Legal

Privacy Policy

Effective and last updated November 13, 2026

This policy explains what Status Vault collects through the official WhatsApp Cloud API, your Creator Passport, your audio and your electronic signatures — and how we protect, share, retain and delete it.

1. Who we are

Status Vault is a product of Official Status, LLC (“Official Status, LLC”, “we”, “us”). Official Status, LLC operates Status Vault and is the business responsible for the personal information described in this Privacy Policy. Our registered address and contact email appear at the top of this page and in the footer of every page of https://vault.official-status.com.

Where Status Vault processes content on behalf of a label, producer team or management company that operates a workspace (a “Workspace Owner”), we process project content on that Workspace Owner’s instructions as well as for our own purposes described below.

2. Scope

This policy covers the Status Vault website at https://vault.official-status.com, the Status Vault web vault and browser signing pages, and the WhatsApp phone numbers we operate through the official WhatsApp Business Platform (Cloud API) provided by Meta Platforms, Inc. (“Meta”). It does not cover WhatsApp itself; Meta’s handling of your data in the WhatsApp app is governed by WhatsApp’s own terms and privacy policy.

3. Information we collect

WhatsApp messaging data

When you message a Status Vault number or participate in a Status Vault Studio Pod, Meta delivers the following to our webhook:

Your business-scoped user ID (BSUID) — an identifier Meta assigns to you for our business portfolio — and, where Meta provides it, your phone number. If you use a WhatsApp username with phone number privacy enabled, Meta may omit your phone number and we identify you by BSUID alone.
Your WhatsApp profile name and username, if shared by Meta.
Message content you send to us or into a Status Vault Studio Pod: text, commands, audio, documents, images, links, reactions and quick-reply selections, together with message IDs, timestamps, forwarding indicators and delivery or read status updates.
For Studio Pods (groups created by Status Vault through the Cloud Groups API, capped at eight participants): the group ID, invite link, and participant join, leave and settings events.

We only receive messages from chats in which a Status Vault number is a participant. We cannot read any other WhatsApp chat. In larger group chats that Status Vault is not part of, we receive only the files and links that a participant chooses to forward to us in a private 1:1 chat; Meta strips the original group’s identity and the original sender from forwarded messages.

Claim links and opt-in records

When a producer or manager shares a Status Vault claim link and you tap it and send the pre-filled message, you start the conversation with us. We record that you initiated contact, the time you did so, and the project role the link relates to. Claim tokens are cryptographically signed, expire after 72 hours, and are stored only as one-way hashes.

Creator Passport data

To prepare and execute agreements, our private 1:1 WhatsApp Flow or browser signing page may collect:

Legal name, professional name (p/k/a) and email address.
Optionally, a government identification number (used on bilingual agreements where a counterparty requires it), stored encrypted.
Writer information: your performing rights organization (PRO) and Writer IPI Name Number.
Publishing information: your publishing entity or administrator and its Publisher IPI Name Number. Writer and Publisher IPIs are always stored as separate fields.
For producers: loanout company name and address, loanout tax identification number (stored encrypted), SoundExchange payee ID and attorney notice contact.
Your signature: either (a) a camera photo of your handwritten signature in ink on paper, from which we extract a transparent signature image, or (b) your typed legal name. We store SHA-256 fingerprints of both the original photo and the extracted signature image as forensic evidence. The extracted signature image is encrypted before storage.

Audio, stems and session assets

Audio files, stems, documents and images you share with Status Vault.
Content we retrieve from Google Drive, Dropbox, WeTransfer or iCloud links you share, so it is preserved before the link expires. We access only the specific link you share.
Derived technical metadata: SHA-256 file fingerprints, file size, sample rate, tempo (BPM), musical key and integrated loudness (LUFS), and short revision notes extracted from the surrounding chat context.

Agreement and signature records

Deal terms, split percentages, the SHA-256 fingerprint of the locked master audio, compiled agreement PDFs and their SHA-256 fingerprints, and an append-only signature ledger recording, for each signature: your BSUID and phone number as known at signing, the signing channel, a hash of the single-use signing session token, the exact consent statement you accepted, the fingerprint of the signature image applied, the UTC timestamp, and — for browser signing — your IP address and browser user agent.

Website and web vault

Our hosting provider records standard server logs (IP address, user agent, requested URL, timestamp and response status) for security and reliability. If you sign in to the web vault we process the account identifiers needed to authenticate you. This website does not use advertising cookies, cross-site tracking pixels or third-party analytics.

Billing

Paid plans are billed through Stripe. Stripe collects your payment card details directly; we receive a customer identifier, plan and payment status, never your full card number.

4. How we use information

To ingest, rescue, version and play back the audio and documents shared with Status Vault.
To route forwarded files to the correct track or project and to acknowledge them.
To prepare, present, execute, seal and deliver split sheets, producer agreements and letters of direction, and to maintain the evidentiary record of each signature.
To reuse your Creator Passport details on future agreements — only when you affirmatively adopt them for each agreement.
To send you service messages inside conversations you started, such as signing requests and executed PDFs.
To secure the service, verify webhook authenticity, prevent fraud and abuse, and debug failures.
To comply with legal, tax and royalty-accounting obligations and to establish or defend legal claims.

Limited automated processing

We use a large language model (Google Gemini via the Gemini API) strictly for structured extraction: to classify audio version labels, summarize studio revision notes and summarize deal counter-offers. It is not used as an open-ended chatbot and off-topic requests receive a static help menu. No agreement is ever executed by automated means — every signature requires your own affirmative action. We do not use your audio, stems or Creator Passport data to train machine-learning models.

5. Legal bases (EEA, UK and similar jurisdictions)

Performance of a contract — operating your vault, preparing and executing agreements you ask to sign.
Consent — initiating WhatsApp contact through a claim link, consenting to electronic records and signatures, and saving a signature to your Creator Passport. You may withdraw consent at any time without affecting prior lawful processing or previously executed agreements.
Legitimate interests — securing the service, preventing abuse and preserving the integrity of the rights record for all collaborators on a song.
Legal obligation — retaining executed agreements and billing records required for tax and royalty accounting.

6. WhatsApp commitments

We use only the official WhatsApp Business Platform (Cloud API). We never use unofficial clients, scrapers or WhatsApp Web session bridges.
We never message a phone number that has not first contacted us. Collaborators are invited through claim links they choose to tap.
Nobody is added to a Studio Pod without tapping its invite link.
You can stop service messages at any time by sending STOP to the Status Vault number or by blocking it in WhatsApp.
Messages between you and our Cloud API numbers are processed by Meta as our service provider and are subject to the WhatsApp Business terms applicable to us.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

Collaborators on the same song. The Passport details that legally must appear in an agreement (such as legal name, p/k/a, PRO, IPIs, loanout entity and your split) are visible to the other parties to that agreement and to the Workspace Owner of the project.
Workspace Owners see the project content and agreements within their workspace.

Service providers that process data on our behalf under contractual confidentiality and security obligations:

Provider	Purpose
Meta Platforms, Inc.	WhatsApp Business Platform (Cloud API) messaging
Render Services, Inc.	Application hosting and job queue
Supabase, Inc.	Managed PostgreSQL database and authentication
Cloudflare, Inc.	R2 object storage for audio, stems, signatures and PDFs
Google LLC	Gemini API for structured extraction (see “Limited automated processing”)
Stripe, Inc.	Payment processing for paid plans

Link providers you choose. When you share a Google Drive, Dropbox, WeTransfer or iCloud link, we request that file from the provider hosting it.
Legal requirements. When required by law, subpoena or court order, or to protect the rights, safety and property of our users, Official Status, LLC or others.
Business transfers. Status Vault is incubated by Official Status, LLC. If Status Vault is transferred to a successor entity — including a corporation formed to operate Status Vault — or is involved in a merger, financing or acquisition, personal information may transfer as part of that transaction subject to this policy, and we will notify you of any change in the responsible entity.

8. Retention

Data	Retention
Raw webhook payload logs	30 days, then deleted
Unexecuted chat metadata (routing records, revision notes, pending signature requests)	While the project is active, or until you request deletion
Audio, stems and session documents	For the life of the project in its workspace; deleted when the Workspace Owner deletes the project or closes the workspace
Creator Passport details	Until you request deletion (subject to the executed-agreement exception below)
Saved signature image	Until you revoke it or request deletion
Executed agreements, signature ledger and the Passport details reflected in them	For the term of the agreement and the rights it governs, and at least seven years after the last royalty accounting under it
Billing records	As required by tax law

9. Security

All traffic to https://vault.official-status.com and our APIs is encrypted in transit with TLS.
Data is encrypted at rest by our storage providers. Government ID and tax ID numbers are additionally encrypted at the field level with keys held in a secrets vault.
Saved signature images are encrypted with AES-256-GCM envelope encryption before upload to private storage and are never publicly addressable.
Every inbound WhatsApp webhook is authenticated by verifying Meta’s SHA-256 HMAC signature.
Database row-level security isolates each workspace’s data.
Executed agreements and master audio are sealed with SHA-256 fingerprints so tampering is detectable.
Access to production systems is restricted to authorized personnel on a least-privilege basis.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. California and other US state residents may additionally request to know the categories of information collected and may not be discriminated against for exercising privacy rights.

Deletion: follow our Data Deletion Instructions, send DELETE MY DATA to the Status Vault WhatsApp number, or email zeferiah@official-status.com.
Revoke your saved signature: send REVOKE SIGNATURE on WhatsApp or email zeferiah@official-status.com.
Correct Passport details: use the “Update IPIs or Retake Signature” option in your next signing Flow, or email zeferiah@official-status.com.
Everything else: email zeferiah@official-status.com.

We verify requests by confirming them through the WhatsApp account associated with your Creator Passport, and respond within 30 days. If you are in the EEA or UK you may also lodge a complaint with your local data protection authority.

11. International transfers

Official Status, LLC is based in the United States and Status Vault is hosted in the United States. If you use Status Vault from outside the United States, your information is transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses with our service providers.

12. Children

Status Vault is intended for adults who can enter into binding agreements. It is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact zeferiah@official-status.com and we will delete it.

13. Changes to this policy

We will post any changes on this page and update the date above. If a change materially affects how we use information you have already provided, we will notify you through WhatsApp or email before it takes effect.

14. Contact

Questions or requests about this policy: zeferiah@official-status.com. Postal correspondence: Official Status, LLC at the registered address shown above.