Privacy Policy

Effective June 16, 2026 · Last updated June 16, 2026

1. Introduction

This Privacy Policy describes how 17795386 Canada Inc. (“Vaulted”, “we”, “us”, or “our”) collects, uses, discloses, and protects your personal information when you use the Vaulted website (vaulted.live), mobile applications, and related services (collectively, the “Services”).

We are committed to protecting your privacy and handling your personal information responsibly. This Policy explains what data we collect, why we collect it, how we use it, who we share it with, and the rights you have over your information.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. Your use of the Services is also governed by our Terms of Service.

2. Scope

This Policy applies to all personal information collected through the Services, whether you use Vaulted as a registered account holder or as an anonymous visitor.

This Policy does not apply to:

Third-party websites, applications, or services linked from the Services, including Seller websites where transactions take place
Information you provide directly to third parties (including Apple, Google, and Sellers)
Affiliated entities that operate under separate privacy policies, including Offside Boys (offsideboys.com)

When you visit a Seller’s website through a link in the Services, your interactions there are governed by the Seller’s own privacy policy.

3. Personal Information We Collect

The personal information we collect depends on how you interact with the Services.

3.1 Account Information

If you create an account, we collect:

Email address
Display name or username
Hashed password (we never store or transmit passwords in plaintext)
Account creation date
Authentication tokens
Settings and preferences

If you sign in using Apple or Google, we receive basic profile information from those providers, which may include your name and email address. Apple allows you to hide your real email behind a relay address; we receive only what you choose to share. We never receive your Apple ID or Google account password. Your relationship with Apple or Google, including what they collect about your sign-in activity, is governed by their own privacy policies.

3.2 Vault and Collection Information

If you use the Vault, we collect:

Photos of shirts you upload
Shirt metadata you enter (team, year, kit type, sponsor, notes)
Review submission status

3.3 Scan and Identification Information

When you use the scan or identification features, we collect:

Photos you capture or upload through the scan feature
Scan timestamps
Identification results returned to you

3.4 Device and Usage Information

When you use the Services, we automatically collect:

Device type, operating system, and OS version
App version
IP address (used for security, basic geolocation, and analytics)
Usage patterns, including which features you use and how often, where analytics tooling is enabled
Crash diagnostics, where crash-reporting tooling is enabled
Push notification tokens (if you have enabled notifications)

3.5 Communications

If you contact us for support or any other reason, we collect:

Your contact information
The content of your message
Any attachments you provide
Records of our response

3.6 Information We Do Not Collect

At launch, we do not collect:

Phone numbers
Precise location data (GPS coordinates)
Payment or financial information (Vaulted does not process transactions)
Social media account data beyond what Apple or Google provide at sign-in
Contacts from your device’s address book
Microphone recordings or audio data

4. How We Collect Information

We collect personal information in three ways:

Directly from you. When you register for an account, upload shirts to your Vault, send us a message, or otherwise provide information through the Services.

Automatically from your device. Device, app, and usage information is collected automatically when you interact with the Services, including through standard application logs and analytics tooling.

From third parties. When you sign in using Apple or Google, we receive limited profile information from those providers. We may also receive aggregated or technical data from service providers that help us operate the Services, such as analytics and crash reporting tools.

5. How We Use Your Personal Information

We use your personal information for the following purposes:

5.1 Operating the Services

Creating and managing your account
Authenticating you when you sign in
Displaying your Vault, and account settings
Processing scan and identification requests
Reviewing photos you upload to your Vault for the purposes of providing a best-effort manual authenticity assessment, performed by members of our team
Showing you catalogue data, listings, and price information
Maintaining and improving the technical performance of the Services

5.2 Communicating With You

Sending transactional emails (account confirmations, password resets, review status updates, security notices)
Sending push notifications you have opted into (price alerts, review status updates, account activity)
Responding to support requests and inquiries
Sending marketing communications, if you have opted in at signup or through account settings

5.3 Improving the Services

Analyzing aggregated and anonymized usage data to understand how the Services are used
Diagnosing and fixing bugs through crash reports
Identifying patterns to inform product development decisions

5.4 Security and Integrity

Detecting and preventing fraud, abuse, and violations of our Terms of Service
Protecting against security threats and unauthorized access
Investigating suspected violations and enforcing our policies

5.5 Legal Compliance

Complying with applicable laws, regulations, and legal processes
Responding to lawful requests from authorities
Establishing, exercising, or defending legal claims

5.6 AI and Machine Learning

We use AI and machine learning to operate the Services, including processing the photos you scan or upload to identify and match shirts. Images submitted through the scan feature are processed to return a result and may be cached for up to one (1) day to reduce processing cost, after which they are deleted. Some of this processing, including generating the image embeddings used for matching, is performed by third-party processors on our behalf (see Section 7). This operational processing is necessary to provide the Services and is not the same as training a model.

6. Consent and When We Can Process Without It

Canadian privacy law (PIPEDA, Quebec's private-sector privacy law, and provincial equivalents) is built on consent. We collect, use, and disclose your personal information with your knowledge and consent, and we explain our purposes at or before the time of collection, in this Policy and in prompts within the Services.

How we obtain your consent depends on the sensitivity of the information and the purpose:

Express consent: for things you actively choose, such as creating an account, opting in to marketing communications or push notifications. We use express opt-in consent where a purpose goes beyond what is needed to provide the Services and beyond what you would reasonably expect from the features you use.
Implied consent: for processing that a reasonable person would expect as part of using the Services you have asked for, such as hosting your Vault, processing a scan you submit, and the routine technical data described in Section 3.4.

Canadian law also permits us to use or disclose personal information without consent in limited circumstances, including where required or authorized by law, to detect and prevent fraud or security threats, to collect a debt, in an emergency that threatens someone's life, health, or security, or as otherwise permitted by applicable privacy legislation. We rely on these exceptions only where they genuinely apply.

You can withdraw your consent at any time, subject to legal or contractual restrictions, by adjusting your account settings or contacting us at [email protected]. Withdrawing consent may affect our ability to provide certain features and we will explain the consequences of withdrawal when you ask to withdraw.

7. Third-Party Service Providers and Processors

We use third-party service providers (“Processors”) to operate and improve the Services. Processors handle personal information on our behalf, under contractual terms that require them to protect your information and use it only for the purposes we authorize.

Categories of Processors currently in use, and that we may use in the future, include:

Hosting and database providers
AI and image processing
Authentication (Apple and Google for Sign in with Apple / Sign in with Google)
Storage and content delivery
Analytics
Crash reporting
Transactional email delivery
Company email and support correspondence

A current list of our material Processors, including vendor names and the regions in which they process data is available on request.

8. How We Share and Disclose Information

We do not sell your personal information. We share personal information only in the following limited circumstances:

8.1 With Service Providers

We share personal information with Processors described in Section 7, strictly for the purposes of operating, maintaining, and improving the Services.

8.2 With Affiliated Entities

Vaulted and Offside Boys are separate legal entities with overlapping ownership and operators. As of the date of this Policy, Vaulted does not share personal information with Offside Boys. The two services operate independently, and your Vaulted account and activity are not linked to any Offside Boys customer record unless you explicitly choose to link them yourself in the future, with separate consent.

For clarity, this commitment does not prevent: (a) disclosures required by law that happen to involve both companies (Section 8.3); (b) the use of shared professional advisors (such as lawyers or accountants) who are bound by confidentiality and who do not use your personal information for Offside Boys' business purposes; (c) shared internal administrative systems and personnel, provided your personal information is not used for Offside Boys' marketing, sales, or customer-facing purposes; or (d) fraud-prevention or security investigations that affect both services. None of these permit Offside Boys to use your Vaulted personal information to market to you or to build customer records about you.

8.3 For Legal Reasons

We may disclose personal information if we believe in good faith that disclosure is necessary to:

Comply with applicable law, regulation, court order, subpoena, or other legal process
Respond to lawful requests from public authorities, including for national security or law enforcement purposes
Enforce our Terms of Service or other policies
Protect the rights, property, or safety of Vaulted, our users, or any third party
Detect, prevent, or address fraud, security, or technical issues

8.4 In a Business Transfer

If Vaulted is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred as part of that transaction. We will notify you of any such transfer and any material changes to how your information will be handled.

8.5 With Your Consent or at Your Direction

We may share your personal information with other parties when you specifically direct us to do so or otherwise consent.

8.6 Third-Party Links and Purchases

Vaulted acts as a catalogue and referral intermediary. When you click on a referral or affiliate link to purchase an item, you will be directed to a third-party partner's external store. Vaulted does not collect, process, or store your payment or transaction data. The third-party seller and any underlying affiliate tracking networks act as independent data controllers with respect to any personal information you provide to them to complete your purchase. We encourage you to review their respective privacy policies.

9. International Data Transfers

The Services are operated from Canada. Your account data and Vault content are stored in Canada. Some processing takes place in the United States, including: AI image-identification and embedding processing, and company email and support correspondence is hosted in the United States. Other Processors may process personal information in additional jurisdictions.

By using the Services, you understand that your personal information may be transferred to, stored, and processed in countries other than your country of residence, including countries where data protection laws may differ from those in your jurisdiction. While your personal information is in another jurisdiction, it is subject to the laws of that jurisdiction, and may be accessible to the courts, government, and law enforcement or national security authorities of that jurisdiction in accordance with those laws.

We require Processors handling personal information outside of Canada to maintain protections that are reasonably comparable to those required under Canadian law, through contractual safeguards. Before transferring personal information outside of Quebec or Canada, we assess whether the information will receive adequate protection, taking into account the sensitivity of the information, the purposes of the transfer, the safeguards in place, and the legal regime of the receiving jurisdiction.

10. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by law. Retention varies by data type:

Active account data (email, profile, Vault entries, scan history): retained while your account is active
Account data after deletion: deleted or anonymized within thirty (30) days of your account deletion request, except where retention is required by law
De-identified shirt images (metadata removed, no link to any individual): may be retained indefinitely for catalogue and image-recognition purposes
Scan images: cached for up to one (1) day to reduce processing cost, then deleted
Scan and identification logs: retained for ninety (90) days for support, diagnostics, and security purposes, then deleted
Aggregated and anonymized analytics: retained indefinitely after personal identifiers have been removed
Crash reports: retained for ninety (90) days
Support communications: retained for two (2) years from the last interaction
Information retained under legal hold or for legal compliance: retained for as long as required

When personal information is no longer needed for any of the purposes above and is not subject to a legal retention requirement, we will securely delete or anonymize it.

10.1 What Happens to Your Vault on Account Deletion

When you delete your account, your private Vault data (photos, shirt metadata, notes, value history, and other personal collection information) is permanently deleted or anonymized within thirty (30) days. Where a shirt photo can be fully de-identified — stripped of metadata and of any information linking it to you — we may retain the de-identified image for catalogue and image-recognition purposes. A de-identified image no longer constitutes your personal information and cannot be connected back to you.

11. Your Rights and How to Exercise Them

Under Canadian privacy law, you have the following rights with respect to your personal information:

Access: You may request a copy of the personal information we hold about you.
Correction: You may request that we correct inaccurate or incomplete personal information.
Deletion: You may request that we delete your personal information, subject to legal retention requirements.
Withdrawal of consent: You may withdraw previously given consent at any time, including for marketing communications and optional features.
Portability: You may request a copy of your personal information in a structured, commonly used, machine-readable format, and request that we transfer it to another service where technically feasible.
Objection to processing: You may object to certain types of processing of your personal information.
Complaint: You may file a complaint with the Office of the Privacy Commissioner of Canada or your applicable provincial regulator (including the Commission d’accès à l’information du Québec for Quebec residents).

If you are a resident of the United States, you may have additional rights under the privacy laws of your state, depending on the state and on whether those laws apply to Vaulted. You may submit any request described above regardless of where you live, and we will honour it to the extent required by the law that applies to you.

11.1 Self-Service Options

You can exercise many of these rights directly through your account settings, including:

Editing your profile and account information
Adjusting consent preferences (marketing communications, push notifications)
Deleting your account directly within the mobile app or on the website

11.2 Submitting a Request

For rights that are not available through self-service, you may submit a request to [email protected]. We will respond to your request within thirty (30) days of receipt, in accordance with applicable law.

To protect your privacy, we may need to verify your identity before processing certain requests. We may decline requests in limited circumstances permitted by law, such as where compliance would reveal personal information about another person, where the request is manifestly unfounded or excessive, or where retention is legally required.

12. Cookies and Tracking Technologies

12.1 Mobile Applications

The Vaulted mobile applications do not use cookies. Where the applications use device identifiers or similar technologies, this is governed by the permissions you grant through your device’s operating system, including Apple’s App Tracking Transparency framework on iOS and equivalent Android controls.

12.2 Website

The Vaulted website (vaulted.live) uses only strictly necessary cookies required for core functionality, including authentication and security. We do not use cookies for analytics, advertising, or cross-site tracking on the website at launch.

12.3 Our Approach to Advertising

We are committed to the following core principles, which we will not change without the explicit consent of affected users:

We do not sell your personal information to advertisers or advertising networks
We do not share your personal information with advertisers or advertising networks for the purpose of targeting ads to you
We do not use cross-site or cross-app tracking technologies (retargeting pixels, third-party advertising identifiers, etc.) to follow you across the internet
We do not build advertising profiles about you based on your activity within the Services

At launch, the Services contain no advertising of any kind.

In the future, we may introduce advertising features that do not involve any of the practices above. Examples we may introduce, with appropriate disclosure, include:

Sponsored listings or promoted shirts: third-party Sellers or partners may pay to have their listings displayed in a featured position. These will be clearly labelled and shown based on the content you are browsing, not based on your personal information or behaviour profile.
Contextual placements: advertising shown based on the catalogue content you are viewing, not based on who you are.
First-party promotional content: communications from Vaulted about our own features, partnerships, or events.

Any advertising feature that would require using your personal information to target ads specifically to you, or that would involve sharing your personal information with advertising platforms, will be introduced only with your explicit consent and at least thirty (30) days’ notice.

13. Children’s Privacy

The Services are not intended for use by anyone under the age of sixteen (16). We do not knowingly collect personal information from anyone under this age. If we learn that we have collected personal information from a user under sixteen (16), we will delete that information and terminate the account.

If you are a parent or guardian and believe that your child has provided personal information to us, please contact [email protected] and we will take appropriate action.

In jurisdictions where parental or guardian consent would otherwise be required to use a service like Vaulted, our minimum age is eighteen (18).

14. Security

We use industry-standard administrative, technical, and physical safeguards to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These safeguards include:

Encryption of personal information in transit using TLS
Hashing of passwords using modern, industry-standard algorithms
Access controls limiting who can access personal information internally
Logging and monitoring of access to systems containing personal information
Contractual safeguards with Processors

No method of transmission over the internet or method of electronic storage is one hundred percent secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

If we become aware of a breach of security involving your personal information, that creates a real risk of significant harm to you, or a confidentiality incident that presents a risk of serious injury, we will notify you and the applicable regulators as soon as feasible, in accordance with applicable law. This includes reporting to the applicable regulatory authorities where those laws apply.

15. Quebec Residents

If you are a resident of Quebec, you have additional rights and protections under Quebec Law 25 (An Act respecting the protection of personal information in the private sector):

Designated Privacy Officer: We have designated Jin Kwon as the person responsible for the protection of personal information at Vaulted. You may contact our Privacy Officer at [email protected].
Right to information: You have the right to be informed about the collection, use, and disclosure of your personal information, in clear and simple language.
Right to data portability: You have the right to receive your personal information in a structured, commonly used technological format.
Automated decision-making: If we ever make decisions about you based solely on automated processing, you have the right to be informed and to request human review. As of the date of this Policy, we do not make automated decisions of this nature.
Breach notification: We will notify you and the Commission d’accès à l’information du Québec without delay, and in any case within seventy-two (72) hours, of any confidentiality incident presenting a risk of serious injury.

If we offer the Services to users in Quebec, this Policy and key user-facing communications will be made available in French in accordance with applicable law.

16. Changes to This Policy

We may modify this Privacy Policy from time to time. If we make material changes, we will provide at least thirty (30) days’ notice before the changes take effect by posting the updated Policy on our website and through other reasonable means, which may include in-app notification or email to your registered address. If a change would permit a use or disclosure of previously collected personal information that is materially broader than what you consented to, we will obtain your express consent before applying the change to your information.

Your continued use of the Services after the effective date of the updated Policy constitutes acceptance of the updated Policy. If you do not agree to the updated Policy, you may terminate your account.

Non-material changes (such as clarifications, typographical corrections, or updates to contact information) may take effect immediately upon posting.

17. Contact Us

For questions about this Privacy Policy, to exercise your privacy rights, or to file a complaint:

Privacy Officer: Jin Kwon Email: [email protected] Mailing Address: 17795386 Canada Inc., operating as Vaulted, 350 Bay St, Suite 1300B, Toronto, Ontario M5H 2S6, Canada

For general support inquiries unrelated to privacy, please contact [email protected].

You may also file a complaint with:

Office of the Privacy Commissioner of Canada: priv.gc.ca, 1-800-282-1376
Commission d’accès à l’information du Québec (for Quebec residents): cai.gouv.qc.ca