Privacy Policy

Effective date: 13 October 2026 · Version: 1.1

This Privacy Policy explains how RW Media Pty Ltd (ABN 82 623 586 372) ("we", "us", "our"), which operates Vaultmastr, collects, uses, stores and shares personal information when you use vaultmastr.com, the Vaultmastr application and the Vaultmastr Assist browser extension (the "Service").

We are based in Australia and handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Because our customers are worldwide, we also aim to meet the requirements of the EU and UK General Data Protection Regulation ("GDPR") for people in those regions. Section 11 explains your rights.

In short: we collect what we need to run your account and bill you; your video and document files stay in cloud storage you control, not ours; we never sell personal information; and performer identity documents are handled as sensitive material and kept out of our databases.

1. Who this policy covers

• Customers: people and businesses who create a Vaultmastr account.
• Team members: people a customer invites into their workspace.
• Performers and other people in customer content: people whose names, stage names or details a customer enters into Vaultmastr. For this information, the customer is the controller (the party that decides why and how it is used) and we act as their processor / service provider, handling it only on their instructions. If you are a performer with a question about how a studio is handling your information, contact that studio first; you can also contact us and we will help where we can.
• Visitors: anyone who visits the public website or contacts support.

2. What we collect

2.1 Information you give us

• Account details: name, email address, password (stored as a one-way hash, never in plain text), time zone, workspace/brand names.
• Billing details: plan, billing name and email, invoice history, and the payment reference or transaction ID of payments you make. We do not hold your card or bank account details: you pay our invoices by bank transfer or cryptocurrency from an account you control.
• Scene and workspace data: titles, descriptions, tags, categories, release dates, links, scene numbers, platform settings, templates, and the names of the cloud folders your files live in.
• Performer records: the stage names and (optionally) legal names and dates of birth of performers you add, notes you write, and platform handles. Legal names and dates of birth are stored encrypted and are never included in copy sheets, briefs, exports or anything sent to another platform. Identification and consent documents are not stored in our databases: see section 4.
• Account verification: the account owner's legal name and date of birth (encrypted), when and from which IP address they confirmed our verification statement, and our decision. While a verification is waiting to be checked, the ID photos stay in your cloud storage and we open them from there. If we approve it, we keep an encrypted copy of those ID photos in storage we control as our record of the check, so the record cannot be changed or lost afterwards. See sections 4 and 9.
• Connected services: when you connect Dropbox, pCloud, Google Drive, X, Reddit, Bunny Stream, WordPress or another service, we store the access tokens or credentials that service issues, encrypted, so the Service can act on your behalf. We store only what the connection needs.
• Support and correspondence: messages, tickets and attachments you send us, and feedback you leave on help articles.
• Signup confirmations: the date and time you confirmed you are 18 or older and accepted our terms.

2.2 Information collected automatically

• Technical data: IP address, browser and device type, operating system, language, referring page, pages viewed and actions taken in the Service, and timestamps. This is collected by our web server and by Cloudflare, which sits in front of our site.
• Security and activity logs: sign-ins, failed sign-ins, changes to connected services, and actions taken in your workspace, kept so we can secure accounts, investigate abuse and support you.
• Cookies and local storage: see section 8.

2.3 Browser extension

The Vaultmastr Assist extension only activates on the platform sites it supports. When active, it reads the scene data you have chosen in Vaultmastr and fills it into that site's upload form. It sends to us only what is needed to know which scene you are posting and whether you marked it posted. It does not read your browsing on other sites, your passwords, or the content of the platform's pages beyond the form it fills.

2.4 Information we do not collect

We do not knowingly collect information from anyone under 18, and we do not ask for or store sensitive information about you (such as health, sexuality or political views) beyond the fact that you operate an adult-content business.

3. How we use information

We use personal information to:

• provide, operate and secure the Service and your account;
• issue invoices, reconcile payments and manage your plan;
• connect to the third-party services you authorise and act on your instructions;
• respond to support requests and communicate with you about the Service (service announcements, security notices, changes to terms);
• detect, investigate and prevent fraud, abuse, security incidents and breaches of our Acceptable Use & Content Policy, including the use of automated scanning on material that passes through our infrastructure;
• comply with legal obligations, including mandatory reporting of illegal material and responding to lawful requests from authorities;
• analyse aggregated, de-identified usage so we can improve the Service; and
• with your consent, send product news (you can opt out at any time).

Legal bases (GDPR): performing our contract with you; our legitimate interests in running, securing and improving the Service and preventing abuse; compliance with legal obligations; and consent where we ask for it.

4. Your files and performer documents

Vaultmastr is designed so that your video, image, identification and consent files live in cloud storage you own (for example your Dropbox, pCloud or Google Drive) and never sit in our databases. Specifically:

• Large files uploaded through the Service go directly from your browser to your cloud storage; the bytes do not pass through our servers.
• Smaller files uploaded through a form (for example thumbnails, trailers, or a performer ID document) are received by our server only to pass them on to your cloud storage, and are deleted from our server once the transfer completes or fails.
• The one exception is account verification. When we approve an account owner's verification, we keep an encrypted copy of the ID photos they submitted for it (the ID and the photo of them holding it) in cloud storage that we control, separate from your account's storage. Each copy is encrypted by the Service before it is stored, with a key held only by the Service, so the storage provider cannot read it. These copies are our record of what was checked and approved, can be opened only by Vaultmastr staff on the verification page, and are never shared with other users or platforms. Performer ID documents added for other performers are not copied: they stay in your cloud storage.
• We keep only the path or file reference so the Service can find the file again, plus the metadata you enter about it.
• Small preview images are kept on our server so pages load quickly: the profile pictures you set for performers, and reduced-size thumbnails of your scene photos and thumbnails. These are pictures you chose as previews; the full-size files stay in your cloud.
• Where you enable a feature that delivers a file to another service (for example sending a master file to a video host for your own website), we pass that service a temporary link or the file itself as needed to complete the delivery, and do not retain a copy.

We do not open, review or use your files except as needed to provide a feature you have used, to verify an account owner's identity (section 2), to investigate a suspected breach of our policies, or where the law requires.

5. Who we share information with

We do not sell personal information, and we do not share it for advertising. We share it only with:

• Service providers who help us run the Service, under contracts that restrict their use of it: our hosting provider (Mojo Host, United States); Cloudflare (network security, DNS and content delivery, global); our email providers (Proton, Switzerland, for our mailboxes; Resend, United States, which delivers the emails the Service sends, such as sign-up, invoice and support emails); our bank and any cryptocurrency payment service we use to receive payments; and error-monitoring or analytics tools we may add (we will update this policy if we do).
• Third-party services you connect (Dropbox, pCloud, Google, X, Reddit, Bunny, WordPress, and the platforms you post to). What they receive is what you instruct us to send; their handling of it is governed by their own privacy policies.
• Authorities and other parties where required by law: including reports of suspected child sexual abuse material or exploitation to NCMEC, the Australian Federal Police / ACCCE, the eSafety Commissioner or other law-enforcement bodies; responses to subpoenas, warrants and lawful requests; and disclosures necessary to protect the rights, safety or property of any person.
• A successor if our business is sold or merged, on terms that respect this policy.

6. Where information is stored and international transfers

Our application and database are hosted in the United States. Cloudflare processes traffic at data centres around the world. Our email is hosted in Switzerland. Your connected cloud storage is wherever your provider keeps it. We ourselves are in Australia.

By using the Service you acknowledge that your information will be transferred to and processed in these countries. Where GDPR applies, we rely on standard contractual clauses or an equivalent lawful mechanism with our providers; contact us for details.

7. Security

We protect personal information with measures including: TLS encryption in transit; encryption at rest for access tokens, credentials, and performer legal names and dates of birth; hashed passwords; tenant isolation so one customer cannot access another's data; access controls and logging; and network protection via Cloudflare. No system is perfectly secure, so please use a strong, unique password and tell us immediately at [email protected] if you suspect a problem. If a data breach is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (and, where GDPR applies, the relevant supervisory authority) as the law requires.

8. Cookies and local storage

We use only cookies and browser storage that the Service needs to work:

We do not currently use advertising or cross-site tracking cookies. If we add privacy-respecting analytics in future, we will update this section. You can block cookies in your browser, but the Service will not work without the session cookie.

9. Retention

We keep personal information only as long as needed for the purposes above:

• Account and workspace data: for the life of your account, then deleted or de-identified within 30 days of closure.
• Billing records: 7 years, as required by Australian tax law.
• Account verification records (the approved legal name and date of birth, confirmation record, decision and the encrypted copies of the ID photos): for the life of your account and 7 years after closure, as our record of the age and identity check behind the content distributed through the Service. Because these are compliance records, a request to delete them earlier is refused (section 11).
• Security and access logs (sign-in history, signed-in browsers): 12 months, then removed automatically.
• Support correspondence: 2 years after the ticket closes, then removed automatically.
• Records relating to a policy breach, investigation or report to authorities: as long as the law requires or the matter is live, which may be after your account is closed.
• Transient file transfers (section 4): deleted on completion, and in any case within 24 hours by an automatic sweep.

10. Children

The Service is for adults only. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has created an account or appears in content managed through the Service, contact [email protected] immediately.

11. Your rights

You can:

• access the personal information we hold about you and ask for a copy;
• correct it if it is inaccurate or out of date (most account details can be edited in the Service);
• delete it by asking us to close your account (email us from your account email; we close it and delete or de-identify the data within 30 days, subject to the retention rules in section 9);
• export your scene and workspace data: ask us and we send it to your account email within 30 days;
• withdraw consent for anything we do based on consent, such as marketing emails;
• object to or restrict certain processing, where the law allows; and
• complain.

To exercise a right, email [email protected] from your account email. We respond within 30 days. We may need to verify your identity first.

If you are unhappy with how we handle your information, please tell us first so we can try to resolve it. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the EU or UK, you may complain to your local data protection authority.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here and, for material changes, notify you by email or in-app before they take effect.

13. Contact

RW Media Pty Ltd (ABN 82 623 586 372), operator of Vaultmastr Privacy enquiries: [email protected] (subject "Privacy")