Privacy Policy

1. Introduction

Welcome to Bingco ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy through strict Data Minimization. This policy explains how we collect, use, and safeguard your data when you use our IP Vault, Secure Transfer, and Scanning services.

2. Information We Collect

We collect personal information that you voluntarily provide to us when you register for the Services or make a purchase. This data is collected based on your explicit, granular consent provided during registration, which is logged with a secure timestamp for audit purposes.

• Identity Data: Email address, name, and profile information. You can sign in with email and password or with Google. If you use Google sign-in, Google provides your email address, name, and profile-picture URL to our authentication provider (Supabase); we never receive your Google password or access any other part of your Google account.
• Digital Assets & Attachments: Images you upload to the Vault for protection, as well as temporary project files uploaded for secure client delivery.
• Client/Recipient Data: Names and email addresses of third parties (your clients) that you input to generate licenses or send secure transfer notifications.
• Audit & Tracking Data (recipients of secure transfers): When you receive a transfer and view, accept a licence, or download it, we record, on the sender's behalf, the name and (if the sender supplied it) email address associated with the delivery, your IP address, your browser user agent, UTC timestamps, and — where the sender requires a signature — the signature image you draw and the exact contract text you agreed to together with a cryptographic hash of it. This forms the sender's legal audit trail and is not used for any other purpose. You are shown notice of this collection in the acceptance flow before you accept. See "Recipients of Secure Transfers" below.
• Security Records: To protect accounts and links, we keep limited security logs: a record of failed password attempts on password-protected transfer links (the link identifier, the IP address the attempt came from, and a timestamp), used only to rate-limit brute-force guessing; and, when you pass the consent gate at sign-up or first sign-in, the IP address, browser user agent, timestamp and policy version recorded against your consent.
• Metadata: Titles, descriptions, and timestamps associated with your assets and transfers.
• Payment Data: We do not store your credit card numbers. All payment data is handled securely by our third-party processor, Stripe.

2a. Recipients of Secure Transfers

If someone sends you files through Bingco, you are a data subject even though you do not have a Bingco account. We process your data as described above solely to deliver the files and to create the sender's record of what was delivered and agreed. The delivered files themselves are deleted when the transfer link expires or is revoked (see Section 8), but the acceptance record — name, contact if provided, IP address, user agent, timestamps, and any signature and agreed contract text — is retained as the sender's audit trail.

That record is kept for as long as the sending account exists and is deleted when the sender deletes their account (for self-service deletion, after a 7-day grace period). Because the sender is the party who holds this record, requests to access or delete it should be directed to the sender; you may also contact us at support@bingco.co and we will act on or forward your request.

3. How We Use Your Data

We use your data solely to provide the IP protection and delivery services offered by Bingco:

• To generate forensic watermarks and cryptographic hashes of your images.
• To facilitate secure file transfers, generate legally binding digital licenses, and send delivery notifications to your clients.
• To verify the existence and integrity of your assets at the time of registration via our public verification endpoints.
• To process recurring subscription payments and manage your plan limits.
• To maintain secure account access and authentication.

We do not sell your personal data, uploaded assets, or your clients' contact information to third parties or advertisers.

4. Blockchain & Public Data

To provide cryptographic evidence that your asset existed at a specific point in time, hashes (digital fingerprints) of your assets are anchored to the Polygon public blockchain. Anchoring transactions are broadcast to the Polygon network through a third-party RPC endpoint; only the hash and a timestamp are transmitted, and no personal data is included. Please note that data written to a blockchain is permanent and cannot be deleted or altered.

Privacy Protection: A SHA-256 cryptographic hash is a fixed-length mathematical representation of your file, computed using a one-way function. It cannot be used to reconstruct your original file, and it does not contain or reveal any information that could identify you as an individual. We never store your name, email, or the visual content of your file on the blockchain — only the hash and a timestamp.

Public Certificate Copy: Each protected asset has a public verification certificate page. A reduced-resolution, watermarked copy of the image (up to 1500px on its long edge) is displayed there and is served from a public URL, so anyone with the certificate link can view that watermarked copy. Your original, full-resolution file is never made public and is never shown on the certificate.

5. Your Privacy Rights (Right to be Forgotten)

Depending on your location (e.g., under the GDPR, CCPA, or Australian Privacy Principles), you have the right to access, correct, or permanently delete your personal data. You can exercise your "Right to be Forgotten" by deleting your account in your settings or contacting us.

Upon request, we will permanently delete your email identity and original high-resolution artwork from our active servers and third-party sub-processors within 30 days. (Note: The anonymous blockchain transaction hash will remain indefinitely as proof of existence).

6. International Data Transfers

As a global platform, your data may be transferred to and processed in countries outside of your own (e.g., the United States or Australia). We ensure that all international data transfers are protected by strict safeguards, including Data Processing Agreements (DPAs) with our sub-processors and Standard Contractual Clauses where applicable.

7. Sub-processors

We engage the following third-party sub-processors to deliver our services. Each is engaged under a data processing agreement and processes only the data necessary for its function:

• Supabase (United States) — Authentication, database, and file storage. Holds your account data, asset records, and uploaded files.
• Render (United States) — Application hosting and deployment. Processes all requests made to bingco.co. Render serves this traffic through its own edge/CDN provider, Cloudflare, which processes connection metadata including IP addresses. Cloudflare is engaged by Render as part of its hosting service, not separately by Bingco.
• Google (United States) — Optional sign-in provider. When you choose to sign in with Google, Google authenticates you and provides your email address, name, and profile-picture URL. Used only for account sign-in.
• Stripe (United States) — Payment processing and subscription management. Processes billing data on your behalf; we do not store card numbers.
• Resend (United States) — Transactional email delivery. Sends welcome emails, secure transfer notifications, and system alerts to you and your recipients.
• SerpApi (United States) — Web search API used by the Theft Scanner. When you run a scan, a reverse-image query is submitted to SerpApi containing a reference to your asset's image URL or hash. No personal identity data is included in these queries.

8. Data Storage, Retention & Security

We implement industry-standard security measures, including encryption in transit (SSL) and at rest. Your original high-resolution files are stored in private, restricted-access storage buckets.

Temporary Secure Transfers: Files uploaded for client delivery are stored temporarily. These files are accessible only via cryptographically secure URLs and are strictly bound to the auto-expiration timeframe tied to your subscription tier (3, 7, or 30 days). Once a transfer expires or is manually revoked, access is immediately terminated, and the files are slated for automated deletion from our servers to minimise data retention.

Retention periods: Account data and asset records are retained while your account is active and deleted on account deletion (blockchain hashes excepted — see Section 4). Licence acceptance records are retained for as long as the sending account exists and are deleted when that account is deleted (for self-service deletion, after a 7-day grace period). Consent records are retained for the life of the account and deleted with it. Failed-password-attempt security logs are automatically deleted within approximately 48 hours.

9. Browser Extension

The Bingco browser extension for Google Chrome provides quick access to the secure transfer and delivery status features described in this policy. The following applies to data handled by the extension specifically.

• Locally stored data: When you sign in through the extension, your authentication token is stored in your browser's local extension storage on your device. This is used solely to keep you signed in between sessions and is not accessible to other extensions or websites.
• Transmitted data: Files and recipient information you provide when sending a transfer are transmitted to bingco.co for processing and storage, as described in Section 2. When you open the dashboard, your recent transfer metadata (recipient names, file names, delivery status) is retrieved from your Bingco account. Authentication credentials are transmitted to bingco.co to verify your identity.
• Data destination: All network requests made by the extension are sent exclusively to bingco.co. The extension does not transmit data to any third party.
• Browsing data: The extension does not read, collect, or transmit your browsing history or the content of any website outside bingco.co.

No data handled by the extension is sold or shared with third parties for any purpose.

Note: Bingco was formerly known as Vulta. Records, certificates, and archived emails referencing the Vulta name remain valid and refer to the same service.

10. Contact Us

If you have questions about this policy, wish to revoke consent, or want to exercise your data privacy rights, please contact us at support@bingco.co or via our support page.