Privacy Policy

1. Introduction

This Privacy Policy outlines how Botbari Secure Vault ("we", "us", or "our") collects, protects, uses, and handles your information when you access our multi-tenant credential vault and disaster recovery management systems.

2. Information We Collect

We collect and process the following categories of information strictly to provide vault operations and enforce multi-factor security:

A. Administrative Account Information

• Account Identifiers: Username, administrative email address, full name, and affiliated institution or organization.
• Authentication Credentials: Passwords hashed using industry-standard Argon2id (OWASP recommended), verification phrases, and date-of-birth challenges. We never store or log plaintext passwords.

B. Encrypted Vault Assets

• Infrastructure Secrets: Server credentials, database passwords, SMTP credentials, API tokens, and environment parameters (.env).
• Encryption Standard: All secrets are encrypted using reversible authenticated AES-256-GCM. Botbari cannot read or inspect plaintext secret payloads without your master environment key.

C. Technical & Security Telemetry

• Audit Logs: Timestamps of credential access, login successes/failures, IP addresses, and user-agent strings. These records are maintained to provide immutable audit trails and identify unauthorized access attempts.
• Firewall Telemetry: Failed authentication attempts tracked per IP address to automatically trigger rate-limiting and temporary blocks against brute-force attacks.

3. Google Drive API User Data & Limited Use Disclosure

When you choose to enable the Google Drive Cloud Disaster Recovery integration, we request authorization to access your Google account:

• Scope of Access: We request only the minimal necessary permission: https://www.googleapis.com/auth/drive.file (create and access only the files created by Botbari Vault) and https://www.googleapis.com/auth/userinfo.email (to display the connected account).
• How We Use Google Data: Google tokens are utilized exclusively to upload locally encrypted database snapshots (.enc) to a dedicated /Botbari_Vault_Backups folder in your Drive and verify sync status.
• Zero Data Sale or Marketing: We NEVER sell Google user data, share it with third-party advertisers, or use it for marketing, behavioral profiling, or advertising purposes.
• No AI Model Training: Google user data is never used to train generalized artificial intelligence (AI) or machine learning (ML) models.
• Human Access: No human personnel at Botbari read or access your Google Drive files or content.
• Revocation: You can disconnect Google Drive integration at any time directly from the Vault dashboard (/backup) or through Google Account Security Settings. Upon disconnection, stored authorization tokens are permanently purged from our database.

4. How We Use Collected Data

Collected information is used exclusively to:

• Deliver authenticated multi-tenant vault access through our 5-step zero-trust authentication pipeline.
• Transmit single-use verification passcodes (OTP) to your registered email during authentication.
• Execute encrypted automated database snapshots every 24 hours when changes are detected.
• Maintain chronological, immutable security audit logs for regulatory and enterprise auditing.
• Enforce automated IP rate-limiting to prevent unauthorized intrusion.

5. Data Security & Cryptographic Standards

We deploy defense-in-depth cryptographic controls across every layer:

• Cipher: Authenticated AES-256-GCM with 96-bit unique IVs and 128-bit authentication tags to verify ciphertext integrity.
• Key Separation: Master encryption keys (VAULT_ENCRYPTION_KEY) are stored strictly in protected environment files separate from the database.
• Password Hashing: Argon2id memory-hard cryptographic hashing with high computational resistance against GPU-based cracking.
• Encrypted Off-Site Backups: Disaster recovery snapshots are fully encrypted locally (BVENC) prior to network transmission.

6. Data Retention & Deletion

You retain full ownership of your credentials and administrative data. You may create, update, or permanently delete server profiles, API tokens, database credentials, and email credentials at any time. When an asset is deleted, it is removed from active storage immediately.

Automated security audit logs are retained for forensic integrity and operational compliance for a period of up to 365 days, after which they are systematically archived or purged.

7. Children's Privacy

Botbari Secure Vault is an enterprise credential infrastructure platform intended solely for authorized IT personnel, administrators, and educational institution staff. We do not knowingly collect personal information from individuals under the age of 16.

8. Policy Updates

We may periodically update this Privacy Policy to reflect security enhancements or regulatory compliance mandates. Any material updates will be noted with a revised "Effective Date" at the top of this document.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact our Data Protection Team at: