Data processing agreement
Last updated: 28th September 2026. Version 2026-09-28+botcheck+dictation+topups.
This agreement forms part of our Terms. It is between the business using FoldVault (the controller) and Carl Mumford Consulting Limited, a company registered in England and Wales (company number 15626285), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ (the processor), and meets Article 28 of the UK GDPR.
The processing
- Subject matter: providing FoldVault to you.
- How long: for as long as you use FoldVault, and until your data is deleted as set out below.
- Nature and purpose: storing, organising, searching and showing your vault's contents to the people you allow; and, where you switch them on, running the built-in assistant, receiving email sent to your vault, and Telegram.
- Types of personal data: whatever you choose to put in your vault, such as names, contact details and notes about customers, staff and suppliers; and the account details of the people on your vault.
- Whose data: the people on your vault, and anyone your notes are about.
Our commitments
- We process your data only on your documented instructions, which are these terms and how you use FoldVault, unless the law requires otherwise, in which case we will tell you first if the law allows.
- Everyone who can access your data is bound to keep it confidential.
- We keep appropriate security measures: data is encrypted in transit, access is limited to what is needed to run the service, accounts are protected by passwords or Google sign-in, and off-site backups are encrypted.
- We help you respond to people exercising their rights. You can export and delete data yourself, and we will help if you need us to.
- We help you meet your duties on security, breaches, impact assessments and consulting the ICO, as far as they concern FoldVault.
- We tell you without undue delay after becoming aware of a breach affecting your data, with what we know and what we are doing about it.
- We give you the information you need to show you are meeting Article 28, and allow reasonable audits, on reasonable notice, at your cost.
Sub-processors
You give general permission for us to use these sub-processors:
- Hostinger, which hosts our servers in the United Kingdom.
- Resend, for sending account emails and, where you switch it on, receiving email sent to your vault.
- Anthropic, for the built-in assistant, only where you switch it on. It does not use your data to train its models.
- Google, for sign-in, only for people who choose to sign in with Google.
- Telegram, only where you switch it on and a person links their own account.
- Stripe Payments UK, Ltd., for taking payment for AI credit.
- Cloudflare, for the security check on the public sign-in, password reset, sign-up and waitlist forms (Cloudflare Turnstile).
We will tell you at least 14 days before adding or replacing a sub-processor, and you may object. If we cannot resolve your objection, you may stop using FoldVault. We put a written contract in place with each sub-processor that protects your data at least as well as this agreement, and we remain responsible for them.
Transfers outside the UK
Where a sub-processor handles data outside the UK, the transfer is protected by UK adequacy regulations or by the UK's International Data Transfer Addendum.
When you leave
When you delete your vault, or ask us to, we delete your data. You can export it first. Backups age out within 30 days, and nothing is restored from them afterwards. We keep nothing unless the law requires it.
Signing
This agreement applies as soon as your business starts using FoldVault, and nobody has to sign anything for it to be in force. If your own processes need a signed copy, ask at hello@carlmumford.co.uk and we will sign one for you.