Privacy policy

Last updated: 12 October 2026

Key principle. Qvault processes documents on your device. No document, extracted text, detection result or file name is sent to us or to anyone else. We have no servers that receive data from the application.

1. Data controller

Santacroce SL, CIF B13886775, Madrid, Spain. Contact: info@santacroce.es.

2. The Qvault application

Qvault is free, open-source software (MIT License) that runs on your computer. It has no accounts, registration, licence keys or payments, and it contains no telemetry, analytics or crash reporting. We do not collect:

• document content or text, including text produced by OCR;
• detected personal data or redaction decisions;
• file names or file metadata;
• usage data of any kind.

The data the application creates (documents, findings, audit log, settings and model files) is stored only in its app data folder on your device, and you can delete it at any time from Settings.

Optional model downloads

The application connects to the internet only when you click Download for an AI model. The file is then fetched over HTTPS from Hugging Face (huggingface.co). As with any download, Hugging Face receives your IP address and standard request headers; no document data is sent. Hugging Face’s own privacy policy applies to that request. If you prefer, you can download model files on another computer and import them; see Models and setup.

OCR model files and installers are downloaded by you, in your browser, from GitHub. GitHub’s privacy statement applies to those downloads.

3. This website

This website is a set of static pages hosted on GitHub Pages, a service of GitHub, Inc. It uses no cookies, no local storage, no analytics, no advertising, no fonts or scripts from third parties, and no forms. The pages load nothing from any other domain.

Like any web host, GitHub processes the IP address of visitors and keeps server logs for security and operation of its service. We do not receive or have access to these logs. See the GitHub General Privacy Statement and the GitHub Pages data collection note.

If you write to us by email, we use your message and address only to reply, on the basis of our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), and delete it when it is no longer needed.

4. Sharing

We do not sell, rent or share personal data with anyone.

5. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Contact us at the address above; we reply within one month. You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

6. Children

Qvault is a professional tool. We do not knowingly collect data from anyone under 16.

7. Changes

We may update this policy. The date above shows the latest version, and the history of every change is public in the project’s source repository.

This document is provided for information and is not legal advice.