Privacy Notice

1. Controller and contact

Kyler Butler operates VantaAccess and is the controller of personal data described in this notice.

Privacy, account, and data-rights requests: support@vantaaccess.com.

2. Data we collect

• Account data: email address, password hash, account identifier, and any username or avatar URL you choose to add.
• Order data: products, plans, prices, currency, payment status, transaction/payment identifiers, delivered-key record, and the date, version, and text of the checkout legal acknowledgements.
• Payment data: the email address, amount, order reference, and transaction details needed by Plisio to create and confirm a payment. We do not receive or store your payment-card number, cryptocurrency wallet private key, or wallet login credentials.
• Support correspondence: information you include when you email us about an order, refund, complaint, or privacy request.
• Service and security data: authentication-session information and limited technical records generated by our hosting, database, payment, and email providers to operate and secure the service.

3. Why we use data and our legal bases

• To create accounts, process orders, deliver keys, send transaction confirmations, and provide support: performance of a contract or steps requested before entering one.
• To keep payment, tax, accounting, and consent records where required: compliance with legal obligations.
• To prevent fraud, secure accounts, investigate misuse, and protect the service: our legitimate interests in security and service integrity.
• Where a law requires consent for a specific optional activity, we will ask for it separately. We do not use account data for an email marketing list unless we first provide the required choice.

4. Processors and other recipients

We share data only as needed to run the store, complete your payment, comply with law, or protect rights and security. Relevant recipients or categories are:

• Plisio: cryptocurrency-payment processing and payment confirmation.
• Turso: production database hosting when configured for the live service.
• Hosting and infrastructure providers: they deliver the web application and may process connection and operational data.
• SMTP email provider: configured to send order confirmations and support-related email.
• Google Fonts and jsDelivr: content-delivery services used to load fonts and Alpine.js. Requests to them may include your IP address and browser-request information.
• Authorities, advisers, or counterparties: only where legally required or reasonably necessary to establish, exercise, or defend legal claims.

5. International transfers

VantaAccess is operated from the United States, and our providers may process data in the United States and other countries. Where data-protection law requires a transfer mechanism, we will use the mechanism available for the relevant transfer, such as an adequacy decision or contractual safeguards. You may ask us for more information about applicable safeguards using the contact details above.

6. Cookies and local storage

We use strictly necessary authentication cookies to keep signed-in users authenticated. We also use browser local storage for the cart associated with your account or device. These are needed for the functions you request. We do not use analytics, advertising, or social-media tracking cookies, so this site does not display an optional-cookie consent banner. If we add non-essential storage or tracking, we will provide an appropriate choice before it runs where required by law.

7. Retention

We retain account data while the account is active and for a reasonable period afterwards to resolve support, security, and fraud issues. We retain order, payment, tax/accounting, and checkout-consent records for up to seven years after the order, or longer where required or permitted by law. Support correspondence is retained for up to three years after closure of the request unless it must be retained with an order or legal record. Session records expire after seven days.

8. Your rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or objection to processing of your data; to receive portable data; and to withdraw consent when processing relies on consent. We may need to verify your identity and may retain records that we are legally required to keep. To exercise a right, email support@vantaaccess.com from the email address associated with your account.

If GDPR applies to you, you may also complain to your local data-protection supervisory authority. Nothing in this notice prevents you from using any right or complaint route available under applicable law.

9. Security

We use password hashing, HTTP-only authentication cookies, access controls, rate limiting, and payment-webhook verification. No online service can guarantee absolute security. Use a unique password and contact us promptly if you believe your account has been compromised.

10. Changes to this notice

We may update this notice when our practices, providers, or legal obligations change. We will publish the updated version and date here. Material changes will be communicated through a reasonable channel where required by law.