Privacy Policy

1. Controller

The controller responsible for processing personal data in connection with Vanthis is:

You can use the email address above for privacy questions, access requests and deletion requests.

2. Data we process

Website and security data

When you access Vanthis, our hosting and security provider processes technical request information such as your IP address, request time, requested URL, browser information and security signals. We use this data to deliver the website, prevent abuse and maintain service security.

Beta access requests

If you request beta access, we process your name, work email address and any optional workflow description you submit. We use the request IP address only to apply a short rate limit. The beta access route does not store that IP address with your request.

Account and Google sign-in data

If you choose Google sign-in, Google and our identity provider Clerk provide the information needed to authenticate you. This can include your Google account identifier, name, email address, profile image and authentication or session information. Vanthis requests only the openid, email and profile scopes for Google sign-in.

Google sign-in does not give Vanthis access to Gmail, Google Drive, Google Calendar or other Google Workspace content.

Workspace and service data

When you use Vanthis, we process the information you and authorized collaborators add to the service. This can include Workspaces, Motions, steps, Resources, source links, comments, invitations, saved versions, agent proposals, work records and run evidence. We also process account identifiers, Workspace membership and permissions so that we can control access.

Local browser data

Vanthis can store drafts, interface preferences and connection preferences in your browser. This data stays on that device unless you submit or save it to the service. You can remove it through your browser settings.

3. How we use data

We process personal data to:

• provide, secure and operate the Vanthis website and service;
• create accounts, authenticate users and manage invite-only beta access;
• store and present the Workspaces and Motions that authorized users create;
• respond to beta access requests, support requests and privacy requests;
• prevent fraud, abuse and unauthorized access;
• meet legal obligations and establish, exercise or defend legal claims.

Where the GDPR applies, these purposes rely on steps requested before entering an agreement and performance of an agreement under Article 6(1)(b), our legitimate interests in providing and protecting the service under Article 6(1)(f), and legal obligations under Article 6(1)(c). We rely on consent under Article 6(1)(a) only where we specifically ask for it.

4. Service providers and sharing

We share personal data only where needed to provide or protect Vanthis, comply with law, or respond to your request.

• Cloudflare provides hosting, network delivery, security, rate limiting and data storage infrastructure.
• Clerk provides account, authentication and session services.
• Google provides Google sign-in when you choose that method.
• Configured AI providers process the content included in an AI-assisted request only when an authorized user invokes that feature. Vanthis keeps agent proposals separate from authored Workspace content until a user explicitly approves a change.

We may also disclose information when required by law, to protect rights and security, or in connection with a business transfer subject to appropriate protections. We do not sell personal data or Google user data. We do not use it for targeted advertising, credit decisions, lending, data-broker services or training generalized or non-personalized artificial intelligence models.

5. International processing

Some service providers may process data outside Germany or the European Economic Area. Where required, those transfers must rely on an applicable legal transfer mechanism and supplementary safeguards. You can contact us for information about the safeguards relevant to your data.

6. Retention and deletion

We retain personal data for as long as it is needed to provide the service, maintain account and Workspace continuity, meet security and legal requirements, or resolve disputes. The appropriate period depends on the type of data and why it is processed.

You can request account or personal-data deletion at tonycliffcore@gmail.com. We will delete or anonymize data when it is no longer required, unless we must retain it for a legal obligation or legal claim. Data held in security logs or backups may remain for a limited period until those systems cycle.

7. Security

We use technical and organizational measures designed to protect personal data. These include encrypted HTTPS transport, access controls, Workspace permissions, security headers, managed identity services, guarded changes and infrastructure security controls. No internet service can guarantee absolute security.

8. Your rights

Depending on applicable law, you may have rights to access, correct, delete or restrict your personal data, object to processing, receive portable data, and withdraw consent for future processing. You may also complain to a competent data protection supervisory authority. In Bavaria, information about supervisory authorities is available through the Bavarian data protection authorities.

Contact tonycliffcore@gmail.com to exercise a right. We may need to verify your identity before acting on the request.

9. Changes to this policy

We may update this policy when the service or legal requirements change. We will publish the current version here and update the effective date. If a change materially affects registered users, we will provide an appropriate notice.

This page describes the current Vanthis closed beta. It is a project policy prepared from the service's current implementation and should receive legal review before broader commercial use.