Privacy Policy
This English translation is provided for convenience. If it differs from the Italian version, the Italian version prevails, without affecting any mandatory rights you have as a consumer.
01Data controller
The data controller is the sole professional who offers Vyloc, based at via Giuseppe Sciuti 112, 90144 Palermo, Italy, VAT no. 07131360823. For any request you can contact us at vyloc.app@icloud.com.
02Data we cannot see
Passwords, notes, cards, 2FA codes and all other vault contents are encrypted locally with AES-256-GCM before being synced. We don't know and don't store your Master Password, so we can't decrypt this data or hand it over to anyone.
03Data we process
The email address and name that Apple or Google share with us when you sign in (with Apple's “Hide My Email” we only receive a forwarding address), the subscription data described under “Payments”, and the technical information needed for syncing, such as the modification dates of encrypted items. If you write to us through the contact form, your name (optional), email, topic and message reach us by email and we use them only to reply to you: the site doesn't store them; to limit abuse it keeps a non-reversible fingerprint of your IP address in memory for one hour. If you open a support ticket from Vyloc on the web, the topic, subject and messages (yours and support's) stay on our servers without the vault's encryption, because support has to read them: for this reason, never write passwords or your Master Password in them. Replies also reach you at your account's email address.
04Browser extensions
Vyloc's extensions for Safari and Chrome read the address of the open page and the login, 2FA code and card fields, in order to recognize the site and fill them in, and after a form filled in by Vyloc is submitted they check whether it leaves the page, to tell if the sign-in worked. This data only travels between the extension and the Vyloc app on your device: the extension doesn't send it to anyone in the clear. The only thing that leaves the device is the sign-in alert described below, encrypted so that only your devices can read it. The logins you choose to save go into the vault and are encrypted and synced like all other items. We don't record your browsing, we don't use this data for advertising and we don't sell it. The use of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
05Sign-in alerts
When you sign in to a site with the Vyloc extension, use a passkey or fill in a password with AutoFill, your devices receive a notification with the item's name, the site or app and the device it came from. These details are encrypted on the device with a key derived from your Vault Key, which we don't know, and they all have the same length: neither we nor the notification services can read them. We only see that an alert was sent from your account at that moment, and we don't keep it. To deliver it we store, for each device, a random identifier with a fingerprint of a code that authenticates it, a Firebase Cloud Messaging notification identifier, the device type and your notification choices, which are deleted when you sign out or when you delete your account. The notification identifier alone is also deleted when you turn off both alerts and Vyloc news on that device. In Settings ▸ Sign-in alerts you choose whether a device receives alerts: those sent from it keep reaching your other devices.
06Payments
If you subscribe from the App Store, Apple handles the payment and tells us the plan, status, purchase, renewal and trial-end dates, store country and amount. If you subscribe on the web, Stripe handles the payment: you enter your card details on its payment page (Checkout) and we never receive the full card number or the security code. We give Stripe your account email and a code that identifies the account; you enter your name, billing address and any VAT number at Checkout, and Stripe keeps them in our account, where we use them only to manage the subscription, refunds and invoicing. Our servers receive the customer and subscription identifiers on Stripe, the subscription's plan, status and dates, the billing country and the amounts paid, with any tax. If you subscribe from the Android app, Google Play handles the payment under its own terms: your card details and Google account data stay with Google. We give Google only a non-reversible fingerprint of your account code, which links the purchase to your Vyloc account; Google tells us the purchase and order identifiers, the subscription's plan, status and dates, the country and the amounts paid, with tax and fee.
07Third-party services
We use Google Firebase for sign-in, sync, notifications and hosting, Apple's App Store for subscriptions bought in the apps for iPhone, iPad and Mac, Google Play (Google Ireland Limited) for those bought in the Android app, Stripe for those bought on the web, iCloud Mail (Apple) to receive contact form messages and to send emails with Vyloc news. For web payments the provider is Stripe Payments Europe, Limited (Ireland), which processes data partly on our behalf and partly as an independent controller, for example to prevent fraud and comply with anti-money-laundering obligations, under its own policy (stripe.com/privacy). Stripe may transfer this data to Stripe, Inc., in the United States: the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, in which Stripe participates, and on the standard contractual clauses approved by the Commission. In the apps, automatic service logos are downloaded from Logo.dev by sending the name of the saved service: this option is on by default and you can turn it off in the settings, while logos you upload yourself stay encrypted in the vault.
08Purposes and legal basis
We process data to provide the service, sync the vault and manage subscriptions and payments (performance of a contract), for invoicing and accounting (legal obligation) and for the security of the infrastructure (legitimate interest). We may write to your account's email address from vyloc.app@icloud.com with Vyloc news and offers (legitimate interest): every email has a link to stop receiving them, and you can object at any time, free of charge. The same news reaches you as a notification only if you turn on “Vyloc news” in the app settings. We don't record whether you open these emails or follow their links, and we don't use your data for other companies' advertising or for profiling.
09Retention and location
The encrypted vault and subscription data are stored on servers in the European Union for as long as the account is active. You can delete your account at any time from the settings of the app or the web: the encrypted vault and the account are deleted from the server immediately, the link with Apple is revoked, a subscription bought on the web or on Google Play is canceled, and your other devices delete their copy the next time they connect. If you prefer, write to us at vyloc.app@icloud.com and we'll do it within 30 days. We keep only the payment data the law requires us to keep for invoicing, the data described under “Payments”, for 10 years and no longer linked to your account (Stripe keeps its own for as long as the law requires), and, in anonymous form, the list of complimentary periods or suspensions decided by support. Your choice not to receive news by email stays for as long as the account is active. Support tickets stay for as long as the account is active: when you delete it they are deleted with everything else, immediately if you do it from the web, by the automatic check that runs every night if you do it from the app; on request we delete them at any time.
10Your rights
Under the GDPR you can request access, rectification, erasure, restriction and portability, and you can object to processing. You can export the vault and delete the account at any time from the app. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).
Want to delete your account? Here's how, and which data stays.