SCARVAULT — Privacy Notice
Last updated: 4 October 2026
SCARVAULT is a personal business operations tool. It is operated by its owner, Lascar Wambu, on their own accounts. It has no other users, no customers of its own, and does not process anybody else's personal data.
This notice describes what happens to account information when the owner connects their own bank.
Who is responsible
The owner of the SCARVAULT installation is the data controller for the data it holds. Enquiries: the email address registered with this application.
What is accessed
When the owner authorises access at their bank, SCARVAULT can read:
- Account details — the account's identifier, name and currency.
- Balances — the amounts the bank reports.
- Transactions — date, amount, currency, direction, description and
counterparty name.
Access is granted by the owner at their own bank, through that bank's own authorisation screen, under PSD2. It lasts until the consent expires or the owner withdraws it, whichever is first.
What is not accessed, and what cannot happen
- No payments. SCARVAULT requests account information access only. It
contains no payment-initiation code. It cannot send, move, convert or withdraw money, and cannot change payout or account details.
- No credentials. SCARVAULT never sees, requests or stores bank
passwords, PINs or login details. Authentication happens entirely at the bank.
- No sharing. Account data is not sent to any third party, not sold, not
used for advertising, profiling or automated decision-making affecting anyone, and not used to train any model.
Where it is kept
On the owner's own computer, in a local database file. Nothing is uploaded to a hosted service by SCARVAULT.
The full IBAN of a connected account is not stored — only a masked form (first two and last four characters), because the rest is not needed to reconcile a payment and storing what is not needed is a liability.
The application's private key is held in a file on the owner's machine. It is never written to the database, never printed to logs, and never transmitted.
Why it is used
A single purpose: to reconcile money. SCARVAULT matches marketplace payouts and business expenses against the bank record, so that revenue is reported as received only once it has actually arrived rather than when a marketplace says a sale happened.
The lawful basis is the owner's consent, given at their bank and withdrawable at any time.
How long it is kept
Transactions are retained while they are useful for reconciliation and accounting. The owner can delete the local database at any time, which removes everything.
Withdrawing access
Access can be withdrawn at any time, in two places, either of which is sufficient:
Consent also expires on its own and must be renewed for access to continue.
Your rights
As the data subject and the controller are the same person here, the usual rights of access, rectification, erasure, restriction and portability are exercised directly against the local database.