Key takeaway: VectorLedger is a self-hosted, on-premise product. Your financial data
never leaves your infrastructure and VectorGuard Labs has no access to it. The personal data described
in this policy relates solely to information you provide when visiting our website or contacting us
about licensing.
Section 1
Overview
VectorGuard Labs ("VectorGuard Labs," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, share, and protect personal information in connection with:
- The VectorLedger website at vectorguardlabs.com and any related subdomains;
- The VectorLedger software licensing and subscription management process;
- Any communications you initiate with VectorGuard Labs, including contact form submissions and email inquiries.
This policy does not apply to data you store within a VectorLedger instance. Because VectorLedger is a fully self-hosted product, any User Data — journal entries, account records, audit logs, encryption keys — resides exclusively on your own infrastructure. VectorGuard Labs cannot access, and does not process, that data.
By using our website or contacting us, you agree to the collection and use of information in accordance with this Privacy Policy.
Section 2
Data Controller
The data controller responsible for personal information collected through the VectorLedger website and licensing services is:
For all privacy-related inquiries, requests, or complaints, please contact us at engineering@vectorguardlabs.com. We aim to respond to all requests within 30 days.
Section 4
How We Use Information
We use the personal information we collect for the following purposes:
- Responding to inquiries: To reply to contact form submissions and email inquiries about licensing, pricing, and technical questions.
- Processing subscriptions: To issue your
license.json file, manage your billing relationship, send renewal reminders, and process payment transactions.
- Providing support: To assist with licensing issues, technical questions, and subscription management.
- Legal compliance: To comply with applicable laws, regulations, and legal processes, including responding to lawful requests from governmental authorities.
- Fraud prevention: To detect, investigate, and prevent fraudulent transactions and abuse of our services.
- Notifying of policy changes: To notify active Subscribers of material changes to our Terms & Conditions or this Privacy Policy, as required by those documents.
- Improving the website: Aggregated, anonymized analytics data (not linked to individuals) may be used to understand how visitors use the website and improve its content and usability.
We do not use your personal information for targeted advertising, behavioral profiling, or sale to third parties.
Section 5
Legal Basis for Processing
For individuals located in the European Economic Area (EEA), the United Kingdom, or other jurisdictions that require a legal basis for processing personal data, we rely on the following bases:
-
Contractual necessity (Article 6(1)(b) GDPR): Processing your name, email address, company name, and billing information is necessary to enter into and perform a Subscription agreement with you — including issuing your License File and managing billing.
-
Legitimate interests (Article 6(1)(f) GDPR): We process limited website analytics data based on our legitimate interest in understanding how our website is used, provided this interest is not overridden by your privacy rights. We also rely on legitimate interests to respond to pre-sale inquiries submitted via the contact form.
-
Legal obligation (Article 6(1)(c) GDPR): We may process personal data to comply with applicable laws, including financial record-keeping requirements and responses to lawful governmental requests.
-
Consent: Where we rely on consent for any processing activity (such as optional marketing communications, if introduced in future), we will seek your explicit consent and you may withdraw it at any time without affecting the lawfulness of prior processing.
Section 6
Data Sharing & Disclosure
We do not sell, rent, or trade your personal information. We may share personal information only in the following limited circumstances:
-
Payment processors: We use third-party payment processors to handle Subscription billing. These processors receive only the information necessary to process your payment (e.g., billing name and card details). They are contractually bound to use this data only for payment processing purposes and in compliance with applicable data protection law. VectorGuard Labs does not store complete payment card numbers.
-
Email delivery providers: We use a transactional email provider to deliver license files, receipts, and important account communications to your registered email address. These providers process your email address on our behalf under data processing agreements.
-
Legal requirements: We may disclose personal information if required to do so by law, court order, or valid legal process (e.g., a subpoena or government request). Where permitted, we will attempt to notify you before complying with such a request.
-
Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal information may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on our website at least 30 days before such a transfer and before your data becomes subject to a different privacy policy.
-
Protection of rights: We may disclose personal information when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of VectorGuard Labs, our customers, or others.
All third parties with whom we share personal data are required to maintain appropriate technical and organizational security measures and to use the data only for the specified purpose.
Section 7
Self-Hosted Architecture & Your Data
Your VectorLedger data belongs to you and stays with you. VectorGuard Labs has no access to it — by design.
VectorLedger is architected as a fully self-hosted, on-premise product. All User Data — including financial journal entries, account records, cryptographic keys, audit logs, and compliance reports — is stored exclusively within your own infrastructure.
The VectorLedger binary does not transmit any operational data, telemetry, usage statistics, or diagnostic information to VectorGuard Labs or any third party. There are no background network connections initiated by the software during normal operation.
License file validation is performed entirely offline. The binary contains an embedded public key that it uses to verify the cryptographic signature on your license.json at startup. No network request is made to VectorGuard Labs during this process.
As a result, VectorGuard Labs acts solely as a controller of personal information you provide for licensing and communication purposes (described in Section 3.1), and is not a processor of your VectorLedger User Data.
Section 8
Cookies & Analytics
8.1 What We Use
The VectorLedger website may use cookies or similar lightweight technologies for the following limited purposes:
- Essential cookies: Strictly necessary to operate the website (e.g., session management for any authenticated pages). These cannot be disabled without breaking site functionality.
- Analytics cookies: Aggregate, anonymized page view and session data to understand how visitors navigate the site. We do not use Google Analytics or similar advertising-network analytics tools. Where analytics are used, data is aggregated and not linked to individual identities.
8.2 What We Do Not Use
- Cross-site tracking cookies or advertising pixels;
- Social media tracking or retargeting scripts;
- Fingerprinting technologies;
- Persistent session identifiers linked to individual behavioral profiles.
8.3 Managing Cookies
You can control or delete cookies through your browser settings. Disabling all cookies may affect the functionality of interactive elements on the site. For guidance on managing cookies, consult your browser's help documentation.
Section 9
Data Retention
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law:
-
Contact form submissions: Retained for up to 2 years from the date of submission, to allow us to respond to follow-up inquiries and maintain a record of pre-sales communications. Submissions that do not result in a licensing relationship may be deleted earlier.
-
Subscription and billing records: Retained for 7 years from the end of the subscription relationship, or longer if required by applicable financial record-keeping law.
-
Email correspondence: Retained for up to 3 years from the date of last communication, unless a longer period is required by legal obligation or is relevant to an ongoing dispute.
-
Website analytics data: Aggregated analytics data (not linked to individuals) may be retained indefinitely. Any session-level data linked to a browser or device is deleted or anonymized within 90 days.
When data is no longer required, it is securely deleted or anonymized. You may request early deletion of your data subject to the conditions described in Section 12.
Section 10
Security Measures
VectorGuard Labs implements appropriate technical and organizational security measures designed to protect personal information against accidental loss, unauthorized access, disclosure, alteration, and destruction. These measures include:
- TLS encryption for all data transmitted between your browser and our website;
- Access controls limiting personal data access to personnel who require it for their job function;
- Secure storage of personal data with encryption at rest where applicable;
- Third-party service providers selected based on their security practices and subject to contractual data protection obligations;
- Periodic review of our data handling practices and security controls.
No transmission over the internet is 100% secure. While we take all reasonable steps to protect your personal information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, VectorGuard Labs will notify affected individuals and the relevant supervisory authority as required by applicable law.
Section 11
International Transfers
VectorGuard Labs is incorporated in the United States. If you are located outside the United States and provide personal information to us (for example, by submitting a contact form or purchasing a Subscription), your information will be transferred to and processed in the United States.
For individuals in the EEA, the United Kingdom, or Switzerland, we ensure that international transfers are subject to appropriate safeguards as required by applicable data protection law. These safeguards may include:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- Adequacy decisions where applicable;
- Other transfer mechanisms recognized under GDPR or the UK GDPR.
You may request information about the specific transfer mechanisms we use by contacting us at engineering@vectorguardlabs.com.
Section 12
Your Rights
Depending on your location, you may have the following rights regarding your personal information:
-
Right of access: You may request a copy of the personal information we hold about you.
-
Right to rectification: You may request correction of inaccurate or incomplete personal information.
-
Right to erasure ("right to be forgotten"): You may request deletion of your personal information where it is no longer necessary for the purpose it was collected, where you withdraw consent (if processing was based on consent), or in other circumstances provided by law.
-
Right to restriction of processing: You may request that we restrict processing of your personal information in certain circumstances, for example while a complaint is being resolved.
-
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request a copy of your personal information in a structured, machine-readable format.
-
Right to object: You may object to processing based on legitimate interests. We will comply unless we have compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.
-
Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
-
Right to lodge a complaint: If you are in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority.
To exercise any of the above rights, please contact us at engineering@vectorguardlabs.com. We will respond within 30 days. We may need to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.
Note on erasure requests and legal obligations: We may be required to retain certain personal information to satisfy legal obligations (e.g., financial record-keeping laws) even where you request deletion. In such cases, we will inform you of the legal basis for retention and, where possible, restrict further processing of the retained data.
Section 13
California Residents (CCPA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights with respect to your personal information:
- Right to know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collection, and the categories of third parties with whom we share it.
- Right to delete: You have the right to request deletion of personal information we have collected about you, subject to certain exceptions.
- Right to correct: You have the right to request correction of inaccurate personal information.
- Right to opt out of sale or sharing: VectorGuard Labs does not sell personal information and does not share it for cross-context behavioral advertising. There is nothing to opt out of in this respect.
- Right to non-discrimination: We will not discriminate against you for exercising any of these rights.
The categories of personal information we collect are described in Section 3. To submit a verifiable consumer request, contact us at engineering@vectorguardlabs.com. We will respond within 45 days as required by the CCPA. Authorized agents may submit requests on your behalf provided they present a signed authorization or power of attorney.
Section 14
Children's Privacy
VectorLedger and the VectorLedger website are not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at engineering@vectorguardlabs.com and we will take prompt steps to delete that information.
Section 15
Third-Party Links
The VectorLedger website may contain links to third-party websites, repositories (such as the VectorLedger GitHub repository), or resources. These links are provided for convenience only. VectorGuard Labs does not control these third-party sites and is not responsible for their content, privacy practices, or terms of use. We encourage you to review the privacy policies of any third-party sites you visit.
Clicking a link to a third-party site leaves our website and any information you provide to that third party is subject to their privacy policy, not ours.
Section 16
Changes to This Policy
VectorGuard Labs may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make material changes, we will:
- Update the "Last updated" date at the top of this page;
- Notify active Subscribers by email at least 14 days before the changes take effect;
- Post a notice on the VectorLedger website.
Your continued use of the VectorLedger website or services after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with the revised policy, please discontinue use of the website and contact us to request deletion of your personal data.
For changes required by law or to address urgent security matters, the notice period may be shorter or we may need to apply changes immediately. We will provide as much notice as is reasonably practicable in such circumstances.