Privacy, in plain words

1.Who we are and what this policy covers

Vantabox (vantabox.ai) is a service that builds and hosts custom web apps from a plain-words description, operated by Liberty Marketplaces LLC, an Arizona limited liability company with its principal office at 4539 N 22nd St Ste R, Phoenix, Arizona 85016 (“Liberty,” “we,” “us” or “our”).

This policy applies to the vantabox.ai website, your Vantabox account, the apps we build and host for you, and the Vanta Pass (together, the “Service”). For information about our own customers, website visitors and contacts, we decide how it is used (in some laws, the “controller”). For the apps we build and host for you, and the people who use them, you decide how their information is used and we act as your service provider (in some laws, the “processor”). See Section 3.

This policy does not apply to websites and services operated by others, even if we link to them. Capitalized terms not defined here have the meaning given in our Terms of Service.

2.Information we collect

Information you give us

• Account and build information, such as your name, email address, phone number if you give it, what you want built, your answers about it and the changes you ask for, and the IP address your build request came from, which we use to prevent abuse and to enforce one free build per person.
• Your AI key. If you give us your own Anthropic API key, we store it encrypted and use it only for your builds and your app.
• Payment information. Our payment processor collects your card details when you pay a build fee, add Vanta credits or pay for hosting. We receive only limited information, such as the card type and last four digits.
• Vanta Pass and wallet. If you get a Vanta Pass, it is held in a digital wallet. We record the public wallet address and which Pass it holds. If we create a built-in wallet for you, it is linked to your email sign-in.
• Communications with us, such as support requests and feedback.

Information collected automatically

• Log and device data. When you use the Service, our servers and hosting providers automatically record technical information such as your IP address, browser type and version, operating system, the pages and features you use, referring page, and the date and time. We use it to deliver the Service, keep it secure and fix problems.
• Approximate location. A general location (such as city or region) can be inferred from an IP address. We do not collect precise location.
• Cookies. We use only the cookies the Service needs to work. See Section 7.

Information from other sources

• Your app's users, when people use an app we host for you (see Section 3).
• Public blockchain records, to confirm which Vanta Pass a wallet holds.
• Service providers, such as payment confirmations from our payment processor.

3.Your app and its users

The app we build for you is yours, and so is the information your customers and users put into it. We host your app and process that information only to run it as you set it up, on your behalf. We never sell it or use it for anything else.

You decide what your app collects, and you are responsible for your app's own privacy notice and terms for its users and for answering their requests. If one of your app's users contacts us, we will pass the request to you and help you respond. You can download everything at any time from Owner › Backups & export.

4.How we use information

We use personal information to:

• provide, operate, maintain and support the Service, including the features you choose to use;
• create and secure accounts, verify identity and prevent unauthorized access;
• process payments, send invoices and receipts, and keep financial records;
• communicate with you about the Service, including service messages, security alerts, support responses and changes to our terms or policies;
• build, change, host and back up your app, and run the AI features you ask for;
• enforce our fair-use rules, including one free build per person, and refuse or take down apps that break the law or are built to deceive people;
• monitor, troubleshoot, measure and improve the Service and develop new features;
• detect, investigate and prevent fraud, abuse, spam, security incidents and violations of our Terms;
• comply with laws, regulations, legal process, and tax and accounting obligations, and establish, exercise or defend legal claims; and
• for any other purpose we describe when we collect the information, or with your consent.

We may create de-identified or aggregated information that can no longer reasonably identify anyone. We use it only for lawful business purposes and will not attempt to re-identify it, except to confirm that our de-identification works.

We do not use automated processing to make decisions about you that produce legal or similarly significant effects.

5.Artificial intelligence

Vantabox uses artificial-intelligence services to build and change your app from your description, and your app may use AI features you ask for. Your build request, answers and change requests, and the content your app's AI features handle, are sent to these services only as needed to provide Vantabox and your app. If you use your own Anthropic key, those requests are made with your key under your own account with Anthropic. We do not use your app's data to train general-purpose AI models.

6.How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We disclose personal information only as follows:

• Service providers that perform services for us, such as website and app hosting, database and file-storage providers, artificial-intelligence services, our payment processor, and email-delivery providers. They may use the information only to provide their services to us and are bound by confidentiality and security obligations.
• The people you give access to. Information in your app is shown to the people you give access to it.
• Public blockchain. Vanta Pass ownership is recorded on a public blockchain. Anyone can see which wallet address holds a Pass, and those records are permanent; we cannot change or delete them.
• Professional advisers, such as accountants, auditors, insurers and banks, under duties of confidentiality.
• Legal and safety: when we believe in good faith that disclosure is necessary to comply with a law, regulation, subpoena, court order or other legal process or valid government request; to enforce our agreements; to protect the rights, property or safety of Liberty, our users or others; or to detect, prevent or address fraud, security or technical issues.
• Business transfers: in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, receivership or sale of all or part of our business or assets. Any recipient must honor this policy for the information it receives.
• With your consent or at your direction, for example when you connect another service to your account.

We may also share de-identified or aggregated information that cannot reasonably identify anyone.

7.Cookies and similar technologies

We use only strictly necessary cookies and similar storage that the Service needs to work, such as a sign-in cookie for your Vantabox account, a cookie that remembers a connected wallet, and short-lived security tokens used during sign-in. We do not use advertising cookies, third-party analytics or tracking pixels, and we do not track you across other websites.

Do Not Track and Global Privacy Control. Because we do not track users across websites, we do not respond differently to “Do Not Track” browser signals. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of any sale or sharing of personal information, although we do neither.

8.How long we keep information

We keep personal information only as long as reasonably necessary for the purposes described in this policy, unless the law requires or permits a longer period. As a guide:

• Account and build information: as long as your account or app exists. Ask and we delete it, except records we must keep by law.
• Your app and its data: while your app exists. If hosting is unpaid, your app is switched off, not deleted.
• Your AI key: until you remove or replace it or your account is deleted.
• IP addresses of build requests: as long as needed to prevent abuse and enforce fair-use limits.
• Billing and transaction records: as long as tax, accounting and legal rules require, generally at least seven years.
• Support correspondence: generally up to three years after it is resolved.
• Log data: for a limited period set by our hosting providers.

We may keep information longer where necessary to resolve disputes, enforce our agreements or comply with a legal hold. When information is no longer needed, we delete or de-identify it; copies held in backups are removed on the backups' normal schedule.

9.How we protect information

We use reasonable administrative, technical and physical safeguards designed to protect personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction. These include encryption in transit (HTTPS) across the Service, encryption at rest provided by our hosting and database providers, encryption of stored AI keys, access limited to people who need it to do their jobs, individual sign-ins, and periodic review of our security practices. Payment card numbers are handled by our payment processor and never stored on our systems.

You are responsible for keeping your sign-in methods secure and for telling us promptly at hello@vantabox.ai if you believe your account has been compromised. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If we learn of a security breach that affects your personal information, we will notify you, and our business customers where their data is affected, as required by law.

10.Third-party services and links

The Service may link to or work with websites, products and services we do not operate, such as Anthropic, payment processors, email senders, phone-number providers and domain registrars you connect to your app. We are not responsible for their content or privacy practices, and this policy does not apply to them. Their own terms and privacy policies govern your use of them.

11.Where we process information

Liberty is based in the United States, and we and our service providers store and process information in the United States. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States, where data-protection laws may differ from those in your country. Where the law requires, we take steps to provide appropriate safeguards for such transfers.

12.Your privacy rights and choices

Your choices

• Account information. You can review and update much of your account information in the Service at any time.
• Marketing emails. You can opt out of marketing emails at any time by using the unsubscribe link or emailing hello@vantabox.ai. We may still send service messages about your account.
• Your app's data. Download everything at any time from Owner › Backups & export, or ask us to delete your app.

Your rights

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you, including the categories, sources, purposes and recipients;
• correct inaccurate personal information;
• delete personal information we hold about you;
• receive a copy of your personal information in a portable format;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do none of these);
• limit the use of sensitive personal information (we use it only for the purposes the law permits);
• withdraw consent where we rely on it; and
• appeal our decision about a request.

We extend these rights to everyone, wherever you live, subject to the exceptions the law allows (for example, information we must keep to comply with the law or to complete a transaction).

How to make a request

Email hello@vantabox.ai with “Privacy request” in the subject line, or write to us at the address in Section 17. To protect your information, we will verify your identity by matching information we already hold, for example by confirming the request from the email address on your account, and we may ask for more information if needed. You may use an authorized agent; we will ask for your signed permission and may ask you to verify your identity directly with us. We will respond within 45 days, and if we need more time (up to another 45 days, where the law allows) we will tell you why. Requests are free unless they are manifestly unfounded or excessive. If we cannot fully meet a request, we will explain why.

If your request is about information held in an app we host for one of our customers, that customer is responsible for it. We will pass your request to them and help them respond.

Appeals

If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line within 60 days. We will respond within the time the law requires. If we deny your appeal, you may contact your state's attorney general.

No discrimination

We will not deny you the Service, charge you a different price or give you a different level of quality because you exercised any of these rights.

13.Children's privacy

Vantabox is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

14.Additional information for U.S. state residents

California

This section supplements this policy for California residents under the California Consumer Privacy Act, as amended (“CCPA”). In the past 12 months we have collected the following categories of personal information, from the sources, for the purposes and disclosed for business purposes to the recipients shown:

• No sale or sharing. We have not sold or shared (for cross-context behavioral advertising) personal information in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.
• Sensitive personal information. We use and disclose it only for purposes the CCPA permits, and never to infer characteristics about you.
• Retention. We keep each category for the periods described in Section 8.
• Shine the Light. We do not disclose personal information to third parties for their own direct-marketing purposes.
• Financial incentives. We do not offer financial incentives in exchange for personal information.
• Your rights. You may exercise the rights described in Section 12, including through an authorized agent.

Other states

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with consumer privacy laws may have the rights described in Section 12, including the right to appeal. We honor them for everyone.

Nevada

We do not sell covered information as defined under Nevada law. You may still submit an opt-out request to hello@vantabox.ai.

15.Visitors from the EEA, UK and Switzerland

If data-protection laws of the European Economic Area, the United Kingdom or Switzerland apply to you, we process your personal information on the following legal bases: to perform our contract with you or take steps at your request before entering into one; for our legitimate interests in providing, securing and improving the Service, communicating with customers and business contacts, and defending legal claims, where those interests are not overridden by your rights; to comply with legal obligations; and, where required, with your consent, which you may withdraw at any time.

You may have the right to access, correct, delete, restrict or object to our processing of your personal information (including objecting at any time to direct marketing), to data portability, and to withdraw consent. To exercise these rights, contact us as described in Section 12. You also have the right to lodge a complaint with your local data-protection supervisory authority.

16.Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date above. If we make material changes, we will give more prominent notice, such as a notice in the Service or an email to account holders, before the changes take effect where the law requires. Earlier versions are available on request.

17.Contact us

If you have questions about this policy or our privacy practices, or want to exercise your rights, contact us:

Please include “Privacy” in the subject line so your message reaches the right person quickly.