Privacy Policy

This Privacy Policy explains how [Legal Entity Name] ("we", "us", "our") handles personal information in connection with the Vanta Panel website at vantapanel.com, the client/billing area, and the license-validation service (the "Service"). It does not cover data that you process on your own server using the software — for that data you are the controller and are responsible for your own privacy practices.

1. Who we are

The data controller for the Service is [Legal Entity Name], [Business Address]. For any privacy question, contact us at support@vantapanel.com.

2. Information we collect

Account information. When you register, we collect your name, email address, and a hashed password.
Billing information. When you subscribe, payment is processed by Stripe. We receive limited details such as your Stripe customer identifier, subscription status, the last four digits and card brand, and billing country — we do not receive or store your full card number.
License activation data. When your installation validates its license, the license service may receive and store the server's IP address, hostname, an installation fingerprint, and the time of the last check, for the purpose of license enforcement and abuse prevention.
Installation usage data. Your installation's daily check-in reports the hosting account usernames and the domain names configured on that server. We use this to verify that paid licenses are used within their terms and to detect abuse — for example installations used to host phishing, malware, or attack infrastructure — so we can protect the Service and other users. We do not receive mailbox contents, passwords, files, or any of your end-users' site content. You can disable all telemetry (including this report) at any time by creating the file /etc/vantapanel/no-telemetry on your server.
Support communications. If you contact us, we keep your messages and contact details to respond and for our records.
Technical/usage data. Like most websites, our servers log standard information such as IP address, browser type, and pages requested, for security and to keep the Service running.

3. How we use your information

To provide and operate the Service, including issuing and validating license keys.
To process subscriptions, payments, renewals, and refunds.
To communicate with you about your account, billing, security, and service changes.
To prevent fraud and abuse, and to enforce our Terms.
To comply with legal obligations.

Our legal bases (where applicable, e.g. under the GDPR/UK GDPR) include performance of a contract, our legitimate interests in operating and securing the Service, your consent (where required, e.g. for non-essential cookies or marketing), and compliance with legal obligations.

4. Payments

We use Stripe to process payments. Your card data is collected and stored by Stripe under their own security standards and privacy policy; we never see your full card number. Please review Stripe's privacy policy for details on how they handle your information.

5. Cookies

We use a small number of cookies that are necessary for the Service to function — primarily a session cookie that keeps you signed in and protects against cross-site request forgery. These essential cookies do not require consent. If we introduce analytics or other non-essential cookies in future, we will update this policy and obtain consent where required.

We do not sell your personal information. We share it only with:

Service providers who help us run the Service — for example, our payment processor (Stripe) and our hosting/infrastructure providers — under appropriate confidentiality and data-processing terms.
Legal and safety recipients, where we are required by law or where disclosure is necessary to protect our rights, users, or the public.
Business transfers, if we are involved in a merger, acquisition, or sale of assets, in which case we will provide notice.

7. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service, then for any additional period required to comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion as described below; some records (e.g. invoices) may be retained where the law requires.

8. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit (HTTPS), hashed passwords, and restricted access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA/UK have rights under the GDPR/UK GDPR; California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. To exercise any right, contact us at support@vantapanel.com; we may need to verify your identity. You may also have the right to complain to your local data-protection authority.

10. International transfers

We and our service providers may process your information in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards (such as standard contractual clauses) where required by law.

11. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, for material changes, provide additional notice where appropriate.

13. Contact

Questions or requests about your privacy? Contact [Legal Entity Name] at support@vantapanel.com.