Vault.

Privacy Policy

Effective November 6, 2026. This policy covers vaultbot.ai and the Vault MCP server at vaultbot.ai/api/mcp.

Who runs Vault

Vault is a free bank and credit union intelligence tool built and operated by GOiDENTIFY, LLC (“iDENTIFY”), a data and analytics company in Tulsa, Oklahoma. Questions or requests about this policy go to lee@goidentify.com.

The short version

• You don’t need an account to use Vault, on the website or through the MCP server.
• Almost everything Vault shows comes from public government data: FDIC, NCUA, CFPB HMDA and U.S. Census.
• We collect personal information only when you fill in a form, plus standard analytics and usage logs.
• We don’t sell personal information, and we don’t share it for targeted advertising.

What we collect

Information you give us

• MCP signup form: name, email, and optionally company, role, how you plan to use Vault, and how you heard about it. We use it to send your setup instructions.
• Feedback and contact forms: name, email, institution, role and your message.

The signup form uses hCaptcha to block automated submissions; hCaptcha processes data about your browser under its own privacy policy.

Information collected automatically

• Website analytics: Google Analytics records pages viewed, device and browser type, approximate location and referring site, using cookies. You can block it with your browser settings or Google’s opt-out add-on.
• MCP usage records: for each request to the MCP server we record the time, the tool called, the MCP client’s name, the user agent, how long it took, whether it succeeded, and a one-way salted hash of the IP address. We don’t store raw IP addresses or the arguments of your tool calls in these records. We use them to count usage and find errors.
• Hosting logs: our host, Netlify, keeps standard server logs (such as IP address and request time) to operate and secure the service.
• Browser storage: the website stores a small flag in your browser so it doesn’t ask you to fill in the same form twice. It isn’t used for tracking.

Cached data

To keep Vault fast, results are cached by their query (for example, a bank’s FDIC certificate number), not by who asked. Cached public data is refreshed after 7 days, or kept up to a year for closed historical periods such as a past year’s branch filing.

Information about bank executives

Vault’s leadership feature lists a bank’s senior executives (such as the CEO, CIO or COO) with their titles. We gather these from public sources, chiefly the bank’s own website, using Anthropic’s Claude with web search. Where we can, we add a link to the person’s public LinkedIn profile, matched through Bright Data, a commercial provider of publicly available data, and kept only if the profile’s work history names the bank. These results are cached for up to 90 days.

If you are one of these executives and want your information corrected or removed, email lee@goidentify.com and we will act on it promptly.

How we use information

• To run Vault, send MCP setup instructions, answer your messages and fix problems.
• To understand which features are used so we can improve them.
• To send occasional Vault updates. You can opt out at any time by replying or using the unsubscribe link.
• Vault is built by iDENTIFY, which provides data services to banks and credit unions. If you sign up or contact us, iDENTIFY may follow up about those services. Tell us if you’d rather not hear from us and we’ll stop.

Who we share it with

We use these service providers to run Vault. They process data on our behalf for the purposes above:

We may also disclose information if the law requires it, or to protect Vault and its users.

Using Vault through an AI assistant

When you use Vault in Claude, Microsoft 365 Copilot or another AI assistant, that assistant’s provider handles your conversation under its own privacy terms. Vault receives only the tool request it makes (the tool name and its parameters, such as a certificate number) and the usage record described above.

How long we keep it

• Form submissions: until you ask us to delete them.
• MCP usage records: kept as usage statistics, with IP addresses stored only as a one-way hash.
• Executive information: up to 90 days in cache, or sooner on request.

Your choices

You can ask us to access, correct or delete the personal information we hold about you by emailing lee@goidentify.com. We don’t sell personal information or share it for cross-context behavioral advertising.

Security

Vault is served over HTTPS, and credentials for the services above are stored as protected secrets, not in code. No system is perfectly secure, but we work to protect what we hold.

Children

Vault is a professional tool for the banking industry and isn’t directed to children under 16.

Changes to this policy

If we change this policy, we’ll update the effective date at the top of this page.