Privacy Policy

What data FrameVault stores

We store only what is necessary to provide the backup service:

• Your account email address. Used for sign-in (magic link, email + password, or Google OAuth) and for transactional emails such as backup-failure notifications. We do not use it for marketing without your consent.
• Framer API keys — encrypted. Your API keys are encrypted with AES-256-GCM before being written to the database. The encryption key is stored only in server environment variables, never in the database. Your keys are never sent back to the browser.
• CMS snapshot data. When a backup runs, FrameVault reads your Framer CMS collections via the Server API and stores the result as a JSON blob in encrypted cloud storage (Supabase Storage). This data includes all field values of all items in all collections — exactly what you would need to restore from a backup.
• Billing information. Processed by Stripe. FrameVault stores only a Stripe customer ID and your current plan name — we do not store card numbers or payment details.
• Usage metadata. When backups run, when restores are triggered, and snapshot status (complete, failed, running). Used for your dashboard and for retention enforcement.

What we do not store

• Framer canvas data, pages, or design assets — only CMS content
• Plain-text passwords — when you sign up with email + password, Supabase Auth stores a bcrypt hash only; FrameVault never sees your password. Magic link and Google OAuth sign-in have no password at all.
• Decrypted API keys outside of active request processing

How we protect your data

All data in transit is encrypted via HTTPS/TLS. API keys are encrypted at rest with AES-256-GCM. Snapshot blobs are stored in Supabase Storage, which applies its own storage-level encryption. Row-level security on the database ensures that each user can only access their own sites, snapshots, and restore logs.

Data retention

Snapshots are automatically deleted after their retention period: 7 days on the Free plan, 90 days on Pro, and 180 days on Agency. The most recent complete snapshot for each site is always preserved regardless of age. After a plan downgrade or cancellation, access continues until the end of the current billing period; retention adjusts on the next scheduled cleanup run.

If you close your account, all of your data — sites, snapshots, API keys, restore logs — is deleted. To close your account, email us at the address below.

Third-party services

FrameVault uses the following third-party services:

• Supabase — database, authentication, and file storage. Data is hosted in the EU or US depending on project configuration. See Supabase's privacy policy for details.
• Stripe — payment processing. Stripe's privacy policy applies to billing data.
• Vercel — hosting. Vercel processes request logs. See Vercel's privacy policy.
• Resend — transactional email (backup failure notifications). Your email address is passed to Resend solely to deliver these messages. See Resend's privacy policy.
• Google — optional OAuth sign-in. If you choose “Sign in with Google,” Google authenticates you and shares your email address with us via Supabase Auth. No other Google data is accessed. See Google's privacy policy.
• Framer Server API — FrameVault reads and writes your Framer CMS data on your behalf when you initiate a backup or restore. Framer's terms and privacy policy govern your use of the Framer platform.

We do not sell your data

FrameVault does not sell, rent, or share your personal data or your CMS content with third parties for advertising or analytics purposes.

Contact

Questions, data deletion requests, or anything else: alerts@useframevault.com