Privacy Policy — Vaultolio Account Portal
This Privacy Policy explains how information is handled in the Vaultolio secure account portal ("the Portal") — the authenticated area where buyers, sellers, and professional partners create an account, enroll multi-factor authentication, and exchange confidential deal information and documents. The Portal is owned and operated by Dominic Dominguez, a Florida-licensed business broker. Where this policy uses "we," "us," or "our," it refers to Dominic Dominguez.
1. Who operates this Portal
The Portal is owned and operated by Dominic Dominguez, a Florida-licensed business broker. As required by Florida Real Estate Commission Rule 61J2, the broker license is registered with Hedgestone Business Advisors, a trade name of (collectively, "Hedgestone"). Hedgestone neither owns nor operates the Portal; this disclosure appears solely for brokerage-licensure compliance. Vaultolio is a brand name for the website and portal only and is not itself a legal entity or licensed brokerage. Florida Broker License No. BK3529743.
Contact for privacy questions and data subject requests:
Dominic Dominguez
2431 NW 92nd Ave, Coral Springs, FL 33065
[email protected]
(813) 389-9466
2. What information we collect
When you create and use a Portal account, we collect:
- Account details — your name, email address, and the role you select (buyer, seller, or professional partner).
- Your password — stored only as a salted Argon2id hash. We never store, log, or have access to your plaintext password.
- Multi-factor authentication data — depending on the factors you enroll: a phone number (verified by SMS code), a time-based one-time-password (TOTP) secret, passkey / WebAuthn public credentials, and one-time backup codes. We store the verification material needed to check your factor, not a way to reconstruct it.
- Documents you upload and their metadata (file name, size, type, and upload time). Document contents are encrypted at rest; see Section 14.
- Account and privacy activity — an audit log of security-relevant and privacy-rights actions taken on your account (logins, factor changes, exports, consent changes).
- Connection metadata — limited technical data (such as country derived from your network connection) used for security and abuse prevention. We do not store your full IP address as account data.
Do not upload Social Security numbers, government IDs, or payment card numbers unless we have specifically requested them in writing for a particular transaction; where we do, that collection is governed by the written engagement for that deal.
3. Why we collect it
We collect this information to:
- Create and secure your account and authenticate you on each visit.
- Store and exchange the confidential documents and information needed to evaluate or progress a potential transaction.
- Send you communications you have agreed to receive about your account and your active matters.
- Comply with our recordkeeping obligations as a Florida-licensed broker.
- Detect and prevent abuse of the Portal (rate-limiting, fraud and account-takeover prevention).
4. Service providers we use
We use a small number of third-party service providers to operate the Portal. Each only processes your data on our behalf:
- Cloudflare, Inc. — provides front-end delivery, bot protection, and abuse mitigation. Cloudflare may process limited connection metadata (IP address, user agent, country) to deliver the Portal and block abuse.
- Twilio Inc. — sends and verifies the SMS code used for phone-based multi-factor authentication. Twilio receives your phone number and the verification code; it does not receive your documents or other account contents.
We do not use Google Analytics, Facebook Pixel, ad-tech pixels, or any cross-site advertising tracker in the Portal.
5. How we share your information
We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising.
We may disclose your information to:
- Service providers above, only as needed to operate the Portal.
- Counterparties to a deal you have asked us to help facilitate, only after you have signed a written engagement and applicable confidentiality agreements.
- Government agencies, regulators, or courts where legally required (subpoena, court order, regulator inquiry).
6. How long we keep your information
We keep your account and the documents you upload for as long as your account is active and as needed for the transaction it relates to. You may delete individual documents at any time from the documents view, and you may request deletion of your account (see Section 7). After deletion or account closure we remove or permanently anonymize the data, except where a longer period is required by Florida real estate brokerage recordkeeping rules, federal law, or an active legal matter.
7. Your rights
Depending on where you live, you may have the following rights regarding your personal information. We honor these rights for all account holders regardless of state of residence:
- Access & portability — download a machine-readable copy of your account record, document catalog, and privacy-action history directly from the Privacy & your data view in the Portal.
- Correction — fix information that is inaccurate.
- Deletion — delete individual documents yourself, or ask us to delete your account and information (subject to legal retention obligations).
- Withdraw consent / object — withdraw consent for optional processing or object to processing, using the self-service controls in the Privacy & your data view.
- Opt-out of marketing — stop receiving marketing messages (every marketing email includes a one-click unsubscribe link).
- Non-discrimination — we will not deny service, charge you more, or provide a worse service because you exercised a privacy right.
Most rights are self-service inside the Portal. For anything else, email [email protected] or write to the address in Section 1. We respond within 45 days (extendable once by an additional 45 days where permitted by law) and may need to verify your identity first.
Self-service data controls. You can exercise most of these rights directly inside the Portal without contacting us — Download your data (export), Withdraw consent, File an objection, and Delete your account — all available from the Privacy & your data view after signing in.
7a. Do Not Sell or Share My Personal Information
We do not sell or share your personal information for cross-context behavioral advertising. If you are a California or Florida resident and wish to confirm or update your opt-out preferences, use the Withdraw consent control in the Privacy & your data view, or contact us at the address in Section 1.
7b. AI use in this Portal
Portions of this Portal — including valuation estimates and document summaries — may be generated with the assistance of AI tools. Outputs are provided for informational purposes and are not professional advice. You should verify any AI-generated estimate with a licensed advisor before making decisions.
8. Florida residents (FDBR)
Florida residents have the rights listed in Section 7 under the Florida Digital Bill of Rights, and may opt out of the sale of personal information; we do not sell personal information.
9. California residents (CCPA / CPRA)
California residents have the rights listed in Section 7 under the California Consumer Privacy Act, and may opt out of the sale or sharing of personal information; we do not sell or share personal information. We do not knowingly collect personal information from California residents under 16.
10. Other US states
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Tennessee (TIPA), Indiana (INCDPA), and other states with comprehensive privacy laws have substantially similar rights and may exercise them through the contact channels in Section 1.
11. International visitors
The Portal is operated from the United States. If you use it from outside the US, your information will be processed in the US. By using the Portal you consent to that transfer. We honor data subject rights under the EU/UK GDPR (access, rectification, erasure, restriction, portability, objection) on request.
12. Cookies and tracking
The Portal uses only strictly necessary cookies required for sign-in, security, and abuse prevention (your authenticated session and bot-protection). The Portal does not use advertising, analytics, or cross-site tracking cookies.
13. Children's privacy
The Portal is intended for adults (18+). We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected a child's information, contact us and we will delete it.
14. Security
We use commercially reasonable technical and organizational safeguards, including TLS encryption in transit, AES-256-GCM envelope encryption of uploaded documents at rest, Argon2id password hashing, multi-factor authentication with step-up requirements for sensitive actions, and access controls. No system is perfectly secure; if we discover a breach affecting your information, we will notify you consistent with applicable Florida and federal breach-notification laws.
15. Changes to this policy
We may update this policy. Material changes will be reflected by updating the "Last updated" date above, and we will notify account holders of material changes that affect their rights.
16. How to file a complaint
If you believe we have not handled your information appropriately, please contact us first using Section 1. You may also contact:
- Florida Attorney General — myfloridalegal.com
- Federal Trade Commission — ftc.gov
- Your state attorney general (for residents outside Florida)