Privacy
Last updated: 28th September 2026. Version 2026-09-28+botcheck+dictation+topups.
This notice explains what FoldVault does with personal information. FoldVault is run by Carl Mumford Consulting Limited, a company registered in England and Wales (company number 15626285), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ ("we"). You can reach us at hello@carlmumford.co.uk.
Who is responsible for what
- Your account, sign-in and security records. We decide how these are used, so we are the controller for them.
- What your business puts in its vault. Your business decides what goes in and why, so your business is the controller, and we process it only to run FoldVault for you. Our data processing agreement covers this, and it forms part of our Terms.
- The waitlist. If you asked for an invite on our website, we are the controller for your email address.
What we hold
- Your notes. Everything you or your team write or add to the vault, including anything you add during set-up, emails you send in, and meeting notes. These are yours.
- Your account. Your name and email address. If you sign up with an email address, a scrambled (hashed) form of your password, which we cannot read. If you sign up with Google, your Google account's name, email address and picture, and the sign-in details Google gives us. We never see your Google password.
- Sign-in and security records. For each signed-in session, the IP address and the type of browser, kept for 30 days. A record of when you accepted these terms, which version, and from which browser.
- What happens in your vault. When jobs ran, what the assistant cost, and a record of actions taken, such as who changed which note and when. This holds names and dates, never the content of a note. It is kept for 180 days.
- If you connect your own AI. The connection details that let your Claude or ChatGPT reach your vault, until you or your business disconnect it.
- The waitlist. Your email address and when you asked.
We do not use analytics or tracking tools.
Why we use it, and our lawful basis
- To provide FoldVault under our agreement with your business: your account, your vault, sign-in, emails about your account, and support. The lawful basis is contract, and where you are a team member rather than the business itself, our legitimate interest in providing the service your business asked for.
- To keep FoldVault secure and working: sign-in records, the activity record and backups. The lawful basis is our legitimate interest in keeping the service and your data safe.
- To invite people from the waitlist. The lawful basis is our legitimate interest in running the pilot you asked to join. We only email you about the pilot.
We do not sell personal information, we do not use it for advertising, and we do not use your notes to train anything of our own. We make no decisions about you by automated means that have legal or similarly significant effects.
Where it is held
In a database on servers in the United Kingdom, run for us by Hostinger. Each night a copy of the database is saved on the server and kept for 14 days. An encrypted copy is also kept away from the server, in the United Kingdom, for 30 days.
Who else receives it
- Anthropic, which makes Claude. FoldVault's built-in assistant runs on Claude, and only if the owner of your vault switches the assistant on. When it writes your briefing, builds or checks your vault, or answers a question, the notes it needs for that task are sent to Anthropic. Under Anthropic's commercial terms it does not use them to train its models.
- Resend, our email provider. It sends invitations, sign-in emails and messages about your account. If your business switches on email to your vault, Resend also receives the mail sent to your vault's address and passes it to FoldVault. Emails from people in your vault are kept in your vault as notes, with their attachments, until you delete them. For emails we do not keep, because they are from someone outside your vault, do not prove who sent them, or are over a size limit, we record only the sender's address, the subject and the reason, never the body or attachments.
- Hostinger, which runs our servers in the United Kingdom.
- Google, only if you choose to sign in with Google.
- Stripe, our payment provider for AI credit. When the owner buys credit, Stripe takes the card details, name and email. Card details never reach our servers. We keep what was paid, when and the Stripe receipt link.
- Cloudflare, for the security check on our sign-in, password reset, sign-up and waitlist forms (Cloudflare Turnstile). When you use one of these forms, Cloudflare receives your IP address and details of your browser and device, and tells us only whether the check passed. We do not keep anything from it.
- Telegram, only if your business switches it on and you link your own account. The questions you send the FoldVault bot, its answers, and anything you save through it pass through Telegram, run by Telegram Messenger Inc. Messages with a bot are not end-to-end encrypted. Unlinking stops it.
- Whoever you connect. If you connect your own Claude, ChatGPT or other AI, your notes go to that provider under your own account with them, on their terms, not ours.
- Where the law requires it, for example a court order.
Transfers outside the UK
Anthropic, Resend and Google, Stripe, Cloudflare may process information in the United States, and Telegram outside the UK. Where they do, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or by the UK's International Data Transfer Addendum. Ask us for details.
How long we keep it
- Your notes and account: until you or your business delete them. Deleting a vault removes its notes, their history, anything uploaded, and the accounts of everyone on it.
- Files uploaded during set-up: used once and deleted, unless you choose to keep them for 30 days.
- Sign-in sessions: 30 days.
- The activity record: 180 days.
- Terms acceptance records: as long as the account exists.
- Backups: 14 days on the server and 30 days off it. Nothing deleted is restored from a backup.
- Voice recordings: if you talk instead of typing, your speech is turned into text on our own server and the recording is discarded straight away. It is never sent to another company and never kept. The text it produces is yours, like anything else you type.
- AI credit payments: what was paid, when and the Stripe receipt link stay in FoldVault until the vault is deleted. Stripe keeps its own record of each payment, and we keep the invoices and receipts in our company accounts for six years, as UK tax rules require. Deleting the vault does not remove those.
- The waitlist: until the pilot invitations are done, or sooner if you ask.
Cookies
We use only the cookies FoldVault needs to work: one that keeps you signed in, and one that lasts 20 minutes while you accept an invitation. Your browser also keeps unsent drafts on your own device. None of these track you, so we do not ask for cookie consent.
Your rights
You can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, or to have it in a form you can take elsewhere. Much of this you can do yourself: FoldVault exports everything as ordinary markdown files, and the owner can delete the vault. For anything in a vault, we will pass your request to the business that controls it and help them answer. Email hello@carlmumford.co.uk. We reply within one month.
Children
FoldVault is for businesses and is not meant for anyone under 18.
Changes
If we change this notice we will update the date and version above. If the change matters, we will tell you by email or in the app and ask you to accept it again.
Complaints
We are registered with the Information Commissioner's Office, reference ZB688474. Please tell us first if something is wrong, at hello@carlmumford.co.uk. You can also complain to the ICO at ico.org.uk.