Privacy Policy | Vanta Panel

This Privacy Policy explains how Vanta Panel (“we”, “us”, “our”) handles personal information in connection with the Vanta Panel website at vantapanel.com, the client/billing area, and the license-validation service (the “Service”). It does not cover data that you process on your own server using the software — for that data you are the controller and are responsible for your own privacy practices.

1. Who we are

The data controller for the Service is Vanta Panel. For any privacy question, contact us at support@vantapanel.com.

2. Information we collect

Account information. When you register, we collect your name, email address, and a hashed password.
Billing information. When you pay by card, payment is processed by Stripe. We receive limited details such as your Stripe customer identifier, subscription status, the last four digits and card brand, and billing country — we do not receive or store your full card number. When you pay with PayPal, PayPal processes the payment and we never see your PayPal login or funding details.
Install report. When the installer finishes, it reports the install once to vantapanel.com: the server’s IP address, the Vanta Panel version and the operating system. You can skip it by installing with VP_NO_INSTALL_PING=1; what the panel sends home is documented on our security page.
License activation data. While a paid license key is installed, your installation validates it with the license service, which may receive and store the license key, the server’s IP address, hostname, an installation fingerprint, and the time of the last check, for the purpose of license enforcement and abuse prevention. This check cannot be switched off separately; removing the key stops it and returns the panel to free-tier limits.
Installation usage data. Your installation’s daily check-in reports a random installation ID, the Vanta Panel version, plan, number of hosting accounts, PHP version and operating system, an installation fingerprint (a hash of the server’s machine ID), on paid installations the license key, and the hosting account usernames and the domain names configured on that server. We use this to verify that paid licenses are used within their terms and to detect abuse — for example installations used to host phishing, malware, or attack infrastructure — so we can protect the Service and other users. We do not receive mailbox contents, passwords, files, or any of your end-users’ site content. You can switch the daily check-in off at any time by creating the file /etc/vantapanel/no-telemetry on your server.
Update checks and sponsored banners. These requests are not reports and the opt-out file does not stop them. Your installation reads update.json from get.vantapanel.com at most every 30 minutes, and again when the vWHM dashboard loads; the request carries the Vanta Panel version in its User-Agent and, like any web request, the server’s IP address. Without a paid license, the panels also fetch ads.json from get.vantapanel.com at most about once an hour and show sponsored banners whose images load from the advertisers’ own servers, so those advertisers receive the IP address and browser details of whoever views the panel. The default page placed on a newly created site fetches the same ads.json file from each visitor’s browser, so get.vantapanel.com receives those visitors’ IP addresses until the site’s own index file replaces that page. A paid license removes the banners from the panels. Every request the panel makes is listed on our security page.
Support communications. If you contact us, we keep your messages and contact details to respond and for our records.
Technical/usage data. Like most websites, our servers log standard information such as IP address, browser type, and pages requested, for security and to keep the Service running.

3. How we use your information

To provide and operate the Service, including issuing and validating license keys.
To process subscriptions, payments, renewals, and refunds.
To communicate with you about your account, billing, security, and service changes.
To prevent fraud and abuse, and to enforce our Terms.
To comply with legal obligations.

Our legal bases (where applicable, e.g. under the GDPR/UK GDPR) include performance of a contract, our legitimate interests in operating and securing the Service, your consent (where required, e.g. for non-essential cookies or marketing), and compliance with legal obligations.

4. Payments

We use Stripe to process card payments and PayPal for PayPal payments. Your card data is collected and stored by Stripe under their own security standards and privacy policy, and your PayPal account details stay with PayPal; we never see your full card number or your PayPal login. Please review their privacy policies for details on how they handle your information.

5. Cookies

We use a small number of cookies that are necessary for the Service to function — primarily a session cookie that keeps you signed in and protects against cross-site request forgery. If you use the light/dark switch, a vptheme cookie remembers your choice. These cookies do not require consent. If we introduce analytics or other non-essential cookies in future, we will update this policy and obtain consent where required.

We do not sell your personal information. We share it only with:

Service providers who help us run the Service — for example, our payment processors (Stripe and PayPal) and our hosting/infrastructure providers — under appropriate confidentiality and data-processing terms.
Advertisers, indirectly: on installations without a paid license, sponsored-banner images load from the advertiser’s servers, which therefore receive the viewer’s IP address and browser details (see section 2).
Legal and safety recipients, where we are required by law or where disclosure is necessary to protect our rights, users, or the public.
Business transfers, if we are involved in a merger, acquisition, or sale of assets, in which case we will provide notice.

7. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service, then for any additional period required to comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion as described below; some records (e.g. invoices) may be retained where the law requires.

8. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit (HTTPS), hashed passwords, and restricted access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA/UK have rights under the GDPR/UK GDPR; California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. To exercise any right, contact us at support@vantapanel.com; we may need to verify your identity. You may also have the right to complain to your local data-protection authority.

10. International transfers

We and our service providers may process your information in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards (such as standard contractual clauses) where required by law.

11. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date and, for material changes, provide additional notice where appropriate.

13. Contact

Questions or requests about your privacy? Contact Vanta Panel at support@vantapanel.com.