Privacy Policy

Last Updated: March 2026

Patent Pending (U.S. Provisional Patent Application 64/014,464)

Vesperly LLC ("Vesperly," "we," "us," or "our"), a Virginia limited liability company, provides this Privacy Policy to explain how we collect, use, disclose, and protect information in connection with our websites, applications, and services (collectively, the "Service"). This Privacy Policy does not modify any other agreement you may have with us, including our Terms of Service.

ImportantThe Service is designed as a zero-knowledge encrypted vault (Patent Pending (U.S. Provisional Patent Application 64/014,464)). We do not access, decrypt, or scan your encrypted vault content ("Vault Content"), and we do not have your master password or recovery code. This Privacy Policy primarily describes information we process outside of Vault Content (for example, account, billing, device, usage, and support information).

Contact Us: support@vesperly.com. If you are a Virginia resident, you may have certain rights under the Virginia Consumer Data Protection Act (VCDPA) as described in this Privacy Policy.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by applicable law (for example, by posting the updated policy and updating the "Last Updated" date, and/or by providing notice through the Service or via email).

1. Information We Collect

Account information: email address (for login/notifications)
Encrypted Vault Content: text data encrypted client-side (Patent Pending (U.S. Provisional Patent Application 64/014,464)); we never see plaintext.
Metadata: account activity, heartbeat check-ins, IP address, device info (for security & analytics)
Uploaded documents: death certificates or Power of Attorney (only during access requests; stored temporarily in private bucket)

We do not collect master passwords, recovery codes, or unencrypted Vault Content.

2. How We Use Information

To provide the Service (heartbeat reminders, access requests)
To perform limited manual review of uploaded documents (death/incapacity requests)
For security, fraud prevention, and analytics (via GA4 and similar tools)

Analytics and Third-Party Tools. We may use analytics tools (such as Google Analytics 4) that collect information via cookies or similar technologies. Where required by law, we will request affirmative user consent before setting non-essential cookies. All third-party processors are bound by strict data-processing agreements.

3. Sharing Information

We do not sell data. We share only with service providers (Supabase, Stripe, Resend) under strict contracts and with law enforcement when required by valid legal process. We do not share encrypted Vault Content.

4. Data Storage & Security

Vault Content: encrypted client-side (Patent Pending (U.S. Provisional Patent Application 64/014,464)); we store only ciphertext.
Uploaded access-request documents: private Supabase bucket with RLS; deleted after review (60 days max).
Logs: audit logs kept for compliance; access restricted.

No Monitoring of Encrypted Content. We do not scan or monitor encrypted Vault Content for illegal material. We review only unencrypted documents submitted during access requests.

5. Your Rights

Under GDPR/CCPA/VCDPA (if applicable): access, correction, and deletion requests can be sent to support@vesperly.com. We respond within 30–45 days.

6. Changes

We may update this Policy. Continued use of the Service constitutes acceptance of the updated Policy.

Questions? support@vesperly.com