulated third-party payment provider. Your card details are entered on their systems, not ours: we never see or store your card number, expiry date or security code. We receive only confirmation of whether a payment succeeded and the identifiers needed to match it to your account.

Our payment provider is a data controller in its own right for the payment data it holds, and its own privacy policy governs that. We will name our provider here once it is appointed.

6. Who else sees your data

We do not sell your personal data, and we do not share it for anyone else's marketing. We share it only with the suppliers who run the service for us, each of which processes it on our instructions under a contract:

Supabase — our database and login provider. Your account, settings and betting records are stored there, in the European Union (Ireland).

Hetzner — the hosting company whose servers run our signal service, in Germany.

Telegram — when you raise a support ticket, we receive an alert containing the ticket so we can respond quickly. Do not put anything in a ticket you would not want passing through a messaging service.

Our payment provider, as described above.

We may also disclose data where the law requires it, to establish or defend legal claims, or to prevent fraud or abuse of the service. If we ever sell or restructure the business, customer records may transfer with it, and we would tell you first.

7. Where your data is held

Your data is stored in the European Economic Area — Ireland and Germany. Some of our suppliers are corporate groups with staff outside the EEA who may access data for support purposes. Where that happens, the transfer is covered by the UK's International Data Transfer Agreement, the equivalent EU Standard Contractual Clauses, or an adequacy decision.

8. How long we keep it

Account, configuration and betting records: for as long as your account is open, and then deleted or anonymised within 90 days of you closing it, except where we must keep something longer.

Financial and transaction records: six years, because UK tax law requires it. This is a legal obligation and is not affected by a deletion request.

Support tickets: two years from when the ticket is closed.

Server logs: normally no more than 90 days, unless a log is retained as part of investigating a specific security incident.

9. Your rights

Under UK data protection law you have the right to: ask what data we hold about you and get a copy of it; have inaccurate data corrected; have your data deleted; restrict or object to how we use it, including where we rely on legitimate interests; receive your data in a portable format; and withdraw consent where we relied on consent.

To exercise any of these, email thevaluevaultdigital1@gmail.com from the address on your account. We will respond within one month. We will not charge you, and we will not treat you differently for asking.

Two honest limits. First, deleting your account does not delete records we are legally required to keep, such as transaction records for tax. Second, deleting your data means we can no longer run the service for you, so a deletion request during an active subscription is treated as a cancellation.

Deleting your account with us has no effect on your bookmaker accounts, which are yours and are held with those bookmakers directly. Bets already placed remain live with them, and any funds are theirs to return to you, not ours.

10. Automated decision-making

Our software decides which bets to signal, and your agent places them automatically. Those are automated decisions about betting, made by software you have configured and switched on — they are not decisions about you, they do not profile you, and they produce no legal or similarly significant effect on you within the meaning of data protection law. We do not use your data to make automated decisions about your access to the service, your pricing, or your creditworthiness.

11. Keeping your data safe

Passwords are stored hashed, never in readable form. Access tokens are stored hashed, so a copy of our database does not let anyone impersonate your agent. Traffic between you, your agent and our servers is encrypted in transit. Access to our production systems is limited to us, requires cryptographic keys rather than passwords, and is logged.

No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.

12. Children

The service is strictly for adults aged 18 or over, as our Terms require. We do not knowingly collect data about anyone under 18. If we discover that we have, we will delete it.

13. Changes to this policy

We may update this policy as the service changes or the law does. The version and effective date at the top of this page always tell you which one is current. If we make a change that materially affects how we use your data, we will email you before it takes effect.