Privacy Policy

This Privacy Policy explains how DURU LLC ("DuruVault", "we", "us") collects, uses, shares, and protects information when you use DuruVault at https://www.duruny.com. DuruVault is a secure digital vault for storing, organizing, protecting, sharing, and verifying important personal, family, and business documents. We aim to be transparent and to collect only what we need to run the Service.

1. Information We Collect

We collect information you provide directly, and information generated automatically as you use DuruVault.

2. Documents, Metadata & Identity

• Documents you upload are stored so you can retrieve, organize, and share them.
• Document metadata we store includes file name, size, type, your chosen category, folder, tags, description, and any expiration date you add.
• Payment card details are handled by our payment processor — DuruVault does not store your full card number.
• For optional identity verification, government ID numbers (e.g., SSN, NIN) are handled by the verification provider's flow and are not stored by DuruVault; we retain only a pass/fail status and a reference.

3. How We Use Information

We use information as reasonably necessary to:

• Provide and operate DuruVault, and store, retrieve, organize, and search your documents
• Enable document sharing and DuruVerify
• Send expiration and reminder notifications you have set up
• Provide optional AI and automated document features you choose to use
• Maintain account security and detect and prevent fraud and abuse
• Troubleshoot problems and provide customer support
• Process subscriptions and payments
• Improve the Service and comply with applicable law
• Protect users, DuruVault, and the company

We do not claim broad or unlimited rights over your documents. Your documents are yours.

4. AI and Automated Processing

DuruVault offers optional AI-assisted features. These are OFF by default and run only when you enable intelligent features in Settings and, where applicable, give consent for a specific document.

When you use an AI feature, we may process the relevant portions of your documents and associated information necessary to provide it — for example your question or instruction, the relevant document(s), extracted information, and account or feature context needed to respond.

• Document recognition, classification, and automatic categorization
• Information extraction and expiration-date detection
• Document search, summarization, and question answering ("Ask Your Vault")
• Organization recommendations and automated reminders

See our AI Terms & AI Privacy Disclosure for details. DuruVault does not use your documents to train our own AI models. AI features rely on a third-party AI provider that processes your content to generate the requested response; that provider's data handling, retention, and any model-training practices are governed by its agreements. [FOR CONFIRMATION: provider identity and its data-use/retention/training terms to be confirmed by the company before publication.]

5. Third-Party Technology Providers

We use trusted third-party providers to deliver DuruVault. Information may be transmitted to or processed by them only as reasonably necessary to provide the requested functionality. These support functions such as:

• Cloud infrastructure and document/object storage
• Artificial intelligence, machine learning, and document processing (incl. optical character recognition)
• Payment processing
• Email delivery
• Identity verification (optional feature)
• Product analytics

[FOR CONFIRMATION: a named list of subprocessors and their locations to be finalized with counsel before publication.]

6. Human Access to Your Documents

We do not routinely review your private documents for ordinary customer-service purposes. Limited access may occur only when reasonably necessary for:

• Security, fraud, and abuse investigations
• Technical troubleshooting and customer support (typically at your request)
• Legal compliance and protecting users or the Service

Where technically and legally feasible, such access is limited to the information reasonably necessary for the purpose. Personnel with infrastructure-level access could technically reach stored data; we limit and control such access.

7. Document Sharing & DuruVerify

When you share a document you create a link that can be view-only or downloadable, optionally password-protected, and optionally set to expire; you can revoke it at any time.

• A recipient of a share link can see the document name, type, and size, and can view or download the document itself (subject to any password, permission, and expiry). For password-protected links, basic details (name, type, size) may be shown before the password is entered.
• A DuruVerify record creates a verification link/QR code that shows only minimal information — a verification ID, status, document type/category, an optional title, a masked owner reference, timestamps, and an integrity check result. It does not expose the underlying file.
• DuruVerify distinguishes records self-attested by the vault owner ("Verified by DuruVault") from records attested by an approved institution. DuruVault does not independently certify government-issued documents unless an approved institution has attested to them.

8. Security

Security is central to DuruVault. Current protections include:

• Encryption of data in transit (TLS)
• Multiple authentication options: password, Google sign-in, email one-time codes, authenticator apps, and passkeys
• Session and device controls, including the ability to sign out other sessions
• Strict per-user isolation so one account cannot access another's data
• Audit logging of account activity
• Controlled document sharing and uploaded-file validation

Documents are stored with our cloud storage provider and served only through short-lived, authenticated requests — never permanent public URLs. No internet-connected system or cloud service can guarantee absolute security. [FOR CONFIRMATION: at-rest encryption is a function of our storage provider and is not independently implemented by DuruVault; wording to be confirmed with counsel/provider.]

9. Data Retention & Deletion

• When you delete a document, it is removed from your active vault immediately. Copies may persist temporarily in storage or backups until routine purging completes.
• When you delete your account, we remove your personal data and stored documents; certain records may be retained where necessary for legal, security, fraud-prevention, or accounting purposes.
• We retain information for as long as needed to provide the Service and for the legitimate and legal purposes described here.

[FOR CONFIRMATION: specific retention periods and backup-purge timelines are not yet finalized and must be confirmed before publication.]

10. Your Privacy Choices

Depending on your account, you can:

• Turn optional AI/intelligent features on or off in Settings
• Delete individual documents at any time
• Export a copy of your data and delete your account from Settings
• Create, password-protect, expire, and revoke share links and DuruVerify records
• Enable two-factor authentication and manage active sessions

11. Cookies & Analytics

DuruVault uses a secure, httpOnly session cookie that is essential to keep you signed in, plus security-related technologies. We also use product analytics that may include session recording of in-app activity to understand and improve the Service. We do not use advertising trackers. See our Cookie Policy for details.

12. Children's Privacy

DuruVault is intended for adults and is not directed to children. We do not knowingly collect information from children below the minimum age required by our Terms of Service and applicable law. [FOR CONFIRMATION: the minimum age must match the age stated in the Terms of Service.]

13. International Users

DuruVault supports users in multiple countries (including the United States and Nigeria) and prices in USD and NGN. Your information may be processed in the United States and other locations where we or our providers operate. [FOR CONFIRMATION: cross-border transfer mechanisms and any applicable-law obligations to be confirmed with counsel. We do not claim compliance with any specific privacy law without legal confirmation.]

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, by notice within the Service.

15. Contact Us

DURU LLC, New York, United States.

• Legal Contact: MORGAN LAW
• Privacy Contact: MORGANLAW@LAW.COM