Privacy Policy

This Privacy Policy explains how PROFSOFT GLOBAL - FZCO ("Company", "we", "us" or "our") collects, uses, stores, shares and protects personal data in connection with Vaaau, a digital vault for the family (the "Service").

This Privacy Policy applies to our mobile application, website and other services directly related to Vaaau.

For the purposes of applicable data protection laws, PROFSOFT GLOBAL - FZCO acts as the data controller in relation to the personal data processed as described in this Privacy Policy.

The Service may be available to users in different countries. We process personal data in accordance with applicable data protection and privacy laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") where applicable.

Data Controller:

• PROFSOFT GLOBAL - FZCO
• Registration Number: DSO-FZCO-19380
• License Number: 21028
• Address: DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE
• Tel.: +971 585798657
• E-mail: hello@profsoft.ae

EU Representative

Pursuant to Article 27 of the GDPR, PROFSOFT GLOBAL - FZCO has designated the following representative in the European Union:

• Kirill Olegovich Kaplin
• Rua da Seca do Bacalhau, 440, Fração Y
• Canidelo, Vila Nova de Gaia
• 4400-396, Portugal
• E-mail: hello@profsoft.ae

This Privacy Policy should be read together with our Terms of Use.

Depending on how you use Vaaau, we may collect and process the following categories of personal data.

Account and Authentication Information

When you create or access your Vaaau account, we may process:

• your name;
• email address;
• authentication and account credentials;
• account settings and preferences;
• information relating to your subscription plan.

You may create or access your account using your email address or third-party authentication services, including Sign in with Apple and Sign in with Google.

If you choose to sign in through Apple or Google, we may receive certain information from the relevant provider, such as your account identifier, name and email address, depending on the information you choose to share and the provider's settings.

Where you use Sign in with Apple and choose to hide your email address, we may receive an Apple-generated private relay email address instead of your actual email address.

Documents and Content

Vaaau allows users to upload and store documents in a digital family vault. We may process:

• documents, images and other files uploaded to the Service;
• information contained in those documents;
• document metadata, including file names, document types, upload dates and categories;
• information extracted from documents, including names, dates, document details and expiration dates;
• questions submitted to the AI functionality and AI-generated responses;
• information necessary to organize, search and manage documents within the Service.

The contents of uploaded documents may include personal data relating both to the user and to other individuals.

Sensitive and Special Categories of Personal Data

Because Vaaau is designed to store different types of personal and family documents, uploaded documents may contain sensitive information.

This may include health information and other special categories of personal data within the meaning of Article 9 of the GDPR, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or information concerning a person's sex life or sexual orientation.

Documents may also contain other sensitive information, including identification document numbers, financial information, insurance information and similar personal records.

We process such information only to the extent necessary to provide the functions requested by the user and in accordance with applicable data protection laws.

Personal Data of Family Members and Other Individuals

Documents uploaded to Vaaau may contain personal data relating to family members or other individuals, including spouses, children, parents and other persons whose information appears in the uploaded documents.

If you upload, share or otherwise provide personal data relating to another individual, you represent that you are lawfully entitled to provide such data to us and to permit its processing in accordance with this Privacy Policy.

Where such documents contain special categories of personal data within the meaning of Article 9 of the GDPR, including health information, their processing is subject to the additional requirements described in this Privacy Policy.

Payment and Subscription Information

Payments may be processed through Apple App Store, Google Play or other authorized payment providers.

We may receive limited information relating to your purchase or subscription, such as:

• subscription plan and status;
• transaction or purchase identifier;
• payment date and amount;
• billing country or region;
• information relating to subscription renewal, cancellation or refund.

We do not receive or store full payment card details where payments are processed directly by third-party payment providers.

Technical and Usage Data

When you use the Service, we may automatically process certain technical information necessary for the operation, security and improvement of Vaaau, including:

• IP address;
• device type and operating system;
• application version;
• language and regional settings;
• login and authentication information;
• usage, diagnostic, error and security logs.

Sources of Personal Data

We may obtain personal data:

• directly from you, when you create or use an account, upload documents, use AI features, manage your subscription or contact us;
• from Apple or Google, if you choose to create or access your account using Sign in with Apple or Sign in with Google;
• from Apple App Store, Google Play or other authorized payment providers, in connection with purchases and subscriptions;
• from other Vaaau users, where they invite you to a family vault, share documents or otherwise provide information relating to you through the Service;
• automatically when you use the Service, including certain technical, authentication, security and usage data;
• from the processing of documents you upload, where Vaaau extracts, classifies or generates information necessary to provide the Service, such as document type, relevant details and expiration dates.

Where a user uploads a document containing personal data of another individual, we receive that information from the user who uploaded the document.

How We Use Personal Data

We use personal data only for purposes connected with providing, operating and protecting Vaaau, including to:

• create, authenticate and manage user accounts;
• store, organize, search and manage documents in the digital vault;
• recognize and classify documents and extract relevant information, including expiration dates;
• process user questions and generate AI-assisted responses based on uploaded documents;
• provide family vault and document-sharing functionality;
• manage subscriptions, purchases, renewals, cancellations and refunds;
• send service-related communications, including security notifications and document expiration reminders;
• provide customer support and respond to user requests;
• maintain the security and integrity of the Service, detect unauthorized access and prevent misuse;
• diagnose errors, maintain and improve the performance and reliability of the Service;
• comply with applicable legal obligations and respond to lawful requests from competent authorities;
• establish, exercise or defend legal claims where necessary.

Where the GDPR applies, we process personal data only where we have a valid legal basis under applicable data protection law. The legal basis depends on the purpose and nature of the processing:

• Creating, authenticating and managing your Vaaau account — performance of a contract (Article 6(1)(b) GDPR).
• Storing, organizing, searching and managing documents at your request — performance of a contract (Article 6(1)(b) GDPR).
• Recognizing and classifying documents, extracting relevant information and expiration dates, and providing AI-assisted functionality requested by you — performance of a contract (Article 6(1)(b) GDPR).
• Managing subscriptions, purchases, renewals, cancellations and refunds — performance of a contract (Article 6(1)(b) GDPR) and, where applicable, compliance with legal obligations (Article 6(1)(c) GDPR).
• Sending necessary service, security and document-related notifications — performance of a contract (Article 6(1)(b) GDPR), or our legitimate interests (Article 6(1)(f) GDPR).
• Protecting the Service, preventing fraud or unauthorized access, maintaining security and diagnosing technical issues — our legitimate interests in operating and protecting Vaaau securely (Article 6(1)(f) GDPR).
• Complying with applicable laws and lawful requests from competent authorities — compliance with a legal obligation (Article 6(1)(c) GDPR).
• Establishing, exercising or defending legal claims — our legitimate interests (Article 6(1)(f) GDPR), or other applicable legal grounds.

Special Categories of Personal Data

Uploaded documents may contain special categories of personal data within the meaning of Article 9 of the GDPR, including health information and other sensitive information described in Section 2.

Where we process such data, we require both a legal basis under Article 6 of the GDPR and an applicable condition under Article 9 of the GDPR.

Where required, we rely on the explicit consent of the data subject under Article 9(2)(a) of the GDPR. Such consent must be specific and informed and may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

If an uploaded document contains special categories of personal data relating to another individual, such data may only be uploaded and processed where an applicable legal basis and an exception under Article 9 of the GDPR exist.

Consent

Where processing is based on your consent, you may withdraw that consent at any time through the available Service settings or by contacting us at hello@profsoft.ae.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If the relevant processing is necessary to provide a feature you requested, withdrawing consent may prevent us from continuing to provide that feature.

Legitimate Interests

Where we rely on our legitimate interests under Article 6(1)(f) of the GDPR, we assess whether the processing is necessary for the relevant legitimate interest and whether your rights and freedoms override that interest.

Our legitimate interests may include maintaining the security, integrity and reliability of Vaaau, preventing fraud and misuse, resolving technical issues and protecting our legal rights.

Vaaau uses artificial intelligence and other automated technologies to provide certain features of the Service.

How We Use AI

When you upload documents or use AI-powered features, Vaaau may automatically:

• recognize and classify documents;
• extract text and relevant information from documents;
• identify document types and expiration dates;
• organize and index information for search;
• process questions relating to your documents;
• generate answers based on the information contained in your documents.

AI-generated responses are provided for informational purposes and may be inaccurate or incomplete. Users should verify important information against the original documents.

AI Service Providers

To provide AI-powered functionality, Vaaau currently uses the following AI services:

• Cohere models through Amazon Bedrock in the AWS Europe (Frankfurt) Region, Germany, for generating embeddings and reranking information used for document search and retrieval;
• Mistral AI OCR, for optical character recognition and extraction of information from documents and images, with processing configured in France;
• Anthropic Claude Haiku 4.5 through Amazon Bedrock in the AWS Europe (Frankfurt) Region, Germany, for AI-powered chat and answering questions based on user documents.

Only the information necessary to perform the relevant operation is transmitted to the applicable AI service.

Where AI models are accessed through Amazon Bedrock, the relevant model providers do not have access to Vaaau's Amazon Bedrock account, service logs, prompts or completions through Amazon Bedrock.

We may replace or update AI models and service providers as the Service develops, provided that any such processing continues to comply with applicable data protection requirements.

Use of Data for AI Training

We do not use your uploaded documents, personal data, questions or AI-generated responses to train or fine-tune AI models for our own purposes.

We select and configure third-party AI services so that user content processed through Vaaau is not used to train their general-purpose AI models, unless we clearly inform you otherwise and have an appropriate legal basis under applicable data protection law.

Automated Decision-Making

Vaaau does not use artificial intelligence or automated processing to make decisions about users that produce legal effects or similarly significantly affect them within the meaning of Article 22 of the GDPR.

AI functionality is used to assist with document recognition, organization, search and information retrieval and does not determine a user's eligibility for employment, credit, insurance, healthcare or other similarly significant services.

Vaaau may allow users to share documents or information with family members or other authorized users.

Sharing and Access Permissions

You control whether and with whom you share documents or information through Vaaau.

Depending on the available functionality, you may grant another user access to specific documents, information or sections of a family vault.

A person who receives access may be able to view or otherwise use the shared information within the scope of the permissions granted to them.

You are responsible for ensuring that you are lawfully entitled to share personal data relating to other individuals and for selecting appropriate recipients and access permissions.

Managing and Revoking Access

Where the relevant functionality is available, you may change or revoke access permissions through Vaaau.

Revoking access prevents the relevant user from accessing the information through Vaaau from that point forward. However, we cannot control copies or information that another user may have lawfully downloaded, exported or otherwise obtained before access was revoked.

Protection of Shared Information

We implement technical and organizational measures designed to restrict access to documents and personal data to authorized users.

Access to shared information is limited according to the permissions granted through the Service. Users should not share their account credentials and should take reasonable steps to protect access to their accounts.

We do not sell your personal data.

We may disclose personal data only where necessary to provide, operate, secure and support Vaaau, or where disclosure is required by applicable law.

Service Providers

We may share personal data with third-party service providers that perform services necessary for the operation of Vaaau, including:

• Amazon Web Services (AWS), including Amazon Bedrock, for cloud infrastructure and AI-powered functionality. Vaaau uses models made available through Amazon Bedrock, including Cohere models for embeddings and reranking and Anthropic Claude Haiku 4.5 for AI-assisted chat;
• Mistral AI, for OCR and extraction of text and information from uploaded documents and images;
• Apple and Google, where you choose to use their authentication services to create or access your account;
• Apple App Store, Google Play and other authorized payment providers, for processing purchases, subscriptions, renewals, cancellations and refunds;
• email, notification and customer support providers, where necessary to communicate with users and provide support;
• security, monitoring and technical service providers, where necessary to protect, maintain and improve the Service.

Where AI models are accessed through Amazon Bedrock, the relevant model providers do not receive direct access through Amazon Bedrock to Vaaau's account, service logs, prompts or model responses.

Service providers that process personal data on our behalf are required to process such data only for the relevant purposes and in accordance with applicable contractual and data protection requirements.

Where a third-party provider acts as an independent controller of personal data, its processing is also governed by its own privacy policy and applicable data protection law.

Other Users

Personal data may be disclosed to family members or other authorized Vaaau users where you choose to share documents or information with them.

Such disclosure is limited to the access permissions granted through the Service, in accordance with this Privacy Policy.

Legal and Professional Disclosures

We may disclose personal data:

• to competent public authorities, courts or regulators where required by applicable law or a lawful request;
• where necessary to establish, exercise or defend legal claims;
• to legal, accounting, audit or other professional advisers where reasonably necessary for the provision of their services;
• in connection with a merger, acquisition, restructuring, financing or transfer of all or part of our business, subject to applicable data protection requirements.

Data Location

Vaaau is designed so that the primary storage and processing of user data takes place within the European Economic Area ("EEA").

AI-related processing is currently configured primarily within Europe, including:

• Amazon Bedrock services in the AWS Europe region, including Frankfurt, Germany;
• Mistral AI OCR processing configured in France.

Depending on the configuration of Amazon Bedrock, certain AI requests may be processed in another AWS region within the European geographic boundary while remaining within Europe.

We seek to keep the storage and processing of documents and their contents within the EEA wherever reasonably possible.

Data Security

We implement appropriate technical and organizational measures designed to ensure a level of security appropriate to the nature and sensitivity of the personal data processed through Vaaau and the risks associated with such processing.

These measures include, as appropriate:

• protection of personal data during transmission and storage through appropriate encryption and secure communication technologies;
• access controls designed to ensure that personal data and uploaded documents are accessible only to authorized users, personnel and systems that require such access;
• authentication and account security measures designed to prevent unauthorized access;
• logging and monitoring of administrative and security-relevant access to systems containing personal data;
• protected backup and recovery procedures designed to preserve the availability and integrity of data;
• technical monitoring, security updates and measures designed to identify and address vulnerabilities, unauthorized access and other security incidents.

Access by PROFSOFT GLOBAL - FZCO personnel to user documents and their contents is limited to circumstances where such access is reasonably necessary for customer support, security investigations, technical maintenance, compliance with legal obligations or the protection of the Service and its users.

Personnel and service providers who are authorized to process personal data are subject to appropriate confidentiality and data protection obligations.

We periodically review our technical and organizational security measures and update them where appropriate, taking into account the state of the art, the nature of the processing and the risks to users.

No electronic system can guarantee absolute security. If we become aware of a personal data breach, we will assess and respond to the incident and make any notifications to affected individuals and competent supervisory authorities required by applicable data protection law.

We retain personal data only for as long as necessary for the purposes for which it was collected and processed, unless a longer retention period is required or permitted by applicable law.

Retention Periods

Unless a longer period is required by applicable law or is necessary for the establishment, exercise or defence of legal claims, we apply the following retention periods:

• Account information: retained while your Vaaau account is active and removed from active systems within 30 days after account closure, unless continued retention is required by applicable law.
• Uploaded documents and extracted information: retained while the relevant documents remain in your account. When you delete a document or close your account, the document and related extracted information are removed from active systems within 30 days. Copies contained in backup systems may remain until the relevant backup is deleted or overwritten in accordance with the backup cycle described below.
• AI questions and responses: retained for up to 90 days after the relevant interaction, unless you delete them earlier or a longer period is necessary to provide functionality specifically requested by you.
• Subscription, billing and transaction records: retained for the period required by applicable tax, accounting and financial laws. Where UAE Corporate Tax record-keeping requirements apply, relevant records are retained for at least seven years following the end of the Tax Period to which they relate.
• Technical, security and diagnostic logs: retained only for the period reasonably necessary for security, fraud prevention, troubleshooting and compliance purposes and deleted or anonymized when no longer required.
• Backup copies: deleted or overwritten as part of the normal backup cycle and, in any event, within 90 days after the relevant data has been removed from active systems, unless a longer period is required by law.

After the applicable retention period expires, personal data is securely deleted or irreversibly anonymized.

Account and Document Deletion

You may delete individual documents through the available Vaaau functionality and may request deletion of your account and associated personal data.

You may also submit a deletion request by contacting us at hello@profsoft.ae.

Following deletion of your account, personal data associated with the account will be deleted or anonymized within 30 days, except where retention of specific information is necessary to:

• comply with a legal obligation;
• retain required tax, accounting or transaction records;
• establish, exercise or defend legal claims;
• investigate or prevent fraud, misuse or security incidents where continued retention is permitted by law.

Personal data may remain in backup copies for up to 90 days after its removal from active systems. During this period, backup data is retained solely for disaster recovery, security and business continuity purposes and is not used for the ordinary operation of the Service. If a backup is restored during this period, data previously subject to a valid deletion request will be deleted again in accordance with our deletion procedures.

Where another Vaaau user has lawfully downloaded, exported or otherwise obtained information that you shared with them, deletion of that information from your account does not automatically delete copies independently retained by that user.

Your rights depend on the data protection laws applicable to you and to our processing of your personal data. As Vaaau is primarily designed for users in Europe, the rights set out under the GDPR form the primary framework of this Section.

Rights of Users in the EEA under the GDPR

Where the GDPR applies, you have the right to:

• access your personal data and obtain information about how it is processed;
• correct inaccurate or incomplete personal data;
• request deletion of your personal data, subject to applicable legal exceptions;
• restrict processing of your personal data in certain circumstances;
• receive and transfer your data in a structured, commonly used and machine-readable format where the right to data portability applies;
• object to processing based on our legitimate interests, including the right to object at any time to processing for direct marketing purposes;
• withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• exercise applicable rights relating to automated decision-making, including the right not to be subject to a decision based solely on automated processing where such decision produces legal or similarly significant effects;
• lodge a complaint with a competent data protection supervisory authority in the EEA.

Vaaau does not currently use automated processing to make decisions that produce legal or similarly significant effects on users.

How to Exercise Your Rights

You may exercise your rights by contacting us at: hello@profsoft.ae

Users in the European Union may also contact our EU Representative:

• Kirill Olegovich Kaplin
• Rua da Seca do Bacalhau, 440, Fração Y
• Canidelo, Vila Nova de Gaia
• 4400-396, Portugal
• E-mail: hello@profsoft.ae

We may request information reasonably necessary to verify your identity before processing a request.

Where the GDPR applies, we will respond to a valid request without undue delay and normally within one month of receipt. Where permitted by law, this period may be extended due to the complexity or number of requests, in which case we will inform you accordingly.

Certain rights may be subject to limitations and exceptions provided by applicable law.

Additional Rights for Users in the United States

Depending on your state of residence and the applicability of the relevant U.S. privacy law to Vaaau, you may have additional rights, including rights to access, correct or delete personal information, receive a portable copy of your data, and opt out of certain uses or disclosures of personal information where required by law.

Vaaau does not sell personal data.

Where applicable U.S. privacy law provides additional rights, we will process requests in accordance with that law.

Additional Rights for Users in the UAE

Where UAE data protection law applies, you may have additional rights, including rights to access information about the processing of your personal data, request correction or deletion, restrict certain processing, request data portability where applicable, withdraw consent and exercise rights relating to certain automated processing.

Requests relating to these rights may be submitted to hello@profsoft.ae.

Minors

Vaaau is intended for use by individuals who are 18 years of age or older.

An adult user may upload and store documents relating to their children or other minors where the user is lawfully entitled to provide and process such information. The processing of such data is subject to the provisions of this Privacy Policy.

If we become aware that an individual under 18 has created an account or provided personal data directly to us without an appropriate legal basis, we may delete the relevant information and close the account.

Cookies and Similar Technologies

Our website and Service may use cookies, software development kits (SDKs), local storage and similar technologies where necessary to:

• authenticate users and maintain secure sessions;
• remember essential settings and preferences;
• protect the Service and prevent unauthorized access;
• diagnose technical errors and maintain Service performance.

Technologies that are strictly necessary for the operation and security of the Service may be used without consent where permitted by applicable law.

If we use non-essential analytics, advertising or similar technologies that require consent under applicable law, they will only be activated after obtaining the required consent. You may withdraw or change such consent at any time through the available settings or consent management tools.

Where necessary, additional information about these technologies will be provided through our Cookie Policy or relevant consent interface.

Service and Marketing Communications

We may send communications necessary for the operation of Vaaau, including:

• account and authentication messages;
• security notifications;
• subscription and payment information;
• document expiration reminders;
• important Service or legal updates;
• responses to support requests.

These communications are necessary for the operation of the Service and may not always be subject to an opt-out.

We may send marketing or promotional communications where permitted by applicable law and, where required, after obtaining your consent. You may unsubscribe from marketing communications at any time using the unsubscribe mechanism provided in the relevant message or by contacting us at hello@profsoft.ae.

Push notifications may be managed through your device or application settings.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our data processing practices or applicable legal requirements.

The current version of this Privacy Policy will always indicate the date of its latest update.

If we make material changes that significantly affect how we process personal data or your rights, we will provide appropriate notice, including through the Service or by email, at least 30 days before the changes take effect, where reasonably practicable.

Where a change requires your consent under applicable data protection law, we will request such consent before the relevant processing begins.

We encourage you to review this Privacy Policy periodically.

Contact Us

If you have any questions about this Privacy Policy, our processing of personal data or wish to exercise your data protection rights, you may contact us:

• PROFSOFT GLOBAL - FZCO
• Registration Number: DSO-FZCO-19380
• License Number: 21028
• DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE
• Tel.: +971 585798657
• E-mail: hello@profsoft.ae

EU Representative

For GDPR-related matters, users in the European Union may also contact our representative under Article 27 of the GDPR:

• Kirill Olegovich Kaplin
• Rua da Seca do Bacalhau, 440, Fração Y
• Canidelo, Vila Nova de Gaia
• 4400-396, Portugal
• E-mail: hello@profsoft.ae