Effective date: 4 April 2026
The data controller responsible for your personal data is:
Soda Creative Studios Ltd
Email: privacy@wax-vault.com
| Purpose | Legal Basis |
|---|---|
| Account creation and authentication | Contract performance |
| Storing and displaying your vinyl collection | Contract performance |
| Looking up record data via Discogs | Contract performance |
| AI-powered vinyl identification and grading | Contract performance |
| Processing subscriptions and payments | Contract performance |
| Sending push notifications (optional) | Consent |
| App analytics and performance monitoring | Legitimate interest |
| Social features (friends, leaderboards) | Consent / Contract |
| Public profile at wax-vault.com/@username | Consent |
WaxVault requests camera access for two purposes:
We use the following third-party services to operate WaxVault:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Firebase (Google) | Authentication, database, analytics | Link |
| Google Gemini AI | Vinyl identification & grading | Link |
| Discogs | Record database lookups | Link |
| Stripe | Payment processing | Link |
| Apple App Store | In-app purchases (iOS) | Link |
| Google Play Store | In-app purchases (Android) | Link |
We do not sell, rent, or trade your personal data to any third party. Data is shared with third-party services only as necessary to provide the Service.
Your data is stored on Firebase (Google Cloud) infrastructure. Google Cloud maintains industry-leading security certifications including ISO 27001, SOC 2, and SOC 3. Data is encrypted in transit (TLS) and at rest.
While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it.
Analytics data is retained in aggregate, anonymised form and is not linked to individual accounts after deletion.
Under UK data protection law, you have the right to:
To exercise any of these rights, contact us at privacy@wax-vault.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
The WaxVault web app uses localStorage to store:
We do not use third-party advertising cookies. Firebase Analytics may set cookies for analytics purposes — see Google's privacy policy for details.
WaxVault is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that data promptly. If you believe a child under 13 has provided us with personal data, please contact us at privacy@wax-vault.com.
Your data may be processed in countries outside the UK where our third-party service providers operate (primarily the United States, where Google and Stripe are headquartered). These transfers are protected by appropriate safeguards including Standard Contractual Clauses and the service providers' compliance with applicable data protection frameworks.
Push notifications are entirely optional. You can enable or disable them at any time through your device settings or within the app. We use push notifications only for collection updates, friend activity, and service announcements — never for advertising.
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy in the app or sending you an email. The "Effective date" at the top of this page indicates when the policy was last revised.
If you have any questions about this Privacy Policy or our data practices, contact us at:
Soda Creative Studios Ltd
Email: privacy@wax-vault.com
Website: wax-vault.com