Information notice
Clad Vault Information Notice
Effective 1 August 2026
1. Data Controller
Pursuant to the Personal Data Protection Law No. 6698 (the “Law”), your personal data are processed by LARİNSOFT BİLİŞİM TEKNOLOJİ A.Ş. (“Larinsoft”), acting as the data controller, within the scope described below.
This Information Notice has been prepared in relation to the processing of personal data of persons who use the Clad Vault mobile application, the Clad Vault services at www.cladvault.com and app.cladvault.com, and who contact Larinsoft through Larinsoft’s electronic communication channels.
2. Personal Data Processed
Within the scope of using Clad Vault or communicating with Larinsoft, the following personal data may be processed:
Identity Information
- Name and surname.
Contact Information
- E-mail address,
- telephone number,
- other contact information provided by the data subject.
Account Information
- Check-in interval,
- last check-in time,
- KVKK and privacy policy consent records.
Authentication Information
- Account information created with e-mail and password,
- Google or Apple account identifiers where sign-in with those providers is used.
Vault Information
- End-to-end encrypted vault contents and vault metadata.
Clad Vault uses a zero-knowledge architecture. Your vault contents are encrypted on your device; Larinsoft does not have access to your secrets in plaintext.
Trusted Contact and Invitation Information
- Trusted contact e-mail address,
- invitation and consent records.
Request and Communication Information
- Subject of communication,
- content of messages and requests sent to info@larinsoft.com,
- correspondence with Larinsoft and the related records.
Transaction Security and Technical Information
- IP address,
- date and time of access,
- server, access and security logs generated within the scope of ensuring the security of the application, website and information systems.
Larinsoft does not request special categories of personal data through Clad Vault. Please do not provide Larinsoft with special categories of personal data that are not necessary for the service or communication purposes.
3. Purposes and Legal Grounds for Processing Personal Data
Your personal data are processed for the purposes set out below and on the basis of the personal data processing conditions set out in Article 5 of the Law.
Provision of the encrypted vault service and account management
Name, surname, contact information, authentication information, account information and encrypted vault data are processed for the purposes of:
- creating and managing your Clad Vault account,
- verifying your identity,
- providing the encrypted vault service,
- conducting check-in processes.
These processing activities are based on the legal ground set out in Article 5(2)(c) of the Law, namely that the processing of personal data is necessary, provided that it is directly related to the establishment or performance of a contract.
Conduct of emergency trusted-contact processes
Trusted contact and invitation information are processed for the purposes of:
- sending trusted-contact invitations,
- recording acceptance and related consents,
- managing emergency access processes.
These processing activities are based on the legal ground of performance of a contract as set out in Article 5(2)(c) of the Law.
Evaluation of communication requests
Name, surname, contact information and communication content are processed for the purposes of:
- receiving questions and requests,
- responding to the data subject,
- providing requested information regarding Clad Vault products and services.
These processing activities are based on the legal ground set out in Article 5(2)(f) of the Law, namely that processing is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject.
Ensuring the security of the application, website and information systems
IP addresses and technical access logs are processed for the purposes of:
- operating Clad Vault securely,
- detecting unauthorized access and misuse,
- preventing and investigating information security incidents.
These processing activities are based on Larinsoft’s legitimate interest in ensuring the security of its information systems and Clad Vault services, as provided under Article 5(2)(f) of the Law.
Fulfilment of legal obligations and protection of rights
Personal data may be processed for the purposes of:
- responding to lawful requests from authorized public institutions and organizations,
- fulfilling obligations arising from applicable legislation,
on the legal ground of compliance with a legal obligation as set out in Article 5(2)(ç) of the Law; and, in the event of a dispute, for the purposes of:
- conducting legal proceedings,
- asserting or defending rights and claims,
on the legal ground that processing is necessary for the establishment, exercise or protection of a right, as set out in Article 5(2)(e) of the Law.
4. Method of Collection of Personal Data
Your personal data are obtained electronically, by fully or partially automated means, in the course of:
- using the Clad Vault mobile application,
- using Clad Vault services at www.cladvault.com or app.cladvault.com,
- registering or signing in with e-mail/password, Google or Apple,
- sending or accepting a trusted-contact invitation,
- sending an e-mail to info@larinsoft.com, and
- the operation of the application, website, server and information security systems.
5. Transfer of Personal Data
To the extent required by the relevant data processing activity and where the conditions stipulated under the Law are met, your personal data may be transferred:
- to application, website, server, hosting, e-mail, authentication and information technology service providers,
- to lawyers, consultants and authorized service providers where necessary to protect Larinsoft’s legal rights,
- to authorized public institutions and organizations and judicial and administrative authorities for the purpose of fulfilling legal obligations,
in each case limited to the data necessary for the relevant purpose.
Your vault contents are stored in end-to-end encrypted form; Larinsoft does not share your secrets in plaintext with unauthorized third parties.
Where personal data are transferred abroad, such transfer will be carried out in accordance with the conditions stipulated under Article 9 of the Law and the applicable legislation governing the transfer of personal data abroad.
6. Retention of Personal Data
Your personal data are retained for the period necessary for the purpose for which they are processed and only for the retention periods prescribed by applicable legislation.
Where the reasons requiring the processing of personal data cease to exist, the data are deleted, destroyed or anonymized in accordance with applicable legislation.
7. Your Rights under the Personal Data Protection Law No. 6698
You have the rights set out in Article 11 of the Law in relation to your personal data.
You may submit your requests regarding these rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to:
LARİNSOFT BİLİŞİM TEKNOLOJİ A.Ş.
Üniversiteler Mah. 1596 Cad. No: 95A İç Kapı No: 42 Çankaya / Ankara
or via KEP to: larinsoft@hs01.kep.tr
You may also submit an application to info@larinsoft.com using an e-mail address that you previously notified to Larinsoft and that is registered in Larinsoft’s systems.
Your applications will be concluded as soon as possible depending on the nature of the request and, in any event, within the period prescribed by applicable legislation.
8. Updates to the Information Notice
This Information Notice may be updated in line with changes in applicable legislation, Clad Vault infrastructure or Larinsoft’s personal data processing activities.
The current version is published at www.cladvault.com and is also made available in the Clad Vault application.