Hathworth, Inc. ("Hathworth," "we," "us," or "our") operates Vault (vault.hathworth.com) and related services (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights available to you.
We serve users worldwide and have written this policy to meet the requirements of the major privacy frameworks our users are commonly protected by, including:
- The U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and comparable laws in Virginia, Colorado, Connecticut, Utah, and other states
- The EU General Data Protection Regulation ("GDPR")
- The UK GDPR and Data Protection Act 2018
- The Swiss Federal Act on Data Protection ("FADP")
- The Brazilian Lei Geral de Proteção de Dados ("LGPD")
- Angola's Lei de Proteção de Dados Pessoais (Law No. 22/11)
- Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), and Quebec's Law 25 where applicable
- Australia's Privacy Act 1988
- New Zealand's Privacy Act 2020
- South Africa's Protection of Personal Information Act ("POPIA")
- India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), as its provisions come into force in phases
Where these frameworks differ, we describe the specific right or mechanism that applies in Section 7 and Section 5. Nothing in this policy limits any right you have under the law that applies to you.
This policy applies to individual users of Vault ("Personal Vault") and to members and administrators of institutional organizations using Vault ("Organizational Accounts," including private membership associations and their affiliated bodies).
1. Our core commitment: zero-knowledge architecture
Vault is built so that the content you store — your files, documents, and personal records — is encrypted on your own device before it ever leaves it. Encryption and decryption keys are derived from your password and are never transmitted to or stored on our servers in usable form.
This means that for the content you store in Vault:
- We cannot read it. Not as a matter of internal policy, but as a matter of technical architecture. Your content is encrypted client-side before transmission, and we do not hold the keys required to decrypt it.
- We cannot hand over what we cannot access. If we receive a legal request for the content of your Vault, we can only provide the encrypted data as it exists on our infrastructure — unreadable ciphertext. We do not have a technical mechanism to decrypt it ourselves.
- This is an architectural fact, not a promise we could choose to break. We describe this as "can't," not "won't."
This policy is written to be precise about what falls inside that guarantee (your stored content) and what falls outside it (account metadata, billing information, and other information necessarily processed to operate the Service, described below).
2. Information we collect
2.1 Information you provide directly
| Category | Examples | Purpose |
|---|---|---|
| Account information | Email address, name, password (processed via one-way cryptographic derivation — we do not store your password itself) | Account creation, authentication, communication |
| Phone number | Mobile number, for accounts that enable phone-based verification | Two-factor / identity verification |
| Billing information | Name, billing address, payment details | Processed entirely by our payment processor (see Section 4) — we do not receive or store full payment card details |
| Organizational information | Organization/body name, membership roster entries, role assignments, membership records (for Organizational Accounts) | Enabling institutional account features |
| Support communications | Content of messages you send us for support purposes | Responding to your inquiries |
If you sign up using a friend's referral link, we record a link between your account and theirs so we can apply referral storage rewards.
2.2 Information collected automatically
| Category | Examples | Purpose |
|---|---|---|
| Technical/connection data | IP address, browser type, device type, access timestamps | Security, fraud prevention, service reliability, incident investigation |
| Functional cookies | A single cookie/local-storage entry recording your selected display language | Remembering your language preference across visits |
We do not use advertising or third-party analytics cookies on the Service. We do not track you across other websites.
2.3 Information we cannot access
The substantive content you store in Vault — documents, files, personal records, and similar material — is encrypted on your device before upload. We store only encrypted ciphertext. We have no technical means to view, scan, index, or otherwise process the plaintext content of what you store.
3. How we use your information
We use the information described in Section 2.1 and 2.2 to:
- Create and maintain your account
- Authenticate you and secure your account against unauthorized access
- Process payments and manage subscriptions
- Send essential service communications (billing notices, security alerts, account changes)
- Respond to support requests
- Comply with legal obligations
- Investigate and prevent fraud, abuse, or security incidents
- Operate Organizational Account features (membership rosters, administrative functions) as configured by the organization's administrators
We do not use your information for advertising, profiling for marketing purposes, or sale to third parties. We do not and cannot use the encrypted content of your Vault for any purpose, including improving our Service, because we cannot read it.
4. Who we share information with
We disclose limited categories of information to service providers who help us operate the Service. These providers act as data processors on our behalf and are contractually bound to use the information only for the purposes we specify. We do not sell personal information to anyone.
| Category of recipient | What they receive | Purpose |
|---|---|---|
| Payment processor | Billing name, billing address, payment method details, transaction history | Processing subscription payments. We do not receive or retain full card numbers. |
| Encrypted object storage provider | Encrypted file content (ciphertext only — no encryption keys, no plaintext, no readable metadata about file contents) | Durable storage of your encrypted files |
| Content delivery / DNS provider | IP address, connection metadata (for traffic routed through this provider) | Network performance, DDoS protection, content delivery |
| Infrastructure hosting provider | Server infrastructure hosting our application and database | Running the Service |
| SMS/phone verification provider | Phone number, verification codes | Two-factor authentication for accounts that use phone verification |
| Transactional email provider | Email address, message content of system-generated emails (e.g., account notices) | Sending account-related emails |
We may also disclose information where required to comply with a valid legal obligation, to protect the rights, property, or safety of Hathworth, our users, or the public, or in connection with a merger, acquisition, or sale of assets (subject to this policy or an equivalent standard of protection).
4.1 Organizational Accounts
If you are a member of an Organizational Account (e.g., a private organization or affiliated body), that organization's designated administrators may have visibility into certain non-content information you provide in that context — such as your name, membership status, role assignments, and attendance or dues records entered into the organization's own administrative tools — as configured by the organization. This visibility is governed by the organization's own administrative permissions within Vault and does not extend to the encrypted content of your Personal Vault, which remains private to you even within an Organizational Account context, unless you affirmatively share it through a feature designed for that purpose.
Hathworth does not grant a parent or governing organization access to a subordinate organization's financial or membership data beyond what that subordinate organization's own administrators choose to share.
5. International data transfers
Hathworth, Inc. is incorporated in the United States (Delaware) and our infrastructure providers operate servers located in the United States. If you are located outside the United States, your information — including encrypted content — will be transferred to and processed in the United States.
- From the European Economic Area: we rely on Standard Contractual Clauses or another lawful transfer mechanism recognized under GDPR with our processors where applicable.
- From the United Kingdom: we rely on the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable.
- From Switzerland: we rely on Standard Contractual Clauses adapted for the Swiss FADP, as applicable.
- From Brazil: transfers are made on a basis recognized under LGPD Article 33, including standard contractual clauses where applicable.
- From Angola: transfers are made on a basis recognized under Law No. 22/11, including your consent or another lawful basis where applicable.
Because the substantive content of your Vault is encrypted before it leaves your device using keys we do not hold, the practical exposure of any cross-border transfer is limited to ciphertext, not readable personal data.
6. Data retention and deletion
- Deleted files and accounts are deleted from active storage after a 30-day recovery period. Backup copies are purged within a further 30 days. The 30-day recovery period applies to files in your personal vault stored by us. Files kept in storage you connect yourself, and documents in shared organization vaults, are deleted when removed. Because files are end-to-end encrypted, we can never read them, during or after these periods.
- Billing records may be retained for a period after account deletion as required by tax, accounting, or other legal obligations.
- We retain technical/connection logs (Section 2.2) for a limited period for security purposes before automatic deletion.
7. Your rights
Your rights depend on where you live. In every case, we can act on these rights with respect to the account and metadata information described in Section 2 — but because the content of your Vault is encrypted client-side using keys we do not hold, we have no technical ability to access, review, or extract the plaintext content of your Vault ourselves. You retain sole access to that content through your own credentials, which also means no request — from you, from us, or from a third party — can make us produce readable content we do not have the technical means to read.
If you are in the European Economic Area, the United Kingdom, or Switzerland (under GDPR, UK GDPR, or the Swiss FADP), you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure; request that we restrict certain processing; receive your data in a portable format; object to certain processing; and withdraw consent at any time where processing is based on consent. You may lodge a complaint with your supervisory authority — your national Data Protection Authority in the EEA, the UK Information Commissioner's Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC).
If you are in Brazil (under LGPD), you have the right to: confirm the existence of processing; access your data; correct incomplete, inaccurate, or outdated data; request anonymization, blocking, or deletion of unnecessary or excessive data; request portability; request deletion of data processed with your consent; obtain information about entities we've shared your data with; be informed about the consequences of denying consent; and revoke consent. You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
If you are in Angola (under Law No. 22/11, the Lei de Proteção de Dados Pessoais), you have the right to: access the personal data we hold about you; request correction of inaccurate data; object to processing for advertising purposes; and not be subject to decisions based solely on automated processing that would significantly affect you. You may lodge a complaint with the Agência de Protecção de Dados (APD).
If you are in Canada (under PIPEDA, or Quebec's Law 25 if you are in Quebec), you have the right to: access the personal information we hold about you; request correction of inaccurate information; and withdraw consent, subject to legal or contractual restrictions. You may lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC), or, if you are in Quebec, the Commission d'accès à l'information (CAI).
If you are in Australia (under the Privacy Act 1988 and the Australian Privacy Principles), you have the right to: access the personal information we hold about you; request correction of inaccurate information; and know how your information is collected, used, and disclosed. You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
If you are in New Zealand (under the Privacy Act 2020), you have the right to: access the personal information we hold about you; request correction of inaccurate information; and be notified if a privacy breach affecting you is likely to cause you serious harm. You may lodge a complaint with the Office of the Privacy Commissioner (OPC).
If you are in South Africa (under POPIA), you have the right to: access the personal information we hold about you; request correction or deletion of inaccurate or unlawfully held information; and object to the processing of your information. You may lodge a complaint with the Information Regulator.
If you are in India, the Digital Personal Data Protection Act, 2023 ("DPDP Act") has been enacted but is coming into force in phases, with the core provisions governing individual rights and consent not yet fully in effect as of the date of this policy. To the extent the DPDP Act's data-principal rights are in force, we honor them; where they are not yet in force, we extend the same practical protections described in this policy as a matter of policy. You may direct inquiries about the DPDP Act's implementation to the Data Protection Board of India as its functions come online.
If you are a California resident (under CCPA/CPRA), you have the right to: know what personal information we collect, use, and disclose; delete personal information; correct inaccurate personal information; and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under CCPA/CPRA. You will not be discriminated against for exercising any of these rights.
If you are a resident of Virginia, Colorado, Connecticut, Utah, or another U.S. state with a comprehensive privacy law, you have similar rights to access, correct, delete, and port your personal information, and to opt out of targeted advertising, sale, or certain profiling — none of which we engage in.
If you are in a jurisdiction not listed above — including other Portuguese-speaking countries such as Mozambique, Cabo Verde, Guinea-Bissau, São Tomé and Príncipe, or East Timor — we are not aware of a comprehensive data protection law currently in force in your jurisdiction as of the date of this policy. We nonetheless extend to you, as a matter of policy rather than legal obligation in that jurisdiction, the same practical protections described in this policy: our zero-knowledge architecture, our limited data collection, and our commitment not to sell your information. Contact us using the details in Section 10 with any request, and we will address it in good faith even where local law does not yet require us to.
To exercise any of these rights, contact us using the details in Section 10. We will respond within the timeframe required by the law applicable to you.
8. Children's privacy
The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
9. Data Protection Contact
For privacy inquiries, data subject requests, or LGPD/GDPR-related questions, contact:
Data Protection Contact — Hathworth, Inc.
Email: [email protected]
10. Contact us
Hathworth, Inc.
913 N Market Street
Wilmington, DE 19801
United States
Email: [email protected] / [email protected]
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email or a prominent notice on the Service prior to taking effect. The "Last updated" date at the top of this policy reflects the most recent revision.