Privacy Policy

Effective Date: September 16, 2026
Last Updated: September 16, 2026

VaultWiz LLC, doing business as ShoBiz ("ShoBiz," "we," "us," or "our"), provides a business management platform for client relationship management, banking and credit application tracking, document management, accounting, communications, and related services (the "Services").

This Privacy Policy explains how we handle personal information when we decide why and how it is used — for example, information about you as a visitor to our website, as an account holder, or as a billing contact. In privacy law, this makes us a controller (or, under US state laws, a "business").

This policy does not govern the data our business customers upload about their own clients. When a business uses ShoBiz to manage records about its clients, employees, or vendors, that business decides why and how the data is used, and we act only on its instructions. For that data we are a processor (or "service provider"), and our obligations are set out in our Data Processing Addendum. If you are the client of a business that uses ShoBiz and you want your data corrected or deleted, contact that business directly — they control it, and we will support their request.

1. Who We Are and How to Reach Us

For privacy requests, please write to info@shobizapp.com with "Privacy Request" in the subject line.

2. Scope and Service Area

The Services are offered to businesses and individuals in the United States. We do not market the Services in the European Economic Area ("EEA") or the United Kingdom. However, because individuals located in those regions may nonetheless interact with us, Section 12 describes the rights available under the EU General Data Protection Regulation ("GDPR") and the UK GDPR where those laws apply.

The Services are not directed to children. We do not knowingly collect personal information from anyone under 18 years of age. If we learn that we have collected such information, we will delete it. If you believe a minor has provided us personal information, contact us at info@shobizapp.com.

3. Information We Collect

3.1 Information You Provide

Account and identity information. Name, email address, phone number, mailing address, username, and password (stored only as a salted hash — we never store your password in readable form).

Business information. Business name, legal entity type, industry, business address, employer identification number ("EIN"), business formation details, and ownership or cap-table information you choose to record.

Financial and sensitive information. Depending on the features you use, this may include Social Security numbers, bank account and routing details, credit card and loan account details, credit reports and scores, bank and credit card statements, tax and accounting records, income and employment details, and vehicle records.

Social Security numbers and stored third-party credentials are encrypted at rest using AES-256-GCM, with keys held separately from the database. They are decrypted only when a permitted user requests the specific record.

Stored credentials. If you use the credential vault to save logins for third-party services, those credentials are encrypted at rest and are accessible only to users you authorize.

Documents and media. Files you upload, including identity documents, statements, contracts, agreements, and images. Some uploads are processed with optical character recognition ("OCR") to extract text.

Communications content. Emails, SMS and voice messages, call metadata, notes, tasks, appointment details, and meeting recordings or transcripts where you enable a meeting integration.

Payment information. When you pay us, our payment processors collect and process your card or bank details. We receive confirmation, the last four digits, card brand, and billing contact details — we do not store full payment card numbers.

3.2 Information Collected Automatically

• IP address and approximate location derived from it (city/region level)

• Browser type and version, operating system, device type, and screen characteristics

• Pages viewed, referring URL, time and duration of visits, and clicks within the Services

• Log and diagnostic data, including error reports and security events

• Cookies and similar technologies (see Section 9)

3.3 Information from Third Parties

• Bank and financial account data you choose to link through Plaid, including account balances, transactions, and account holder details

• Credit report data you or your client authorizes us to import from consumer reporting sources

• Calendar, email, and meeting data where you connect a Google, Microsoft, or Zoom account

• Referral information when you arrive through an affiliate link

• Payment and billing confirmations from our payment processors

4. How We Use Information

We do not use your personal information to train artificial intelligence models, and we do not permit our AI vendors to do so. See Section 6.

Automated decision-making. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

5. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We honor Global Privacy Control ("GPC") and similar opt-out preference signals.

We disclose personal information only as follows.

5.1 Service Providers (Sub-processors)

We use the following categories of vendors, who may process personal information solely to provide services to us and under written confidentiality and security obligations:

We maintain a current list of sub-processors and will provide it on request to info@shobizapp.com.

5.2 Other Disclosures

• At your direction. When you share a document, send an agreement for signature, or publish a page.

• With the business you work with. If you are a client, employee, or vendor of a business that uses ShoBiz, your records are visible to that business.

• Legal and safety. To comply with law, valid legal process, or a governmental request; to enforce our terms; or to protect the rights, property, or safety of ShoBiz, our users, or the public. Where lawfully permitted, we will notify you before disclosing your information in response to legal process.

• Business transfers. In connection with a merger, acquisition, financing, or sale of assets. We will notify you before your information becomes subject to a different privacy policy.

6. Artificial Intelligence

Some features use AI models to assist your work. Today this includes AI-assisted SMS replies and AI analysis of notes to identify application outcomes. We are direct and specific about how this works.

What we commit to:

1. No model training on your data. Your content, and your clients' content, is not used to train ShoBiz models or any third-party model. Our AI vendors are contractually prohibited from training on data we submit.

2. Human review is always possible. AI output is presented as a suggestion or a logged action a person can review, correct, or reverse. No AI decision that produces legal or similarly significant effects about a person is made without human involvement.

3. Minimum necessary input. We submit only the text needed for the feature — typically the current message and a short conversation history — not your full database.

4. You can switch it off. Every business can disable AI processing for its own data at Business Settings → Privacy & AI. When AI processing is disabled, no AI feature will process that business's data, including features we add later. This is enforced by a single platform-wide gate, not by each feature individually.

5. No sensitive-data enrichment. We do not use AI to infer sensitive characteristics such as race, health, religion, or sexual orientation.

Our current AI sub-processor is Anthropic. If we add or change AI vendors, we will update this policy and the sub-processor list.

7. Text Messaging (SMS)

If you provide a mobile number and consent to receive text messages, the following applies:

• We do not sell or share mobile opt-in data or consent with third parties for marketing purposes. Mobile numbers collected for SMS consent are used only for the messaging program you opted into.

• Message frequency varies depending on your account activity and the messaging program.

• Message and data rates may apply.

• Reply STOP to any message to opt out; reply HELP for assistance, or contact us at info@shobizapp.com or (424) 234-9134.

• Carriers are not liable for delayed or undelivered messages.

• Consent to receive marketing text messages is not a condition of purchasing any goods or services.

8. Email Communications

We send transactional email (account, security, and billing notices) and, with your consent where required, marketing email.

Our marketing email includes open and click tracking implemented with a tracking pixel and redirect links, so we can measure engagement. Every marketing email includes an unsubscribe link and our physical mailing address. Unsubscribing from marketing email does not stop transactional messages necessary to operate your account.

9. Cookies and Similar Technologies

We use:

• Strictly necessary cookies and local storage — authentication tokens, session state, security, and interface preferences. These cannot be disabled without breaking the Services.

• Analytics — to understand aggregate usage and diagnose problems.

• Affiliate and referral tracking — to attribute a signup to the referring partner when you arrive via a referral link.

• Email tracking pixels — as described in Section 8.

Most browsers let you block or delete cookies. Blocking strictly necessary cookies will prevent you from signing in. We honor Global Privacy Control signals as an opt-out of any sale or sharing, of which we currently do neither.

10. Data Retention

We may retain information longer where required to comply with law, resolve disputes, or enforce agreements.

11. Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data we handle, including:

• Encryption in transit using TLS for all connections to the Services

• Encryption at rest using AES-256-GCM for Social Security numbers and stored third-party credentials, with keys managed separately from the database

• Password hashing with bcrypt; plaintext passwords are never stored

• Role-based access control, so users see only the records their role permits

• Rate limiting, input sanitization, and bot mitigation on public endpoints

• Audit logging of significant actions, and monitored error and security logs

• Least-privilege access for our personnel, granted only as needed to operate and support the Services

No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your credentials confidential and for enabling available account protections.

Breach notification. If we discover a breach of security leading to the unauthorized acquisition of your unencrypted personal information, we will notify you and any required regulator without unreasonable delay and within the timeframes required by applicable law.

12. Your Privacy Rights

12.1 All Users

Regardless of where you live, you may ask us to:

• Access the personal information we hold about you

• Correct information that is inaccurate or incomplete

• Delete your personal information

• Export a copy in a portable format

• Opt out of marketing email and text messages

To exercise a right, email info@shobizapp.com. We will verify your identity before acting, typically by confirming control of the email address on the account or by requesting information matching our records. We respond within 45 days and may extend once by a further 45 days where permitted, telling you why.

We will not discriminate against you for exercising a privacy right. We do not deny services, charge different prices, or provide a different level of quality in response to a privacy request.

Authorized agents. You may use an authorized agent to submit a request. We will require written proof of authorization and may ask you to verify your identity directly.

12.2 US State Privacy Rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, or Rhode Island — or another state with a comprehensive privacy law — you have the rights described in Section 12.1, and in addition:

• Right to know the categories and specific pieces of personal information collected, the categories of sources, the purposes for collecting, and the categories of third parties to whom it is disclosed

• Right to opt out of the sale of personal information, sharing for cross-context behavioral advertising, and profiling with legal or similarly significant effects — we do none of these

• Right to limit the use of sensitive personal information to what is necessary to provide the Services — we already limit it to that

• Right to appeal a denied request. If we decline your request, you may appeal by replying to our decision or writing to info@shobizapp.com with "Privacy Appeal" in the subject line. We will respond within 45 days. If we deny your appeal, you may complain to your state Attorney General.

Sensitive personal information. We collect Social Security numbers, financial account credentials, and precise account details because the Services cannot function without them. We use this information only to provide the Services, to secure them, and to comply with law — never to infer characteristics about you and never for advertising.

Shine the Light (California Civil Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

12.3 EEA and UK Rights (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, you additionally have the right to:

• Object to processing based on our legitimate interests

• Restrict processing in certain circumstances

• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

• Lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk)

Legal bases are listed in the table in Section 4.

International transfers. Our Services are hosted in the United States. If you access them from outside the US, your information will be transferred to and processed in the United States, which may not provide the same level of data protection as your home country. Where we transfer personal data subject to the GDPR or UK GDPR, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures as appropriate.

13. What We Are Not

To avoid any confusion about our role:

• ShoBiz is not a bank, lender, or money transmitter. We do not extend credit, hold deposits, or make lending decisions.

• ShoBiz is not a consumer reporting agency under the Fair Credit Reporting Act. We do not furnish consumer reports or assemble consumer information for the purpose of providing consumer reports to third parties. Where we display credit report data, we are presenting information that you or your client obtained and chose to store.

• ShoBiz is not a credit repair organization. We do not perform credit repair services or promise to improve any credit score.

• ShoBiz does not provide financial, tax, investment, or legal advice. The Services are software tools. Decisions you make using them are your own.

Approval for any bank, credit, or financing product is determined solely by the issuing institution. Results vary.

14. The ShoBiz WordPress Plugin

The ShoBiz plugin connects your WordPress site to the ShoBiz platform to synchronize content and commerce data at your direction.

What the plugin transmits. The plugin sends data between your WordPress site and ShoBiz only for the item types you choose to sync. Depending on your settings, this can include posts and pages, products, orders and order line items, customer and user records, form submissions, testimonials, and media files.

How we use it. Solely to provide the synchronization and related features you enable — importing orders, publishing content, routing form submissions to your CRM, and keeping records in step between the two systems. We do not sell this data.

Security. Connection keys and other secrets are encrypted at rest, all traffic is transmitted over HTTPS, and webhook payloads are signed so each system can verify the other.

Your control. You choose which data types sync, and you can disconnect a site at any time from your WordPress admin or your ShoBiz account to stop further syncing. Disconnecting stops new transfers; data already synced is retained under Section 10.

15. Third-Party Links and Services

The Services may link to or integrate with websites and services we do not control. This Privacy Policy does not apply to them. Review the privacy policy of any third party before providing information to it.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above and post the updated policy at this address. If the changes are material, we will provide additional notice — by email to the address on your account, or by a prominent notice within the Services — at least 14 days before the changes take effect where practicable.

Your continued use of the Services after an update takes effect means you accept the revised policy.

17. Contact Us

VaultWiz LLC (dba ShoBiz)
30 N Gould St Ste 5170, Sheridan, WY 82801, United States
Email: info@shobizapp.com
Phone: (424) 234-9134

For privacy requests, write to info@shobizapp.com with "Privacy Request" in the subject line.