Privacy Policy

Key points

• We don't sell your personal information, and we don't use it for interest-based advertising, data brokering, or third-party marketing. There are no ad networks or ad pixels on this site.
• Your funds are held by Column, N.A., Member FDIC — vbank is a technology platform, not a bank.
• Identity verification and external-account linking are performed by Plaid. Your database is hosted by Supabase. Neither uses your data for their own purposes beyond what we've instructed.
• You can export or delete your data from Settings → Privacy at any time, subject to the recordkeeping rules banks are legally required to follow (Section 6).

1. Who this covers

vbank (also marketed as "Vitez Bank") is a product of Vermilion Vitez LLC ("Vermilion Vitez," "vbank," "we," "us," "our"). This policy explains how we collect, use, share, and retain information about people who visit vitezbank.com, open an account through vbank, or use the vbank dashboard.

vbank is a financial technology company, not a bank. Banking services, accounts, and lending are provided by Column, N.A., a nationally chartered bank, Member FDIC. Column maintains its own privacy notice under the Gramm-Leach-Bliley Act ("GLBA") governing the deposit account itself; this policy governs vbank's own collection and handling of your information as the technology platform you interact with. Where the two overlap, both apply — this policy does not narrow any protection Column's notice provides you.

This policy does not cover Vermilion Vitez LLC's other, unrelated web properties or services, which maintain their own separate privacy policies.

2. What we collect

We do not knowingly collect precise geolocation, biometric identifiers beyond what Plaid's liveness check requires for identity verification, or your device's contacts, and we do not embed third-party advertising or analytics trackers on vitezbank.com.

3. How we use it

• To open and operate your account, and to verify your identity as required by federal banking law (Customer Identification Program / Know Your Customer and Bank Secrecy Act / anti-money-laundering obligations)
• To process transfers, loan applications, and other transactions you request, and to link external accounts you authorize
• To screen for and prevent fraud, unauthorized access, and financial crime, including sanctions and watchlist screening
• To comply with legal, regulatory, and recordkeeping requirements imposed on us or on Column
• To provide customer support and respond to the requests you send us
• To maintain the security and integrity of our systems

We do not use your information to build advertising profiles, to sell to data brokers, or for automated decision-making that produces legal or similarly significant effects without human review. We do not sell your personal information, full stop — not for money, and not in exchange for other value.

4. Who we share it with

We share data only with the service providers that make vbank work, each bound by contract to use it solely for the purpose listed below — never for their own marketing, and never resold:

• Column, N.A. — the chartered bank that holds your funds and provides accounts, cards, and loans
• Plaid — performs document/selfie identity verification and Watchlist Screening, and facilitates linking an external bank account, if you choose to; Plaid's own handling of data it collects directly is governed by Plaid's End User Privacy Policy
• Supabase — hosts our database; access is restricted to our own service credentials, not Supabase's staff in the ordinary course

Beyond our service providers, we may disclose information:

• When required by law, subpoena, court order, or a bank regulator's or law enforcement's lawful request
• To protect the rights, property, or safety of vbank, Column, our members, or the public, including to detect and prevent fraud
• To a successor entity in the event of a merger, acquisition, or sale of assets, in which case this policy would continue to apply to your information unless you're notified otherwise
• With your explicit direction or consent

We do not have joint-marketing arrangements, affiliate-sharing arrangements, or data-broker relationships that involve your personal or financial information.

5. Cookies and automatic data

vitezbank.com uses only the cookies strictly necessary to keep you signed in and to remember basic preferences — no third-party advertising or cross-site tracking cookies. Our servers log standard request metadata (IP address, browser type, timestamps, and requested pages) for security, abuse prevention, and troubleshooting, the way any web server does. This log data is not shared with advertisers because we don't have any.

6. How long we keep it

Retention depends on what the data is and whether it's tied to an account you actually opened:

• Incomplete or failed identity verification attempts (you started but never finished, or the check failed) are automatically deleted after 30 days.
• Completed identity verifications never used to open an account are automatically deleted after 90 days.
• Identity verification tied to an account you opened is retained for as long as required by federal recordkeeping rules — generally up to 5 years after account closure — even if you later request deletion of other data.
• Account, loan, and transaction records are retained per standard banking recordkeeping requirements (BSA and related federal rules generally require up to 5 years).
• Linked external account data is deleted immediately when you unlink it yourself in Settings.
• Device/log data is retained only as long as needed for security and troubleshooting purposes, then purged on a rolling basis.

Where legal recordkeeping rules require us to retain something, we retain only that record — a retention requirement on one record doesn't extend to unrelated data about you.

7. How we protect it

• All data is encrypted in transit (TLS) and at rest (AES-256)
• Our database is locked down so that only our application's own service credentials can read or write it — there is no direct public or client-side access to any account data, and no row-level policy grants end-user or anonymous access
• We never store your linked bank account's raw access credentials from Plaid in a form usable outside our systems — only a reference token that our servers use to reconnect to Plaid when needed
• Inbound webhook requests (e.g., from Plaid) are cryptographically signature-verified and checked for replay before we act on them
• Access to production systems and secrets is limited to the people who need it to operate the service

No system is perfectly secure, and we can't guarantee absolute security — but we design for defense in depth, and we'll notify affected members and regulators as required by law if a breach occurs.

8. Your rights and choices

You can request a copy of your data or request deletion of your account at any time from Settings → Privacy while signed in. Export requests are fulfilled immediately. Deletion requests are reviewed and processed as quickly as possible, subject to the retention rules in Section 6 — some records (like completed identity verification tied to an account you opened) can't be deleted early because we're legally required to keep them.

Because we don't sell personal information or use it for targeted advertising, there's no "opt out of sale/sharing" toggle to offer — there's nothing to opt out of. If that ever changes, we'll update this policy and provide one, as required by state privacy laws (e.g., CCPA/CPRA and similar laws in other states).

Much of what we collect is "nonpublic personal information" under GLBA and is subject to bank recordkeeping law rather than general consumer privacy statutes; where a state privacy law nonetheless grants you access, correction, deletion, or portability rights, we honor those requests through the same Settings → Privacy flow or by contacting us below.

Questions about this policy or a request you've submitted can be sent to privacy@vermilionvitez.com. We may need to verify your identity before acting on a request.

9. Eligibility and who this service is for

vbank is offered only to individuals, businesses, and trusts located in the United States, and only to individuals who are at least 18 years old. We do not knowingly collect information from anyone under 18, and accounts may not be opened on a minor's behalf other than through structures Column separately supports.

10. Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, where required by law, notify you directly (for example, by email) before the change takes effect.

11. Contact us

Vermilion Vitez LLC
Email: privacy@vermilionvitez.com