Privacy Policy

Effective date: 21 July 2026 · Last updated: 21 July 2026

Celestial Data Vault EOOD ("Celestial", "we", "us") is committed to protecting your privacy. This policy explains what limited information we process, why, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Our guiding principle

Celestial is built on zero-knowledge architecture. The contents of your vault — passwords, files, notes, cards and secrets — are encrypted on your device with a key we never receive. We cannot read your vault data. This policy therefore concerns only the minimal account and operational data we do process.

2. Data we process

Account data: your email address and an authentication verifier (never your master password).
Encrypted vault blobs: ciphertext we store and sync but cannot decrypt.
Billing data: processed by our PCI-DSS compliant payment provider; we store only a plan status and invoice records, never card numbers.
Operational metadata: minimal logs (e.g. sync timestamps, device type) used to run and secure the service.

3. What we do not do

We do not sell, rent or share your personal data with advertisers or data brokers — ever.
We do not use third-party tracking or advertising cookies.
We do not profile you or build behavioural advertising audiences.

4. Legal bases

We process account and operational data to perform our contract with you (Art. 6(1)(b) GDPR), and to pursue our legitimate interest in securing the service (Art. 6(1)(f)). Billing data is processed to meet legal obligations (Art. 6(1)(c)).

You have the right to access, rectify, erase, restrict and port your personal data, and to object to certain processing. Because we cannot read your vault contents, requests concerning that data are fulfilled by giving you tools to export or delete it yourself. To exercise any right, email contact@celestialdatavault.com. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection.

6. Data location & retention

All data is stored within the European Union (Frankfurt and Sofia). We retain account data for as long as your account is active and delete it within 30 days of account closure, except where longer retention is legally required for billing records.

7. Cookies

We use only strictly necessary cookies required to keep you signed in and to secure your session. We set no analytics, advertising or third-party tracking cookies, so no consent banner is needed for non-essential tracking — because there isn't any.

8. Sub-processors

We use a small number of EU-based sub-processors for hosting, email delivery and payment processing, each bound by data-processing agreements. A current list is available on request.

9. Changes

We'll notify registered users of material changes to this policy by email at least 30 days before they take effect.

10. Contact

Data Controller: Celestial Data Vault EOOD, ul. Tsar Ivan Shishman 27, 1000 Sofia, Bulgaria. Data Protection Officer: contact@celestialdatavault.com.