Privacy Policy

1. Introduction

Vantor Treasury, Inc. ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Vantor platform ("Service"). By using the Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account registration information (name, email address, password)
• Organization and enterprise details
• Financial data imported from connected ERP systems, bank accounts, and digital asset wallets
• Transaction records and payment information
• Communications with us (contact form submissions, support requests)

2.2 Information Collected Automatically

• Device information (browser type, operating system, device identifiers)
• Usage data (pages visited, features used, timestamps)
• IP address and approximate geographic location
• Error logs and performance data (via Sentry)

2.3 Information from Third Parties

• Financial account data from Plaid or other banking integrations
• Blockchain data from public networks (wallet balances, transaction history)
• Compliance screening results from Chainalysis or similar providers
• ERP data from connected systems (invoices, vendors, GL entries)

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Process transactions and manage treasury operations
• Generate AI-powered treasury recommendations and forecasts
• Perform compliance screening and regulatory checks
• Send transactional emails and system notifications
• Monitor for fraud, security threats, and unauthorized access
• Respond to your inquiries and provide customer support
• Comply with legal obligations and regulatory requirements
• Generate aggregated, anonymized analytics to improve the Service

4. How We Share Your Information

We do not sell your personal information. We may share your information with:

• Service providers: Third-party services that help us operate the platform (e.g., Supabase for data storage, Plaid for banking, Chainalysis for compliance, Anthropic for AI features, Sentry for error tracking)
• Compliance authorities: When required by law, regulation, or legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets
• With your consent: When you explicitly authorize sharing

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Role-based access control (RBAC) with least-privilege principles
• Row-level security (RLS) policies for data isolation between enterprises
• Comprehensive audit logging of all sensitive operations
• Regular security assessments and monitoring

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We may also retain certain information as required by law, for audit purposes, or to resolve disputes. Upon account termination, we will delete or anonymize your personal data within 90 days, except where retention is required by law.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Object to or restrict certain processing of your data
• Request portability of your data in a structured format
• Withdraw consent at any time (where processing is based on consent)

To exercise these rights, contact us at privacy@vantor.xyz.

8. GDPR — European Economic Area

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply:

8.1 Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you requested
• Legitimate interests: Analytics, fraud prevention, security monitoring, and Service improvement
• Legal obligation: Compliance screening, regulatory reporting, and record-keeping
• Consent: Where required, such as for optional communications

8.2 Your GDPR Rights

In addition to the rights listed in Section 7, you have the right to:

• Lodge a complaint with your local data protection supervisory authority
• Request restriction of processing while a complaint is being resolved
• Object to processing based on legitimate interests

8.3 International Transfers

When we transfer personal data outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission or other legally recognized transfer mechanisms.

8.4 Contact

For GDPR-related inquiries, contact our data protection team at privacy@vantor.xyz.

9. CCPA — California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

9.1 Do Not Sell or Share

Vantor does not sell your personal information to third parties. We do not share your personal information for cross-context behavioral advertising.

9.2 Categories Collected

• Identifiers: Name, email address, IP address, wallet addresses
• Financial information: Bank account details, transaction records, digital asset holdings
• Commercial information: Invoice data, payment history, ERP records
• Internet activity: Usage data, pages visited, feature interactions
• Professional information: Organization name, role, business details

9.3 Your CCPA Rights

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Not be discriminated against for exercising your privacy rights
• Designate an authorized agent to submit requests on your behalf

To exercise these rights, contact us at privacy@vantor.xyz.

10. Cookies and Tracking

We use essential cookies for authentication and session management. We use Sentry for error tracking and performance monitoring. We do not use third-party advertising cookies or trackers. You can manage cookie preferences through your browser settings.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: