Volt Platform — Privacy Notice
Effective date: 2026-04-24 Last updated: 2026-04-24 Hosted at: https://volt.armored.app/legal/privacy
This Privacy Notice describes how ArmoredGate LLC
("ArmoredGate," "we,"
"us," or "our") collects, uses,
discloses, and safeguards personal data in connection with the Volt
Platform — VoltStudio, VoltMCP, Voltainer, VoltTray, VoltHub,
VoltNative, VoltAPEX, VoltDisplayBridge, our websites at
armoredgate.com, volt.armored.app, and
hub.3kb.io, and our subscription billing operations.
This Notice supplements the Terms of Service at https://volt.armored.app/legal/tos and the EULA at https://volt.armored.app/legal/eula.
We aim to be specific. Where a section says "we do not collect X," that means exactly that; if a future product change causes us to start collecting X, we will update this Notice and notify active customers before the change takes effect.
1. Who is the controller
For data collected through the Volt Platform, ArmoredGate LLC is the data controller (or the equivalent role under your local law). For Customer Content that you process using the Volt Platform but never transmit to us, you are the controller and ArmoredGate has no relationship to that data.
Contact: privacy@armoredgate.com.
2. The data we collect — and the data we deliberately do not
2.1 Account data
When you create an account we collect: your name, your business email address, your organization name (optional), and the password hash (Argon2id; we do not store your plaintext password).
2.2 Billing data
When you purchase a Subscription Service we collect, through Stripe
and store in our Supabase project (US region, project identifier
ywwpkigsnnxblgkszvlk, "Seed Library"):
- Stripe customer identifier and subscription identifier
- The SKU you purchased and your billing cycle
- Invoice history (amounts, dates, status)
- Billing address, billing email, last-four digits of the payment instrument, and instrument type as supplied by Stripe
We do not store your full payment card number, CVV, or bank account number. Those live in Stripe's PCI-DSS Level 1 environment.
2.3 License-key validation data
When a Subscription Service activates or revalidates your License Key we collect: the License Key fingerprint (a hash, not the key itself), the timestamp of validation, the source IP address, a salted machine-identifier hash, the product name and version, and the operating-system family. We use this strictly to enforce the per-organization licensing model in EULA §3 and to detect license abuse.
2.4 Telemetry and crash reports
The Volt Platform collects diagnostic telemetry only when you opt in during installation or in the application settings. When enabled, we collect: anonymized application identifier, version, OS and architecture, feature-usage counters (e.g. "container-start invoked"), and crash stack traces with file paths redacted. We do not collect command-line arguments, environment variables, file contents, or container payloads.
2.5 VoltHub publishing data
When you publish to VoltHub we collect: the image manifest, the image
bytes (which we store on Bunny CDN), the publisher identity, and
publish-event metadata (timestamp, source IP, signature material). When
the public reads from hub.3kb.io we receive standard CDN
access logs from Bunny: requesting IP address, timestamp, requested
path, user agent, response code, and bytes served. Bunny retains these
logs under its own retention policy; we ingest a downsampled copy for
abuse and capacity analysis.
2.6 Website data
On armoredgate.com and volt.armored.app we
collect minimal first-party analytics (page path, referrer, screen size,
country derived from IP — no cookies set for analytics, no third-party
trackers).
2.7 What we do NOT collect
Specifically and as a design commitment, ArmoredGate does not:
- scan, index, parse, or extract data from your container images, source code, build manifests, secrets, or environment files at any point — locally or in transit;
- train any machine-learning model on Customer Content;
- read the contents of containers you run with Voltainer or VoltTray;
- forward your VoltMCP tool calls or AI-agent transcripts to any ArmoredGate or third-party service;
- collect biometric data;
- collect children's data (the Volt Platform is not directed at anyone under 18).
3. How we use the data
We use the data above to:
(a) Provide the Volt Platform — authenticate accounts, validate License Keys, deliver software updates, host VoltHub. (b) Bill you — charge your payment method, issue invoices and tax documents, prevent payment fraud (through Stripe). (c) Support you — respond to email or in-app support requests. (d) Secure the Volt Platform — detect abuse, defend against attacks, investigate incidents. (e) Improve the Volt Platform — when you opt in to telemetry, we use aggregated counters to prioritize roadmap work. (f) Comply with legal obligations — respond to lawful requests, meet tax and accounting obligations, keep audit trails.
We do not sell or rent personal data, and we do not share personal data with third parties for their own marketing purposes.
4. Legal bases (for users in the EEA, UK, or Switzerland)
When the GDPR or its UK or Swiss equivalents apply, we rely on:
- Contract — to provide the Volt Platform you purchased (account, billing, license validation).
- Legitimate interests — to secure the Volt Platform, prevent abuse, and improve our products in a privacy-respecting way (telemetry is opt-in, not legitimate-interest based).
- Legal obligation — to meet tax, accounting, and lawful-request requirements.
- Consent — for opt-in telemetry, optional marketing email, and any future processing that requires it. You may withdraw consent at any time.
5. Sub-processors and infrastructure
We rely on the following sub-processors. Each one is bound by a written contract that requires confidentiality, security, and data-minimization standards consistent with this Notice.
| Sub-processor | Purpose | Data handled | Region |
|---|---|---|---|
| Supabase, Inc. | Customer, account, billing, and License-Key metadata storage; authentication backend | Account data, billing metadata, license-validation events | United States (project ywwpkigsnnxblgkszvlk — "Seed
Library") |
| Stripe, Inc. | Subscription payment processing | Billing instrument, billing address, invoice events | United States (with PCI-DSS Level 1 controls) |
| Bunny.net (BunnyWay d.o.o.) | VoltHub CDN distribution and hosting for hub.3kb.io and
armoredgate.com |
VoltHub image bytes, public access logs | EU + global edge |
| AWS (Amazon Web Services, Inc.) | Origin storage and license-validation API hosting | License-validation events, telemetry (when opted in), crash reports | United States |
| Email transactional provider | Account, billing, and security email | Email address, message content | United States |
We will publish updates to this list at https://volt.armored.app/legal/sub-processors. Material additions will be announced at least thirty (30) days in advance for active subscribers.
6. International transfers
ArmoredGate is based in the United States and stores most personal data in the United States. If you access the Volt Platform from outside the United States, your data will be transferred to and processed in the United States and other countries where our sub-processors operate.
Where required by EEA, UK, or Swiss law, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss equivalent) with our sub-processors. A Data Processing Addendum (DPA) is available on request from privacy@armoredgate.com for customers who require one — including customers subject to GDPR, UK GDPR, the Swiss FADP, the Brazilian LGPD, and the California CCPA/CPRA.
7. Retention
| Category | Retention |
|---|---|
| Account data | Life of account + 30 days |
| Billing data and invoice history | 7 years (tax/accounting) |
| License-key validation logs | 13 months rolling |
| Opt-in telemetry | 24 months rolling |
| Crash reports | 12 months rolling |
| VoltHub published images | Until you delete them; deleted images may persist on CDN edges for up to 30 days |
| VoltHub access logs | 90 days at full fidelity, then aggregated indefinitely |
| Support email correspondence | 3 years |
| Security incident records | 7 years |
When you close your account we delete or anonymize personal data within 30 days, except where we are required by law to keep it longer (for example, billing records for tax purposes).
8. Your rights
Depending on where you live you may have the right to:
(a) access the personal data we hold about you; (b) correct inaccurate personal data; (c) delete personal data ("right to be forgotten"); (d) object to or restrict certain processing; (e) withdraw consent for processing based on consent; (f) port your personal data in a commonly used format; (g) lodge a complaint with your local data protection authority.
To exercise any of these rights, email privacy@armoredgate.com from the address on file. We will verify your identity and respond within thirty (30) days, or the period required by your local law if shorter.
California residents: under the CCPA/CPRA you have the rights above plus the right to know whether we sell or share personal information (we do not) and the right to non-discrimination for exercising your rights.
9. Customer Content — your responsibility
The Volt Platform is a control-plane and runtime for software you build and operate. The container images, source code, secrets, and runtime data you process stay on your machines and in your infrastructure unless you explicitly publish them (for example, pushing an image to VoltHub) or unless you opt into telemetry that includes a specific datum. ArmoredGate does not have access to your Customer Content under normal operation.
You are the controller for any personal data you process inside containers you run with the Volt Platform. ArmoredGate is not your processor for that data. If you believe you need a processor relationship with us for any specific dataset, please contact privacy@armoredgate.com.
10. Security
We follow industry-standard security practices including: TLS 1.3 for data in transit; encryption at rest for account, billing, and License-Key data; least-privilege access control inside ArmoredGate; signed software releases under the Voltainer Circle of Trust; an internal incident-response process; and a public security-disclosure channel at security@armoredgate.com.
We do not currently hold SOC 2, ISO 27001, FedRAMP, HIPAA, or PCI-DSS attestations as a service provider. Stripe handles cardholder data in its PCI-DSS Level 1 environment; we do not.
ArmoredGate is pursuing FIPS-140-3 validation for the Voltainer signing and verification module, anchored to a hardware GPG signing ceremony scheduled for the week of 2026-04-27. Until the validation certificate is issued and published at https://volt.armored.app/compliance, we make no representation that any component of the Volt Platform is FIPS-140-3 validated.
11. Cookies
We do not use third-party advertising cookies or trackers. We use a minimal set of strictly necessary first-party cookies to keep you signed in to your account and to remember your preferences. The cookie list is published at https://volt.armored.app/legal/cookies.
12. Changes
We may update this Notice. Material changes (for example: new categories of data, new sub-processors that increase risk, changes to retention) will be announced at least thirty (30) days in advance by email and in-app banner. The "Last updated" date at the top of the Notice will always reflect the current revision.
13. Contact
ArmoredGate LLC 111 W 4th Street, #23 Okmulgee, OK 74447 United States
Privacy: privacy@armoredgate.com Security: security@armoredgate.com General: legal@armoredgate.com