Privacy Policy

1. Who is responsible for your information

Two parties share this website and trade as Vanta Flows. Each is a controller under the GDPR, and a responsible party under POPIA, for the personal information it handles:

• If you are a client, the party responsible for your information is the one named on your proposal, service agreement or invoice.
• If you contact us before becoming a client, Vanta Flows LLC is responsible if you are outside South Africa, and Aidan Maguire trading as Vanta Flows is responsible if you are in South Africa.

In this policy, "we", "us" and "our" mean the responsible party. This policy covers vantaflows.com and our agency services. It does not cover our separate products, such as Clinzo and MoveM8.

2. What we collect

When you contact us

• Through the forms on this website: your name, email address and company, and a description of what you need. The contact page form also asks for your website, team size, the service you are interested in, and the tools you use. Each submission also sends the page it came from, the time, and your browser's user agent, which describes your browser and device type.
• When you book a call through Calendly: the details you enter in the booking form.
• Anything else you choose to send us, such as a phone number in an email.

When you pay us

• Billing details are collected and processed by our payment providers, Stripe and PayFast. We never store full card numbers or bank account numbers.
• We keep records of what you were invoiced and what you paid.

When we host a system for you

The systems we build and host hold business data that you and your team put into them, which can include personal information about your own customers, staff and contacts. We process that data on your behalf, as a processor under the GDPR and an operator under POPIA. You remain its controller or responsible party, and we use it only to provide our services to you, as set out in our Terms of Service.

When you browse this website

• Google Analytics 4 uses cookies to collect technical and usage information, such as the pages you visit, how you arrived, your approximate location, and your device and browser type.
• The fonts on this website are loaded from Google Fonts, so your browser sends your IP address to Google when a page loads.

When you try a demo

If you use a demonstration environment, such as the Vantage demo sandbox reached through "Try the demo", we collect your interactions with it. Demonstration environments are reset periodically. Please do not enter real personal information or client data into them.

3. Why we use it, and our lawful bases

• To reply to enquiries and prepare proposals. Our legitimate interests in responding to people who contact us, and taking steps you ask for before entering into a contract.
• To provide, host, support and bill for our services. Performance of our contract with you.
• To keep financial and tax records. Compliance with our legal obligations.
• To understand how this website is used, and improve it, using Google Analytics 4. Our legitimate interests in running and improving the website. You can opt out at any time, as explained in section 8.
• To run demonstration environments. Our legitimate interests in letting prospective clients evaluate our work.

4. Who we share it with

• Vantage, our own CRM, where contact form submissions are stored.
• Supabase, database and hosting infrastructure for the systems we build and host.
• Netlify, hosting for this website and for the systems we host. Netlify also receives contact form submissions if our CRM cannot be reached.
• Stripe and PayFast, which process payments.
• Wise and Payoneer, which we use to receive and transfer payments.
• Google Workspace, for email, documents and calendars.
• Google Analytics, for website analytics.
• Google Fonts, which serves the fonts on this website.
• Calendly, which handles call bookings.
• Make.com, which runs automation workflows we build and operate as part of our services.
• Professional advisers, such as accountants and lawyers, where needed.
• Authorities or other parties, where the law requires us to disclose information.

5. International transfers

We and our providers process personal information in the United States, the European Union and South Africa. Where we transfer personal information about people in the European Union to a country without an adequacy decision, we rely on standard contractual clauses or an equivalent safeguard.

6. How long we keep it

• Enquiries are kept while they remain relevant, and then deleted.
• Client data in systems we host remains available for 30 days after the end of your final paid period, as set out in our Terms of Service, after which we may permanently delete it. You can ask us in writing, before your final paid period ends, to keep it for longer.
• Financial records are kept for as long as the law requires.

7. Your rights

Depending on where you are, the GDPR and POPIA give you the right to:

• access the personal information we hold about you;
• have it corrected;
• have it deleted;
• object to how we use it;
• receive it in a portable format; and
• complain to a supervisory authority.

To exercise any of these rights, email aidan@vantaflows.com. We may need to confirm your identity before we act on a request.

If we hold your information because we host a system for one of our clients, please send your request to that client. We will help them respond.

In South Africa, you can complain to the Information Regulator. If you are in the European Union, you can complain to the data protection authority in the country where you live or work.

8. Cookies

• This website uses Google Analytics 4, which sets cookies with names beginning _ga to distinguish visitors and measure how the site is used.
• The booking calendar on our contact page is provided by Calendly, which may set its own cookies when it loads.
• Your light or dark theme choice is saved in your browser's local storage. It stays on your device and is not sent to us.

To opt out of Google Analytics, install Google's Analytics opt-out browser add-on, or block or delete cookies in your browser settings. This website works without analytics cookies.

9. Security

We use reasonable technical and organisational measures to protect personal information. No method of storing or transmitting information is completely secure, so we cannot guarantee absolute security.

10. Children

This website and our services are not directed at anyone under 18.

11. Changes to this policy

We may update this policy. The effective date at the top of this page shows when it last changed.

12. Contact

For privacy questions and requests:

Email: aidan@vantaflows.com
Post: Vanta Flows LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA