Privacy Policy Acrolyze

Last Updated: August 3, 2026

1. Introduction

Acrolyze ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

This policy complies with:

General Data Protection Regulation (GDPR) EU/UK
California Consumer Privacy Act (CCPA) USA
Children's Online Privacy Protection Act (COPPA) USA
Personal Data Protection Law (PDPL) Oman

2. Information We Collect

Account Information	Name, email address (encrypted at rest with AES-256-GCM)
Payment Information	Processed by PayPal/Stripe. We never store full card numbers
Vault Data	Passwords, documents, financial records encrypted client-side, we CANNOT access
Usage Data	IP address (encrypted), browser type, pages visited for security purposes

3. Zero-Knowledge Architecture

Your Vault Data is encrypted on your device before transmission using AES-256-GCM encryption. Your encryption key is derived from your password and never transmitted to our servers in plaintext form. We have no technical ability to access, read, or decrypt your Vault Data.

4. How We Use Information

To create and manage your account
To send verification codes and password reset emails
To process subscription payments
To send important security notifications
To comply with legal obligations
We NEVER sell your data to third parties

5. Cookies Policy

We use only essential cookies for:

Authentication & session management
Security (CSRF protection)
Theme preference (dark/light mode)
Remember-me functionality

No tracking cookies. No advertising cookies. No third-party cookies.

6. Data Sharing & Disclosure

We do not sell, trade, or rent your personal information. We may disclose information:

To payment processors (PayPal, Stripe) for billing purposes only
To comply with valid legal requests (court orders, warrants)
To protect our rights, property, or safety

7. Data Retention

Active accounts: Data retained while account is active
Deleted accounts: All data permanently deleted within 30 days
Audit logs: Retained for 14 months for premium users, 90 days for free users
Payment records: Retained as required by tax laws (7 years)

8. Your Rights

GDPR Rights (EU/UK Users):

Right to access your personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to data portability
Right to object to processing
Right to withdraw consent
Right to lodge a complaint with a supervisory authority

CCPA Rights (California Users):

Right to know what personal information is collected
Right to delete personal information
Right to opt-out of sale (we don't sell data)
Right to non-discrimination for exercising rights

9. Children's Privacy (COPPA/GDPR)

Our Platform is not intended for children under 13 years of age (16 in the EU/UK). We do not knowingly collect information from children. If you believe a child has provided us with personal data, contact us immediately.

10. International Data Transfers

Your data is stored on servers located in the Sultanate of Oman. For users outside Oman, by using our Platform, you consent to the transfer of your data to Oman, which may have different data protection laws than your jurisdiction.

11. Security Measures

AES-256-GCM encryption for all stored data
Argon2id password hashing (OWASP recommended)
TLS 1.3 for data in transit
HSTS with preload
Content Security Policy (CSP) headers
Regular security audits
Rate limiting on all authentication endpoints

12. Data Breach Notification

In the event of a data breach involving personal data, we will notify affected users within 72 hours of discovery, as required by GDPR, and relevant authorities where applicable.

13. Data Protection Officer

For privacy-related inquiries, contact our Data Protection Officer:
Email: connect@acrolyze.com
Subject line: "Data Protection Inquiry"

14. Changes to This Policy

We will notify you of material changes via email and/or prominent notice on our Platform at least 30 days before changes take effect.