Privacy Policy

1. Who we are

The Dupe Vault (“we”, “us”) is the data controller of your personal data. The Dupe Vault is an independent project operated from Belgium. For any privacy question or to exercise your rights, contact us at hello@thedupevault.com.

2. What we collect

• Account data — your email address and authentication identifiers when you create an account or sign in (handled by our auth provider, Supabase).
• Quiz data — the answers you choose and the email you provide to receive your matches, plus whether you opted in to marketing.
• Purchase data — when you buy, our payment processor (Stripe) handles your card details; we receive your email, the items purchased, payment status, and country for tax. We never see or store full card numbers.
• Usage & device data — basic technical logs (IP address, browser, pages viewed) needed to run and secure the site, and — only with your consent — analytics.

3. Why we use it, and our legal basis

• To provide the product (deliver the index, your account, your purchase) — performance of a contract.
• To send your quiz matches — your request / pre-contractual step.
• Marketing email (new-dupe drops, tips) — your consent, which you can withdraw at any time. We only send marketing to people who opted in.
• Security, fraud prevention, and basic operation — our legitimate interests.
• Tax and accounting — compliance with a legal obligation.

4. Who we share it with (processors)

We use trusted service providers who process data on our behalf under contract:

• Supabase — accounts, authentication, and database.
• Stripe — payments, subscriptions, and tax.
• Klaviyo — email delivery and marketing (consented).
• Vercel — website hosting and logs.
• Affiliate networks & retailers (e.g. Amazon and partner programmes) — when you click an outbound “where to buy” link, the retailer’s own privacy terms apply.

We do not sell your personal data.

5. International transfers

Some providers are based outside the EEA. Where data is transferred outside the EEA, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

We keep account and purchase data for as long as your account is active and as required for tax and accounting (typically 7 years for invoices under Belgian law). Marketing data is kept until you unsubscribe or ask us to delete it. Quiz leads that never become customers are kept for up to 24 months.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• data portability;
• withdraw consent at any time (this does not affect prior processing).

To exercise any right, email hello@thedupevault.com. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, dataprotectionauthority.be).

8. Cookies

We use essential cookies to run the site and, with your consent, analytics/marketing cookies. See our Cookie Policy for details and how to manage them.

9. Changes

We may update this policy. Material changes will be communicated where appropriate.