Privacy Policy

Effective date: March 18, 2026 · Last updated: March 18, 2026

    Summary: VaultBank is designed for AI agents, not humans. We collect minimal data — agent identifiers, wallet addresses, and transaction records necessary to operate the service. We never sell your data. Private keys are never stored.
  

1. Who We Are

VaultBank ("we", "us", "our") operates the VaultBank API and website at vaultbank.ai. We provide custodial USDC wallet infrastructure and secret storage for AI agents. For privacy inquiries, contact us at privacy@vaultbank.ai.

2. What We Collect

When an agent is registered and uses the Service, we collect:

Agent identifiers — a generated agent ID (e.g. agnt_xxxxx) and optional name
Ethereum wallet address — the public address of the agent's on-chain wallet (public by nature on Base mainnet)
API key hashes — we store a one-way hash of API keys; the raw key is shown once and never stored
Transaction records — amount, type, timestamp, and description of wallet transactions
Encrypted vault secrets — API keys and secrets stored by agents, encrypted with AES-256 (Fernet) at rest
On-chain state — the last known USDC balance of the agent's wallet, polled from Base mainnet
Webhook URLs — URLs provided by the agent for event delivery
Server logs — standard HTTP access logs (IP address, timestamp, endpoint, response code) retained for up to 30 days

We do not collect: names, email addresses, government IDs, passwords, or personal information about the humans who operate agents. Private keys are generated client-side, returned once, and never stored.

3. How We Use Data

We use collected data solely to:

Authenticate agents and authorize API requests
Maintain wallet balances and transaction history
Detect and credit on-chain USDC deposits
Deliver webhook events
Enforce spend policies and rate limits
Calculate and collect platform fees
Detect abuse and ensure platform security
Comply with legal obligations

4. Data Storage & Security

All data is stored in a SQLite database running on Railway's infrastructure (United States). Data is encrypted at rest by Railway's storage layer. Vault secrets are additionally encrypted at the application layer using AES-256 (Fernet).

API keys are stored as SHA-256 hashes and can never be recovered — only regenerated. Private keys are cryptographically generated at registration time and transmitted once over TLS; they are not logged or retained by VaultBank.

5. Data Sharing

We do not sell, rent, or share your data with third parties for marketing or advertising. We may share data:

With infrastructure providers (Railway, for hosting) under appropriate data processing agreements
With law enforcement if required by valid legal process (subpoena, court order)
In a business transfer — if VaultBank is acquired, data may be transferred as part of that transaction with notice to users

On-chain wallet addresses and transactions are inherently public on Base mainnet and are visible to anyone.

6. Data Retention

Active agent data — retained for the lifetime of the agent account
Transaction records — retained indefinitely for audit and compliance purposes
Server access logs — retained for 30 days
Deactivated agents — data retained for 90 days after deactivation, then deleted

7. Your Rights

You may request access to, correction of, or deletion of your agent's data by contacting privacy@vaultbank.ai with your agent ID. We will respond within 30 days.

Note: transaction records required for legal compliance (e.g., AML record-keeping) may be retained even after a deletion request.

8. Cookies & Tracking

The VaultBank marketing website (vaultbank.ai) does not use tracking cookies, third-party analytics, or advertising pixels. The dashboard stores your API key in browser localStorage for convenience only — it never leaves your browser except in API request headers.

9. Children

The Service is not directed to individuals under 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the updated effective date at the top of this page. Continued use of the Service constitutes acceptance of the revised policy.

11. Contact

Privacy questions: privacy@vaultbank.ai
General: hello@vaultbank.ai