Effective 2026-05-11
This Policy covers information handled by National Cold Vault LLC (“NCV,” “we”), an Ohio limited liability company, 576 12th St NW, Carrollton, OH 44615, through nationalcoldvault.com, the Cold Vault Node, and our monitoring platform (together, the “Service”).
The Service is sold to businesses and licensed professionals. Most information we hold is business information, not personal information about consumers.
2.1 Account and business information you give us: business name, business address, the name, business email, and mobile number of your designated contacts, and shipping address.
2.2 Alert contact information: at least one mobile number capable of receiving voice calls and SMS. This is the only way the Service can function.
2.3 Payment information — we do not hold it. Card details go directly to Stripe. NCV never receives, stores, or transmits full card numbers. We retain only the last four digits, card brand, and expiration as returned by Stripe.
2.4 Telemetry Data from your Node: temperature, humidity, battery level, signal strength, power status, device online/offline state, and timestamps. This is environmental data about equipment. It contains no information about any person.
2.5 Technical and usage data: IP address, browser type, pages viewed, and session timestamps.
2.6 Communications: emails, form submissions, and support correspondence.
2.7 What we do not collect: we do not collect Social Security numbers, financial account numbers, biometric data, precise geolocation of individuals, or information about anyone under 18. We do not knowingly collect information about your patients.
3.1 NCV monitors equipment environments. We do not create, receive, maintain, or transmit Protected Health Information as defined by HIPAA, and NCV is not a business associate.
3.2 Do not submit PHI to the Service. Do not use patient names or identifiers in device names, notes, or support messages.
3.3 If PHI is submitted despite §3.2, we will delete it promptly on discovery and notify your administrator. Inadvertent receipt of PHI does not make NCV a business associate.
3.4 A written HIPAA Position Statement is available on request.
We use information to: deliver the Service and generate your reports; send excursion, power-loss, and device-offline alerts by voice call and SMS to the numbers you provide; process payments through Stripe; provide support; secure the Service and investigate abuse; comply with law and resolve disputes; and improve the Service using de-identified, aggregated data that cannot identify you or your facility.
We do not use your information for advertising. We do not sell, rent, or trade it. We do not use your data to train third-party AI models.
5.1 Your consent. By providing a mobile number, you expressly consent to receive automated and prerecorded voice calls and SMS messages from NCV at that number for device alerts and service notices. We record the date, time, and exact language of your consent.
5.2 Frequency. Alerts are event-driven. We limit alerts to one per event per device and cap total alerts per device per 24-hour period to prevent runaway messaging.
5.3 Withdrawing consent. Reply STOP to any SMS, or email support@nationalcoldvault.com. We honor withdrawal within ten (10) business days.
5.4 Withdrawing consent disables alerts. If you opt out, the Service can no longer notify you of a refrigeration failure. NCV has no liability for any loss occurring after you withdraw consent.
5.5 Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.
6.1 We do not sell, rent, or trade your information to anyone, for any purpose.
6.2 Service providers who process data on our instructions under written terms:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication | Account + Telemetry Data |
| Vercel | Hosting | Technical data |
| Twilio | Voice and SMS alerts | Alert contact numbers, alert content |
| Stripe | Payments | Billing information |
| EMQX | Device message broker | Telemetry Data |
| Google Workspace | Business email | Communications |
An updated list is available on request. All data is stored in the United States. We do not transfer your data outside the US.
6.3 Regulators — read this carefully.
NCV does not report, forward, or volunteer your Telemetry Data to any Board of Pharmacy, health department, accreditation body, the CDC, the FDA, or any other authority. Ever. Your records are yours.
We disclose data only if compelled by valid legal process, and where we are legally permitted, we will notify you before disclosing so you may object.
We will also provide your data to a third party at your written instruction.
6.4 Business transfer. If NCV is acquired or merges, your information may transfer as a business asset. The acquirer will be bound by this Policy for data collected under it, or we will give you notice and an opportunity to export and delete.
7.1 NCV maintains a written information security program that reasonably conforms to the CIS Critical Security Controls, Implementation Group 1, scaled to our size, as contemplated by Ohio Rev. Code Chapter 1354.
7.2 Controls include: encryption in transit (TLS 1.2 or higher) and at rest (AES-256) as provided by our infrastructure providers; database-level row security enforcing tenant isolation so no customer can access another’s data; multi-factor authentication on all administrative accounts; append-only audit logging with database-enforced immutability; and least-privilege access.
7.3 What we do not claim. NCV does not hold a SOC 2, ISO 27001, or HITRUST certification. Our infrastructure providers maintain their own certifications, available from them directly. We will state plainly when this changes.
7.4 No system is perfectly secure. We cannot guarantee absolute security.
7.5 Breach notification. We will notify affected customers without unreasonable delay and no later than 45 days after confirming a breach of personal information, consistent with Ohio law, and will report to authorities where required.
| Data | Retention |
|---|---|
| Telemetry Data | Subscription term + 36 months — intended to support common 3-year record-retention requirements |
| Account and billing records | 7 years after termination (tax and legal) |
| Alert and consent logs | 7 years — these are append-only and cannot be altered or deleted |
| Technical and usage data | 24 months |
| Support communications | 3 years |
You remain responsible for your own recordkeeping. Export and retain your own copies. Use §9 to export at any time, including for 90 days after termination.
9.1 You may: access your data; export it as CSV and PDF at any time from your dashboard; correct inaccurate information; delete your account data; and withdraw alert consent under §5.3.
9.2 To exercise these rights, email support@nationalcoldvault.com with your account email. We respond within 30 days. We may verify your identity and authority. If we decline, we explain why, and you may appeal by replying — we will respond to an appeal within 45 days.
9.3 Deletion and your compliance obligations. Deleting Telemetry Data may destroy records you are legally required to retain. Export your data before requesting deletion. We will confirm you understand this before acting. We may retain records we are independently required to keep.
9.4 We do not discriminate against you for exercising these rights.
9.5 State-specific rights. Residents of states with comprehensive privacy laws may have additional rights regarding personal information. Most information we hold is business information collected in a commercial context, which many of these laws exempt. Contact us at support@nationalcoldvault.com and we will honor applicable rights.
9.6 You may use an authorized agent, with written proof of authority.
10.1 We use cookies strictly necessary for authentication, security, and session management.
10.2 We use no third-party analytics, advertising, or tracking technologies. There is no Google Analytics, no Meta Pixel, and no LinkedIn Insight Tag on this site.
10.3 We honor Global Privacy Control signals.
The Service is for businesses. We do not knowingly collect information from anyone under 18.
Our site may link to third-party sites. We are not responsible for their privacy practices.
We will post any change here with a new effective date. For material changes we will email account holders at least 30 days in advance. Prior versions are available on request.
Privacy inquiries: support@nationalcoldvault.com
Mail: National Cold Vault LLC, 576 12th St NW, Carrollton, OH 44615
Phone: (575) 448-2858
Response time: 5 business days for general inquiries; 30 days for formal rights requests.