Privacy Policy

This Privacy Policy describes how DURU LLC, doing business as DuruVault ("DuruVault", "DURU", "we", "us", or "our") collects, uses, stores, processes, discloses, transfers, protects, and deletes information in connection with DuruVault websites, applications, digital vaults, document-management services, DuruVerify, AI-assisted features, APIs, communications, and related services (the "Services").

It is intended to be read together with DuruVault's Terms of Use, Cookie Policy, Security Policy, Data Deletion Policy, DuruVerify Terms, AI Terms & AI Privacy Disclosure, applicable service-specific agreements, and other notices presented at collection. Where applicable law provides greater protection or additional rights, that law controls to the extent required.

1. Who We Are

DuruVault is operated by DURU LLC, New York, United States. DuruVault provides a digital platform to store, organize, manage, protect, share, and — where available — verify personal, family, professional, business, and other documents and information, including identity, document, business, and address verification through DuruVerify.

2. Scope

This Policy applies to information processed through DuruVault websites, accounts, digital vaults, document storage and sharing, DuruVerify, AI-assisted features, APIs, customer support, communications, security systems, analytics, subscriptions and payments, applications, and other Services that link to it. It does not necessarily apply to third-party sites or services DuruVault does not control.

3. Information We Collect

Depending on how you use DuruVault, we may collect:

• Account information: name, email, username, password credentials (in protected form), phone (if provided), preferences, authentication/MFA/passkey information, account status, organization and subscription information.
• Documents & user content: the files and information you upload or create — e.g. IDs, certificates, contracts, business/financial/educational/employment/immigration/legal/insurance/family/property records, photographs, scans — plus metadata, categories, folders, tags, descriptions, expiration dates, and information contained within documents.

Except as described here, DuruVault does not claim ownership of your documents; you retain your rights, subject to the licenses necessary to operate the Services.

4. Sensitive Personal Information

Because DuruVault is designed for important documents, you may submit particularly sensitive information (government ID, financial, biometric, health-related, legal, immigration, employment, educational, information concerning minors, credentials, addresses, dates of birth, ID numbers, and other sensitive data). DuruVault does not require you to upload sensitive information unless a feature specifically requires it — consider whether a document or feature is appropriate before submitting.

5. Information Collected Automatically

When you use the Services we may automatically collect IP address, browser/device type, OS, session and login activity, timestamps, approximate location derived from technical information, security and authentication events, device identifiers, usage/crash/performance information, audit-log information, storage usage, and referral information — used for security, authentication, fraud prevention, troubleshooting, analytics, performance monitoring, and improvement.

6. Cookies and Analytics

We use cookies, session, security, analytics, and similar technologies to authenticate users, maintain secure sessions, protect accounts, prevent fraud, remember preferences, understand usage, measure performance, diagnose problems, and improve the Services. Where session recording is used, we take reasonable measures to prevent passwords, credentials, and document contents from being unnecessarily captured. See the Cookie Policy.

7. How We Use Information

We process information to deliver the Services (operate accounts; store/retrieve/organize/search documents; enable sharing; provide DuruVerify and AI features; support; process subscriptions); for security (authenticate, protect accounts, detect unauthorized access/fraud/abuse, investigate incidents, maintain audit records); for communications (account, security, service, reminder, support, and legally required messages); for business operations (billing, analytics, troubleshooting, performance, improvement, infrastructure); and for legal and compliance purposes.

8. Legal Bases for Processing

Where a legal basis is required, we may rely on performance of a contract, consent, legitimate interests, compliance with legal obligations, protection of vital interests, establishment/exercise/defense of legal claims, or other lawful bases recognized by applicable law. Where consent is required, we seek it in accordance with applicable law.

9. DuruVerify

DuruVerify may provide verification involving identity, documents, addresses, businesses, institutions, records, document integrity, and verification status, and may involve third-party verification providers to whom information may be transmitted as necessary to perform the requested verification.

10. Third-Party Verification Providers

Depending on the feature, we may use external providers for identity, document, business, or address verification, fraud detection, biometric verification, sanctions screening, and document processing. A provider may process information under its own privacy policy and contractual obligations. Where legally required, we will provide additional information about applicable providers. Not every provider is controlled by DuruVault.

11. DuruVerify Does Not Guarantee Authenticity

Unless expressly stated for a specific service, a verification status does not guarantee that a document is genuine in every respect, that information supplied is truthful, that an individual is who they claim, that a business will continue to exist, that information remains accurate, that a government issued a document, that a document remains valid, that a person has authority to act, that a transaction is safe, or that a user is suitable for a purpose. Results are limited to the scope of the verification actually performed; users remain responsible for independent due diligence.

12. Third-Party Service Providers

We may use third-party providers for cloud infrastructure, storage, authentication, payments, email, SMS, identity verification, document processing, OCR, AI, analytics, security, monitoring, support, and fraud prevention. They may process information on our behalf; we seek to select appropriate providers and, where appropriate, enter arrangements addressing confidentiality, security, privacy, and data processing.

12a. Subprocessors

The providers below process personal information on DuruVault's behalf to deliver specific functionality. This list may change as the Services evolve; we will update it where required.

• Provider

  Stripe
  Purpose

  Payments & subscriptions
  Data processed

  Billing and payment status (DuruVault does not store full card numbers)
  Region

  Provider-managed / US where applicable
• Provider

  MongoDB
  Purpose

  Primary database
  Data processed

  Account data and document metadata
  Region

  Provider-managed / US where applicable
• Provider

  Emergent-managed AI (OpenAI / Anthropic / Google)
  Purpose

  AI features (OCR, extraction, search, assistant)
  Data processed

  Content and prompts you submit to AI features
  Region

  Provider-managed / US where applicable
• Provider

  Emergent-managed email (Resend)
  Purpose

  Transactional email
  Data processed

  Email address and message content
  Region

  Provider-managed / US where applicable
• Provider

  Object storage
  Purpose

  Document and file storage
  Data processed

  Documents and files you upload
  Region

  Provider-managed / US where applicable
• Provider

  Dojah
  Purpose

  Identity verification (currently sandbox)
  Data processed

  Identity data you submit to a verification check
  Region

  Provider-managed

13. Payment Information

Payment information for subscriptions or paid Services may be processed by third-party payment processors. Unless expressly stated, DuruVault does not intentionally store complete payment-card numbers. Payment providers process information under their own notices and terms.

14. AI-Assisted Features

DuruVault may provide optional AI-assisted functionality, including document classification, OCR, information extraction, summarization, search, question answering, organization assistance, expiration detection, verification assistance, fraud detection, security analysis, and support. AI features may process information necessary to provide the requested functionality.

15. AI and User Content

DuruVault does not intentionally use customer documents to train its own general-purpose AI models unless the applicable service terms expressly state otherwise. Where third-party AI services are used, the provider may process submitted information according to its contractual terms and technical configuration. We will not make representations about a provider's data practices inconsistent with the applicable provider agreement, and will reflect material changes in disclosures where required.

16. AI Limitations

AI-generated information may be inaccurate, incomplete, outdated, misunderstood, or incorrectly classified or summarized, and is not a substitute for legal, medical, financial, or immigration advice, professional or governmental verification, or professional judgment. You are responsible for independently reviewing important AI output before relying on it.

17. Human Access

We do not routinely access private documents for ordinary purposes. Limited access may occur when reasonably necessary for support, technical troubleshooting, security/fraud/abuse investigations, verification, legal compliance, or protection of users and the Services — limited according to applicable permissions and the principle of least privilege.

18. Document Sharing

Sharing may include view-only or download access, password protection, expiration, revocation, access controls, and audit information.

Important: when you intentionally share a document, the recipient may view, download, copy, photograph, screenshot, retain, or redistribute it. DuruVault cannot control conduct outside its systems — verify recipients before sharing sensitive information.

19. Security

We maintain administrative, technical, and organizational safeguards designed to protect information, which may include TLS encryption, authentication controls, MFA, passkeys, session and authorization controls, per-user isolation, secure storage, access controls, file validation, audit logging, security monitoring, controlled sharing, and incident response. Controls may change as technology and threats evolve.

20. No Absolute Security Guarantee

No internet, cloud, software, storage, communication, or information system can be guaranteed completely secure. DuruVault does not represent that the Services are immune from cyberattacks, unauthorized access, malware, data loss, interruption, vulnerabilities, human error, or third-party failures. Our representations are limited to the safeguards actually implemented and maintained; nothing here is a guarantee of absolute security.

21. User Security Responsibilities

You are responsible for maintaining credentials, using strong passwords, protecting authentication devices, enabling available security features, reviewing active sessions, promptly reporting suspected unauthorized access, ensuring information you submit is lawful and authorized, and reviewing recipients before sharing. You must not share passwords, circumvent access controls, access another's account, upload malicious files, use DuruVault unlawfully, impersonate others, or submit information without authorization.

22. Data Minimization

We seek to collect and process only information reasonably necessary for the purposes described here. You should not upload information unnecessary for your intended use of the Services.

23. Data Retention

We retain information for periods reasonably necessary to provide the Services, maintain accounts, satisfy legal obligations, resolve disputes, enforce agreements, prevent fraud, investigate incidents, maintain legitimate business records, and comply with regulatory requirements. Retention periods vary by information type, purpose, account status, and legal, security, contractual, and backup considerations.

24. Deletion

You may delete eligible information via account functionality or by contacting us. Deletion from active systems may not immediately remove information from backups, disaster-recovery systems, security logs, fraud-prevention systems, legal or accounting records, third-party systems, or other systems where retention is permitted or required. We take reasonable steps to process valid requests consistent with law. See the Data Deletion Policy.

25. Legal Retention Exception

We may retain information when reasonably necessary to comply with law, court orders, or governmental requests; establish or defend legal claims; investigate fraud, abuse, or cybersecurity incidents; protect users or DuruVault; or maintain required business records. Such information is not necessarily deleted solely because an account is closed.

26. Information Sharing

We may disclose information to service providers (to provide the Services); at your direction (e.g. when you share a document); for legal compliance; for security (fraud/abuse/incident investigation); for legal claims; and during corporate transactions (merger, acquisition, financing, restructuring, sale of assets, bankruptcy, reorganization) — any transfer remaining subject to applicable law and contractual obligations.

27. No Sale of Document Content for Advertising

DuruVault does not sell users' private documents for advertising. We may use limited technical, analytics, or business information to operate and improve the Services as described here. Where applicable law defines certain disclosures or transfers as a "sale" or "sharing", we will comply with the applicable requirements.

28. International Data Processing

We may serve users in multiple jurisdictions, so information may be processed in the United States, Nigeria, countries where our service providers operate, and other jurisdictions necessary to provide the Services. International transfers use mechanisms required or recognized by applicable law where such mechanisms apply.

29. Privacy Rights

Depending on your location, you may have rights to know/access, correct, delete, port, object, restrict processing, withdraw consent, opt out of certain processing, exercise rights relating to automated decision-making, appeal certain decisions, and lodge a complaint with a competent regulator. Rights vary by jurisdiction, and we may need to verify identity before fulfilling certain requests.

30. United States State Privacy Laws

We may be subject to state privacy laws depending on residency, our activities, revenue, consumer numbers, processing activities, and statutory thresholds. Where applicable, we will provide legally required rights and notices. We do not claim that every state privacy law applies to every user or activity.

31. New York Data Security

Because DuruVault is operated by a New York entity and may process information about New York residents, we maintain security practices designed to address applicable New York data-security requirements, which may include administrative, technical, and physical safeguards, risk assessments, service-provider controls, access controls, security testing, incident response, and data disposal.

32. California Users

If applicable California privacy law applies, California residents may have additional rights concerning access, deletion, correction, portability, certain disclosures, sale/sharing opt-outs, sensitive personal information, and non-discrimination. We will provide additional California-specific notices where legally required.

33. European and UK Users

Where GDPR or comparable European/UK laws apply, we process personal information consistent with lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, and accountability. Where required, we may provide additional information on controller/processor roles, legal bases, international transfers, data-subject rights, supervisory authorities, and automated decision-making.

34. Nigerian Users

Where Nigerian data-protection law applies, we process personal information consistent with applicable Nigerian privacy and data-protection requirements, providing additional jurisdiction-specific disclosures where required.

35. Children's Privacy

You must be at least 18 years old to create and use a DuruVault account. DuruVault is intended for adults and is not designed to knowingly collect children's information in violation of applicable law. Where children's information is processed, we apply applicable safeguards and, where legally required, obtain parental/guardian consent. If we learn information was collected from a child where not permitted, we may take reasonable steps to delete or restrict it.

36. Health Information

DuruVault is not a HIPAA-covered entity merely because you may store health-related documents; storing medical documents does not create a HIPAA-covered relationship. Other federal or state privacy laws may apply. We evaluate our obligations based on the actual services and processing we perform.

37. Identity and Biometric Information

Where DuruVerify or another feature processes identity or biometric information, additional notices, consents, contractual safeguards, retention limitations, or jurisdiction-specific requirements may apply. We process such information only as reasonably necessary and consistent with applicable law; a third-party provider's terms and practices may also apply.

38. Information Security Incidents

If we discover a security incident involving personal information, we will assess it and take reasonable steps appropriate to the circumstances. Where applicable law requires notification to affected individuals, regulators, authorities, law enforcement, or others, we will notify within the time and manner required. We do not promise a particular outcome or that unauthorized access can never occur.

39. Third-Party Links

The Services may link to third-party websites or services whose privacy practices we do not control. Review their privacy policies before providing information.

40. Business Transfers

If DuruVault or substantially all of its assets are acquired, reorganized, merged, financed, or transferred, information may be transferred as part of the transaction, subject to applicable law.

41. Legal Requests

We may disclose information when legally required or reasonably necessary to respond to subpoenas, court orders, lawful governmental requests, or legal processes; to protect rights, property, or users; or to investigate fraud or cybersecurity incidents. Where legally permitted, we may seek to notify affected users.

42. Account Termination

When an account is terminated or deleted, access may be disabled, documents may become inaccessible, information may enter the deletion process, some information may remain temporarily in backups, and certain information may be retained for legal, security, fraud-prevention, accounting, or other lawful purposes. Export information you wish to keep before deleting your account.

43. Limitation of Privacy Representations

We describe our practices in good faith based on the Services and technology actually implemented. We do not guarantee uninterrupted availability, complete accuracy or security, absence of vulnerabilities or unauthorized access, uninterrupted third-party services, permanent availability of any feature, permanent retention of any information, or that providers will never experience an incident. Nothing here limits any right that cannot lawfully be limited.

44. User Indemnification and Responsibility

To the maximum extent permitted by law and subject to the Terms of Use, you may be responsible for claims, losses, liabilities, damages, or expenses arising from unauthorized use of your account, misuse of the Services, unlawful content you upload, infringement of others' rights, unauthorized sharing of others' information, or violation of law or DuruVault agreements. The precise scope is governed by the Terms of Use and applicable law.

45. No Waiver of Non-Waivable Rights

Nothing here is intended to waive rights that cannot legally be waived, eliminate statutory privacy rights or breach-notification duties, authorize unlawful processing, exclude liability that cannot be excluded, or prevent a regulator from exercising lawful authority. Any limitation applies only to the maximum extent permitted by law.

46. Governing Documents

This Policy should be interpreted together with the Terms of Use, Security Policy, Cookie Policy, Data Deletion Policy, DuruVerify terms, AI Terms & AI Privacy Disclosure, subscription/enterprise agreements, data-processing agreements, and other applicable notices. If a specific service-specific notice conflicts, the more specific notice controls to the extent permitted by law.

47. Changes to This Privacy Policy

We may update this Policy to reflect changes in the Services, technology, business operations, third-party providers, applicable law, regulatory developments, or security improvements. The updated version will identify the effective date. Where law requires notice or consent for material changes, we will provide it. We will not rely solely on an undisclosed retroactive change to materially expand data practices where law requires additional notice or consent.

48. Privacy Requests

For privacy-related requests, contact DURU LLC / DuruVault, New York, United States — privacy@duruvault.com. Suggested subject lines: PRIVACY REQUEST, DATA ACCESS REQUEST, DATA DELETION REQUEST, DATA CORRECTION REQUEST, PRIVACY RIGHTS REQUEST. Do not send passwords, authentication codes, private keys, or unnecessary sensitive information through ordinary email.

49. Verification of Privacy Requests

To protect your information, we may require reasonable verification before processing certain requests; verification information is used to authenticate the request and protect against unauthorized disclosure or deletion.

50. No Discrimination for Exercising Privacy Rights

Where required by applicable law, we will not unlawfully discriminate against users for exercising legally protected privacy rights.

51. Severability

If any provision is unlawful, invalid, or unenforceable, it will be interpreted or modified to the minimum extent necessary to make it enforceable where legally permissible; the remaining provisions remain in effect.

52. No Third-Party Beneficiaries

Except where expressly required by applicable law, this Policy is not intended to create rights for persons who are not parties to the applicable agreement governing use of the Services.

53. Entire Privacy Disclosure

This Policy, together with the other applicable DuruVault privacy disclosures referenced here, describes our privacy practices as of the effective date. No employee, contractor, representative, or marketing statement may make privacy representations materially inconsistent with this Policy unless properly authorized and legally approved.

54. Contact

DURU LLC · DuruVault · New York, United States.

• Privacy: privacy@duruvault.com
• Security: security@duruvault.com

Final notice: DuruVault provides secure digital storage, organization, sharing, and verification, but no digital service can guarantee absolute security, availability, or accuracy. You remain responsible for determining whether DuruVault is appropriate for your documents, transactions, legal, regulatory, and business needs. We maintain reasonable safeguards appropriate to the information and applicable law, and will continue to improve our practices as the Services evolve.