Privacy Policy

1. Data controller

OMEGA IMPORT EOOD („ОМЕГА ИМПОРТ“ ЕООД), UIC/ЕИК 208928597, registered office: 23 Sinchets Str., Ignatievo, 9143, Aksakovo Municipality, Varna Region, Bulgaria, is the controller of personal data processed for IconVaults. Contact support@iconvaults.com or +359 898 629 156.

2. Personal information collected

• Accounts: name, email, language, password hash, verification status, collections, favorites, editor presets and download history.
• Security and sessions: IP address, browser/device information, session identifiers, sign-in and activity timestamps, and hashed refresh and verification tokens.
• Support: information you include in emails, refund requests and other correspondence.
• Orders: name, email, phone, company and billing address, chosen plan or icons, amounts, card brand, the checkout confirmations you gave and the order date. Orders are stored on our servers, linked to your account or, for guest orders, to your email, and a copy may be kept in your browser. Card numbers and security codes are never collected.

3. Purposes and legal bases

We use account and library information to provide services you request (contractual necessity), correspondence to respond to your requests, and session/security information to prevent abuse and protect the service (legitimate interests). Legal obligations may require retaining business records. Optional recent searches are saved only with consent, which you can withdraw in Cookie settings. We do not use automated decision-making with legal or similarly significant effects.

4. Retention

Account information and libraries remain while your account exists. You can delete your account in Settings. Download history is cleaned up under the API retention policy; expired and revoked sessions and used/expired verification tokens are removed by scheduled cleanup. Browser collections, cart, theme and preview orders remain until you clear them or your browser storage. Optional recent searches are removed when you reject optional storage. Consent choices expire after 180 days. We retain correspondence only as needed to respond, resolve disputes and meet applicable legal obligations. Deployment-specific log and backup retention must be confirmed by the operator.

5. Data security

Passwords are hashed with Argon2id. Authentication cookies are HttpOnly and SameSite; production cookies are Secure. Refresh tokens and email-verification/reset tokens are hashed in storage. The API uses request validation, origin checks, rate limiting and session revocation. Use HTTPS in production. These measures reduce risk; no system can guarantee absolute security.

6. Third parties and international transfers

The site is deployed through Vercel; the account API uses our PostgreSQL infrastructure and configured email provider (Resend). Icons and icon search are served by our own icon server at icons.iconvaults.com; your browser sends it your IP address and browser information, and no third-party icon host receives these requests. Sharing links contact X or Reddit only when opened. We do not sell personal data.

Providers may process information outside the European Economic Area. Before such transfers, the operator must verify applicable adequacy decisions or appropriate safeguards such as European Commission Standard Contractual Clauses, together with any necessary supplementary measures. Contact support@iconvaults.com for the current provider locations and transfer safeguards; the deployment inventory and agreements must be confirmed by the operator.

7. Cardholder data and payment security

We do not store raw card details. Card payments are processed by our PCI DSS-compliant payment service provider: you enter your card number, expiry date and security code (CVC/CVV) on the provider's secure payment page, and they are never sent to, stored on or accessible from IconVaults servers. We receive only the payment result, the card brand and, where provided, the last four digits.

Card payments are authenticated with 3-D Secure — Visa Secure and Mastercard Identity Check — so your bank may ask you to confirm the payment. Card payments are not yet enabled on this website; until they are, checkout records a preview order and no card details are requested.

8. Cookies and browser storage

Essential categories include authentication cookies (__Host-iv_at / iv_at, __Secure-iv_rt / iv_rt and iv_signed_in), requested language (iv-locale), theme, collections, cart and preview orders. The consent record remembers your choice. Optional preferences include recent searches (iconvaults:recent). Analytics and marketing cookies are not used. See Cookie Policy for names, purposes and expiry details. Open Cookie settings in the footer to change or withdraw optional consent.

9. Your GDPR rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing. You can withdraw consent without affecting the lawfulness of earlier processing. Account Settings provides account export and deletion. Contact support@iconvaults.com for other requests; we respond within one month, with any lawful extension explained. You may complain to the Bulgarian Commission for Personal Data Protection or your local supervisory authority. Providing account details is needed to create an account; you can browse and download without one.