Privacy Policy
This Privacy Policy explains how INBOX.KY Ltd. (a Cayman Islands company), trading as vCon Ledger ("vCon Ledger", "we", "us", "our"), collects, uses, shares and protects personal data when you use our website at vconledger.com and, where made available to you, the vCon Ledger usage-billing service (together, the "Service").
We are the data controller for the personal data described here.
In plain words: this is a small, Cayman-owned engineering project. We collect what we need to answer you and to run the Service. We do not sell your personal data, and we do not use the contents of the records you send us to profile anyone.
1. Who we are & how to contact us
- Controller: INBOX.KY Ltd., 65 Garvin Road, West Bay, Grand Cayman, Cayman Islands.
- Privacy / data-protection contact:
nick@myst.ky. - Design-partner enquiries:
nick@myst.ky.
2. Scope
This policy covers (a) the marketing website at vconledger.com, including the interest form, and (b) the vCon Ledger service where you have been given access to it as a design partner. Release 0.1 is a working prototype made available to a small number of design partners; it is not a generally purchasable product.
3. The personal data we collect
(a) When you submit the interest form
- your name and work email address;
- your company and the usage source you select, if you provide them;
- the message you write;
- a timestamp, and technical signals used only to prevent abuse (including your IP address, held transiently in memory for rate limiting and not stored with your submission, and a Cloudflare Turnstile challenge result).
(b) When you use the Service as a design partner
- account and contact details for the people you nominate to use it;
- the vCons and related records you submit, which may contain personal data of your own customers or staff (for example an extension, a handle, a fob or vehicle identifier, or call metadata), together with the charge records, resolution paths and receipts we generate from them;
- support correspondence and service logs.
Where you submit records about your own customers or staff, you are the controller of that data and we act as your processor, handling it on your documented instructions under a separate written agreement. This policy describes our own controller activities.
(c) Automatically, on the website
- essential first-party storage — remembering your cookie choice;
- with your consent only, Google Analytics 4 (with IP anonymisation) and Microsoft Clarity (usage analytics including session recordings). These load only if you select Accept on our cookie banner. See the Cookie Policy.
We run no advertising tags and no third-party advertising cookies.
4. Why we use it, and our lawful bases
| Purpose | Lawful basis (GDPR / Cayman DPA) |
|---|---|
| Reply to your enquiry and discuss a design-partner slot | Steps prior to a contract; your consent |
| Provide, operate and support the Service | Performance of a contract |
| Keep a replayable record of each billing operation so charges can be audited or disputed | Performance of a contract; legitimate interests (a billing system that can be checked) |
| Prevent abuse, spam and fraud; keep the Service secure | Legitimate interests (running a safe service) |
| Send service and transactional email | Performance of a contract |
| Understand how the website is used | Your consent (analytics cookies) |
| Comply with law and respond to lawful requests | Legal obligation |
5. Records you send us
To price an event we necessarily receive, validate, hash and store the record you submit, along with the charge we derive from it. We treat the contents as confidential. We access them only where strictly necessary to provide or troubleshoot the Service at your request, to protect its security, or where required by law. We do not use them to build advertising or behavioural profiles, and we do not disclose them except as set out in Section 7.
6. How long we keep it
- Interest-form submissions: kept while we are in contact with you about a partner slot and for a reasonable period afterwards, then deleted. Ask us and we will delete yours sooner.
- Operation records (submitted records, charges, receipts): kept for the life of the partner engagement and for a limited period afterwards so that charges remain auditable and disputes can be replayed, then deleted or anonymised. Specific retention periods are set out in your partner agreement.
- Logs and abuse signals: kept only as long as needed for security and legal purposes.
7. Who we share it with
We share personal data only with:
- service providers (subprocessors) who help us run the Service, under contract and only on our instructions (see Section 8);
- authorities or third parties where we are legally required to, or to protect rights, safety and the integrity of the Service, or in connection with a merger or business transfer.
We never sell personal data and we do not share it for third-party advertising.
8. Subprocessors
| Provider | Purpose | Where |
|---|---|---|
| Netlify | Website hosting and form-handling functions | US/global |
| Brevo | Storing enquiry contacts and sending notification email | EU |
| Cloudflare | Turnstile bot-protection challenge on the interest form | US/global |
| Google (Analytics 4) | Website analytics — only with consent | US/global |
| Microsoft (Clarity) | Website analytics and session recordings — only with consent | US/global |
The hosting and processing arrangements for the billing service itself are set out in each design partner's agreement. This list is kept up to date.
9. International transfers
vCon Ledger is operated from the Cayman Islands, and some providers above process data outside the Cayman Islands (including in the EU and US). Where we transfer personal data internationally we use appropriate safeguards — such as contractual protections and Standard Contractual Clauses, and provider compliance commitments — consistent with the Cayman Islands Data Protection Act, 2017 and, where applicable, the GDPR and UK GDPR.
10. Security
We protect personal data with measures including encryption in transit (TLS), a strict content-security policy on this site, access controls, least-privilege internal access, and keeping secrets out of client code and source control. Submitted records are content-hashed so that tampering is detectable. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a qualifying personal-data breach as required by law.
11. Your rights
Under the Cayman Islands Data Protection Act, 2017 you have rights to: be informed about how we use your data; access it; have inaccurate data corrected; require us to stop processing likely to cause unwarranted damage or distress; stop processing for direct marketing; and require correction, blocking, erasure or destruction in certain cases. You may complain to the Office of the Ombudsman (Cayman Islands).
If you are in the EU/EEA or UK, under the GDPR / UK GDPR you also have rights to access, rectification, erasure, restriction of processing, data portability, objection to processing, and to withdraw consent at any time. You may complain to your local supervisory authority (in the UK, the ICO).
To exercise any right, email nick@myst.ky. We respond within the time limits set by applicable law. Exercising your rights is free unless a request is manifestly unfounded or excessive.
12. Marketing
We only email you about vCon Ledger if you asked us to — by submitting the interest form or by being in a partner conversation with us — and every marketing email has an unsubscribe link. Opting out does not stop essential service email.
13. Children
The Service is intended for businesses and is not directed at children under 16 (or the age of digital consent in your jurisdiction). We do not knowingly collect their data; contact us if you believe a child has provided us data.
14. Cookies & tracking
We use no advertising or third-party tracking cookies. Analytics load only with your consent. See the Cookie Policy.
15. Changes
We may update this policy. We will post the new version here and update the date; material changes will be communicated where appropriate.
16. Complaints
Contact us first at nick@myst.ky — we want to put things right. You also have the right to complain to the Office of the Ombudsman (Cayman Islands) or, if applicable, your EU/UK supervisory authority.