Privacy Policy

Summary

We're a small, veteran-owned software company in Reno-Sparks, Nevada. We collect what we need to run a working website, respond to product inquiries, operate the MyVaultMate subscription, and understand how our site is being used. Everything we collect lives on a server we run ourselves (a virtual private server rented from Hostinger; see section 5), apart from payment details, which Stripe holds. We don't sell anyone's data, share it with advertisers, or hand it off to third-party analytics vendors. Anyone can ask for their data to be deleted at any time.

1. Who we are

CMTechSoftware LLC (“CM Tech Software”, “we”) is a veteran-owned software company operated by Chris Martinez, based in Reno-Sparks, Nevada (United States). We're the data controller for everything described below. Contact: support@cmtechsoftware.io · (775) 229-2579.

2. What we collect

2.1 When you visit any public page on cmtechsoftware.io

Always, to run and protect the site: our web server writes standard access logs for every request — your IP address, the URL you requested, your browser's User-Agent string, the page you came from, and the timestamp — kept about 30 days. These are essential to operate the site, debug problems, and detect abuse, so they're recorded regardless of your cookie choice (we rely on legitimate interest for them, not consent).

Only if you accept analytics in our cookie banner, we additionally capture behavioral analytics to understand how the site is used. If you decline, none of the behavioral tracking below runs and the cm_vid cookie is not set — only the essential cookies that keep the site working (your session and CSRF token) are used. You can change your choice any time via Cookie settings in the footer. When you've consented, we collect:

• First-party visitor cookie (cm_vid, 2-year expiry): a random UUID that lets us recognize that the same browser returned, without tying it to your real identity. The cookie is set by our server and read back by our own JavaScript. It is not shared with any third party.
• Per-page-load session ID (in your browser's memory, not stored on your machine): a random UUID that groups the events on a single page load together.
• Click positions and element identifiers: when you click somewhere on a page we record the click's x/y coordinates, the CSS selector + visible text of what you clicked, your viewport size, the device class (mobile / tablet / desktop), the URL, and the visitor + session identifiers.
• Mouse-movement samples: throttled to roughly five samples per second and only when the pointer has actually moved more than 20 pixels, we record the position and a millisecond offset from page load. This is used to render mouse-trail heatmaps so we can see where attention concentrates.
• Scroll depth: the deepest percentage of the page you scrolled to during a visit.
• Page-visit duration: how many seconds you spent on each page before leaving.
• Self-hosted analytics events (via Umami, running on our own server): the URL of each page view, anonymized referrer, country (derived from IP without storing the IP), device/browser/OS class, and a small set of custom events we track (form submissions, button clicks, phone-link clicks, file downloads, outbound-link clicks, time-on-page buckets, scroll-depth thresholds).

2.2 When you submit a form

We collect whatever you put in the form. Depending on which form:

• Product demo / interest request: name, company, email, phone (optional), type of business, and your message. A demo request also sets up a MyVaultMate trial account for you with the same details, so we can run the demo on your own computers.
• Trial, founding-member and account sign-up: name, email, company, phone (optional), roughly how many computers or people you have, your type of business, the plan you choose, and a password (stored salted and hashed, never in plain text).
• Newsletter: email and optionally name. Double opt-in — you'll get a confirmation email and we don't add you to the list until you click it. Once confirmed, you receive our general newsletter: an educational content series sent on a schedule. Every email has a one-click unsubscribe link, and section 2.5 explains how we measure engagement.

2.3 When you use MyVaultMate (trial or paid)

If you start a trial of MyVaultMate or subscribe to it, we also collect what's needed to run your subscription and the payment:

• Billing information: handled entirely by Stripe. We never see, store, or have access to your card or debit number, bank-account details, or billing/postal address — none of it is written to our database or kept on this website. Stripe collects and maintains all of it and gives us back only a Charge identifier, the last four digits, the card brand, and the amount. When you save a card to start a trial, Stripe keeps it with your account there so that choosing a plan later can charge it; nothing is charged until you do. See Stripe's privacy notice for what they collect.
• Scan results from the MyVaultMate agent: the agent reads files on your computers locally and sends us only metadata about what it found: the computer's name, machine ID (the identifier the operating system gives the computer), operating system and version (with its kernel version and processor type), whether its system disk is encrypted (BitLocker on Windows, LUKS on Linux; used to weight the risk score), and the program version, together with the email address of the account that signed the computer in (if it was signed in rather than connected with a code); for each finding, the file path, the kind of file (document, image and so on), the kind of data detected, a severity, the compliance frameworks involved, the label next to the value when there is one (such as “DOB”), when it was found, and at most a short redacted sample; for each file with a finding or that could not be read, its size, date modified, how much of it was read, where in the file a finding sits (such as a page and line, or a spreadsheet cell), and a fingerprint of its contents (a SHA-256 hash, which cannot be turned back into the contents); and for each scan, when it ran and how many files it looked at. While a scan runs, the computer also reports its progress for the dashboard's live view: the folder it is reading (tagged too when names are kept off the dashboard), counts, and its latest findings in the same masked form; each update replaces the last. Each distinct value found is its own finding, so counts come from the number of findings, not from any stored value. To keep scans fast, a file stops at the first part where something is found (at most 10 findings) and is read to the end in a later overnight full count, so counts can rise after that. A redacted sample looks like ***-**-1234 and is capped at 64 characters. We never receive the files, their contents, or the full sensitive values, and no field in our database can hold one. A file path or file name can itself contain a person's name. If they do, switch on Keep file names off the dashboard (Scan settings): each computer replaces every file and folder name with a tag before sending, using a key that never leaves the computer, so the dashboard never receives the names; the computer's own report files then stay on the computer. The agent also uploads its own scan report (built from the same metadata) to your dashboard. You choose which drives and folders are scanned. Each scan's report files (a PDF report, a raw-data CSV, and HTML and JSON versions; they hold the same metadata and masked samples, never file contents) are stored with the computer for the most recent 25 scans of that computer, then deleted along with the older scans.
• Office locations: the sites you add to your account (name, nickname, city, state and an optional street address) and which computers are at each.
• Subscription and usage records: your plan, invoices, the data you enter into the product, support messages, and status changes — kept while your subscription is active and for our internal records afterwards.
• Email log: a copy of every transactional email we send to you (subject, body, slug, timestamp, success/failure) so we can prove what was sent in case of dispute. Every email we send ends with a small reference number, and we keep a record of each number with its recipients and subject so we can look up a message.
• Product emails: while your MyVaultMate subscription (or trial) is active, starting when your trial starts (your first computer), we send onboarding and educational emails about the product. They stop automatically when the subscription ends, and every email has a one-click unsubscribe link. Engagement is measured as described in section 2.5.

2.3a What the MyVaultMate program keeps on your computers

The program stores a few files on each computer it runs on, all in one folder (run it with --where to list them): its settings and connection (the connection token is encrypted), a list of the files it has already checked with their size, date and a fingerprint (so later scans re-read only what changed), its log (14 days), a short status file, and the reports of the newest 25 scans (HTML, JSON, CSV and PDF). If an administrator switches on the optional reader for a computer, the folder also holds it: a separate program, downloaded once from our server, that reads pictures and scanned PDF pages on that computer and cannot connect to the internet. Those local reports include the real file paths even when names are kept off the dashboard, so the office can find the files; they never contain file contents or full sensitive values. Text read from files is checked in memory and never written to disk. The program moves or deletes a file only when someone chooses to: the person at the computer (from its Review files page, or by putting files in its encrypted Quarantine or Vault), or an administrator on the dashboard, who can ask a computer to quarantine, move or delete for good files its own recent scans reported (the request names those files by the path or tag the dashboard already holds; deleting needs the administrator to type DELETE, and the computer checks each file against its own reports again). A Scan setting can also quarantine, move or mark as ignored the files a scan could not read, after each scan; it never deletes them. When someone marks such a file as ignored, we keep its path or tag, who marked it and when. Each computer also sends the list of extra folders set for it, so its dashboard page can show them. It keeps a log of those actions on the computer (paths, sizes and fingerprints); we receive only counts. For each vault we keep one key and a one-way hash of its PIN, so we can check the PIN or your account sign-in before the program can open the vault. We never receive the files in it, their names, or the keys that encrypt them. We keep that key while your account exists, so you can still open your vault after a plan ends.

2.4 What we don't collect or store

• Payment card / debit numbers, bank-account details, and billing/postal addresses — never stored in our database (PostgreSQL) or anywhere on this website. Our payment processor, Stripe, collects and maintains all of it; we only ever see a charge reference and the last four digits.
• Your password in readable form — we store only a salted, one-way hash that cannot be reversed, so no one (including us) can recover your actual password.
• We don't use third-party tracking pixels (no Facebook Pixel, no Google Analytics, no LinkedIn Insight, no advertising cookies). Our own newsletter and product emails do include first-party, self-hosted open- and click-tracking so we can measure engagement — this is described in section 2.5, stays on our own servers, and is never shared.
• We don't use third-party fonts that report back (we self-host fonts).
• We don't sell, rent, or share personal data with advertising networks, data brokers, or any external mailing-list service.
• We don't load videos or chat widgets from third-party providers.
• We don't collect biometric data, precise geolocation, or anything from minors under 13, and we never receive your files or the full sensitive values the MyVaultMate agent finds in them (see 2.3 for the limited metadata it does report). File paths can include client names; if yours do, switch on Keep file names off the dashboard (see 2.3).

2.5 Email engagement (our newsletters and product emails)

Our marketing emails — the general newsletter and the product onboarding/education series — include lightweight, first-party engagement tracking so we can tell whether our emails are useful and improve them:

• Opens: a small, invisible image (a "tracking pixel") served from our own server. When your email app loads images, it tells us that message was opened, and when.
• Clicks: links in these emails route through our own server before forwarding you to the destination, so we can count which links were clicked.

This tracking is first-party and self-hosted — it runs on our servers, is tied only to your subscription record, and is never sent to or shared with any third party or ad network. It applies to marketing emails, not to transactional emails (receipts, password resets, and the like). You can avoid it by keeping images turned off in your email app, and you can stop the emails entirely with the one-click unsubscribe link in every message. Engagement records follow our behavioral-data retention window (see section 4).

2.6 When you're an affiliate partner

If you join our invite-only affiliate program, we collect what's needed to attribute your referrals, pay you, and meet our tax obligations:

• Contact & business details: your name, business name, email, and phone.
• Tax information (Form W-9): your legal/business name and taxpayer identification number (EIN, or SSN/TIN). Your EIN/TIN is encrypted at rest, shown only in masked form in the portal, and revealed in full only to you — after a password step-up and with an audit-trail entry. It is automatically purged after a 90-day retention window.
• Payout (ACH) details: your bank name, routing number, and account number, so we can pay commissions by bank transfer. These are encrypted at rest and masked in the portal (same reveal-with-audit protection as above); we keep them while your affiliate account is active so we can pay you.
• Referral & payout records: which customers you referred, the commissions earned, and the quarterly payouts made.
• Referral cookie (cmtech_ref, first-party, ~30-day expiry): set only when a visitor arrives through an affiliate referral link (a ?ref= link), so that if they later become a customer we can credit the referring affiliate. It's a functional cookie for the referral program, set by our own server, and never shared with any third party.

Affiliate accounts require two-factor authentication, and every access to a sensitive tax or bank field is written to an append-only audit log.

3. Why we collect it (lawful basis)

• To run the website (server logs, session cookies, CSRF tokens): legitimate interest in keeping the site working and secure.
• To respond to your inquiries and operate MyVaultMate (form data, account data, subscription records): performance of a contract (or steps before one).
• To understand how the site is used (visitor cookie, click + scroll + mouse-trail tracking, self-hosted analytics): your consent, given through our cookie banner and withdrawable at any time via "Cookie settings" in the footer. None of this runs until you accept, and your data is never transmitted to anyone else.
• To send transactional email (signup confirmation, password reset, payment receipt): performance of a contract.
• To send the general newsletter: your consent (which you give by confirming the double opt-in). You can unsubscribe at any time using the link in every email.
• To send product onboarding and education emails to customers about MyVaultMate: our legitimate interest in helping you get value from what you're paying for. You receive these only while you have an active subscription, and you can unsubscribe at any time.
• To measure email engagement (opens and clicks on our marketing emails, section 2.5): our legitimate interest in improving those emails. It's first-party, self-hosted, never shared, and you can opt out by unsubscribing.
• To run the affiliate program (contact details, W-9 / tax ID, ACH details, referral and payout records): performance of the affiliate agreement, and — for the tax details — a legal obligation under U.S. tax law.
• To meet legal obligations (tax records, audit logs): legal obligation under U.S. law.

4. How long we keep it

• Server logs: ~30 days.
• Behavioral data (clicks, mouse-movement, scroll): 12 months, then automatically purged.
• Newsletter list: until you unsubscribe.
• Customer account records: as long as the account is active. When an account is closed after 6 months without a plan, its scan data is deleted and sign-in is switched off, but the account record (company name, your people's names and email addresses) is kept with any billing records so the closure stays traceable; ask us and we will delete it. Subscription and billing records (invoices, payments, subscription history): 10 years, for tax and accounting reasons, then deleted automatically (you can request earlier deletion of records that aren't tied to a financial transaction).
• Support messages and our transactional email log: kept while your account is active so we can help you and resolve any dispute over what was sent (entries tied to a payment are kept 10 years, like other billing records); otherwise deletable on request.
• Stripe payment records: per Stripe's own retention; we keep the Charge identifier plus our own subscription and billing notes for 10 years for tax purposes.
• The cm_vid cookie: 2 years from your last visit (rolling).
• Self-hosted analytics events (page visits): 24 months, then automatically purged.
• Scan results (the agent metadata described in 2.3) and office locations: only the newest 25 scans of each computer are kept, with their report files; older scans are deleted automatically. Each scan's counts (dates and numbers only, no file names or findings) are kept for 13 months for the trend in Summary reports. The rest is kept while your subscription is active. When you cancel, it is kept for 90 days in case you come back, then your computers, scans, findings and report files are deleted automatically (your account and settings stay until you close the account). We email the account's contact when a cancellation is scheduled, when it takes effect, each month after that, and a week before the deletion. If a trial or demo ends and no plan is ever chosen, the account is kept paused for 6 months (with a reminder each month and a final notice a week before), then closed: its scan data is deleted, sign-in is switched off and the saved card is removed from Stripe. You can delete a computer and its findings in the dashboard at any time. Encrypted backups roll off on their normal rotation.
• Vault keys and PIN hashes (section 2.3a): kept while the account exists, also after a computer is removed or its scan data is deleted, so a vault can still be opened with the account sign-in; deleted with the account. Once an account is closed or deleted, its vaults can no longer be opened.
• Requests sent to a computer from the dashboard (such as quarantine or folder changes) and their results: kept with that computer's records and deleted with them.
• Affiliate W-9 / taxpayer ID (EIN/TIN): purged 90 days after collection.
• Affiliate ACH bank details: kept while the affiliate account is active (so we can pay you), then removed on request; affiliate referral and payout records are kept 10 years for tax reasons, like other billing records.
• The cmtech_ref referral cookie: ~30 days.

5. Who we share it with

The short version: as few third parties as we can possibly use. The longer version:

• Stripe, Inc. — payment processor. They see your card number and billing address; we don't.
• Hostinger — our VPS hosting provider. The server runs on their infrastructure.
• Our bank and the U.S. Internal Revenue Service (affiliates only) — to pay affiliate commissions by ACH bank transfer and to file the tax forms (e.g. Form 1099) that U.S. law requires. This applies only if you're an affiliate partner.
• A successor business — if CM Tech Software is ever acquired, merged, or sold, customer and subscriber data may transfer to the successor as part of that transaction. The successor will be bound by this privacy policy (or one at least as protective), and if you're a customer or subscriber we'll notify you before the transfer takes effect.
• The U.S. government and any other lawful authority — only if compelled by a valid legal request (subpoena, warrant, court order). We will resist overbroad requests and notify you unless legally prohibited.

That's it. No advertising networks, no analytics aggregators, no CRM SaaS vendors, no email-marketing platforms, no chat tools, no surveillance vendors. If we ever add a vendor that processes personal data, this list will be updated and (if you're a customer or subscriber) you'll be notified before the change takes effect.

6. Your rights

Regardless of where you live, you can ask us to do any of the following by emailing support@cmtechsoftware.io:

• Access the personal data we hold about you, in a portable format.
• Correct anything that's inaccurate.
• Delete what we hold (subject to records we're legally required to keep, like tax records of past payments). Deleting your account also deletes its vault keys, after which files in the program's Quarantine or Vault can't be opened, so take out anything you need first.
• Stop processing for a specific purpose (e.g. opt out of behavioral tracking but keep your customer account).
• Opt out of the newsletter using the one-click link in every email.
• Take your data elsewhere (data portability).

We aim to acknowledge within 5 business days and complete within 30 days. If we say no to any request, we'll explain why.

6.1 If you're a California resident (CCPA / CPRA)

You have the rights listed above, plus the right to opt out of any sale or share of your personal data (we don't do either — but the right is reserved). You can also designate an authorized agent to act on your behalf. We don't discriminate against anyone who exercises these rights.

6.2 If you're in the EU/UK/EEA (GDPR)

You have the rights listed above, plus the right to lodge a complaint with your local data-protection authority. We're a U.S. business and don't actively target the EU, but if you reach out and we engage with you, we'll honor GDPR-equivalent rights.

7. Security

HTTPS site-wide (TLS 1.2+). Passwords stored salted + hashed. Stripe handles all card data. Our database and its backups are stored on encrypted disks on the server. Files in the program's Quarantine and Vault are encrypted on the computer with AES-256-GCM, and the key that opens them is released by our server only after it checks the PIN (with waits after wrong tries) or your account sign-in. Two-factor authentication (an authenticator app) is required for every customer and staff sign-in, on the website and in the MyVaultMate program. The program connects to us only over HTTPS, refuses redirects, and keeps its connection token encrypted on the computer (Windows DPAPI) or readable only by its own account (Linux). For your protection, signed-in sessions are automatically signed out after one hour of inactivity (with an on-screen warning shortly before). Our server uses standard hardening: rate-limiting, CSRF protection, honeypot fields on public forms, signed-cookie sessions, content-type and frame-ancestor headers, and per-user permission separation. No system is unbreakable. If we have a breach that affects you, we'll notify you without undue delay and within the timeframes required by applicable law, by email if we have one on file.

8. Children

This site is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child has submitted information to us, contact us and we'll delete it.

9. International transfers

Our server and Stripe are in the United States. If you submit personal data from outside the U.S., you're consenting to that data being transferred to and processed in the U.S.

10. Changes to this policy

If we change anything material (what we collect, how we use it, who we share it with, retention periods), we will update the "Last updated" date above and notify newsletter subscribers and active customer accounts. Continued use of the site after the change indicates acceptance.

11. Contact

For any privacy question, request, or complaint:
support@cmtechsoftware.io · (775) 229-2579 · CMTechSoftware LLC, Reno-Sparks, Nevada, USA.