Last Updated: 5 October 2026
Welcome to Vanta ("we," "our," or "us").
This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application, public website, and Vanta Studio management service.
By using Vanta, you agree to the collection and use of information in accordance with this policy.
We collect the following types of information:
a. Information You Provide
b. Automatically Collected Information
c. Location Information
We may collect approximate location data based on your IP address or device settings.
This information is used to:
We do not collect precise GPS location unless explicitly stated and permitted by you.
We use your information to:
We use analytics tools built on Supabase to understand how users interact with the app.
This may include:
Analytics data is used to improve the app and is not sold to third parties.
We do not sell your personal information.
We may share information in the following cases:
We take reasonable measures to protect your information, including:
However, no system is completely secure, and we cannot guarantee absolute security.
We retain your information for as long as your account is active or as needed to provide our services.
Depending on your location, you may have the right to:
You may request deletion of your account and associated data by contacting us at:
matthew.m.kwon@gmail.com
We will process deletion requests within a reasonable timeframe.
Vanta is not intended for individuals under the age of 13 (or the minimum age required in your jurisdiction).
We do not knowingly collect personal data from children.
Your information may be stored and processed in countries outside your own.
By using the app, you consent to this transfer.
We may update this Privacy Policy from time to time.
We will notify users of significant changes by updating the "Last Updated" date.
If you have any questions about this Privacy Policy, please contact us:
Email: matthew.m.kwon@gmail.com
Google connections are optional and are initiated by you.
Google sign-in and connected-account identity: We access the Google account identity and email address authorized by you to identify the connected account and display the account being used.
Gmail sending: If a studio owner connects Gmail, we request gmail.send to send emails from that account. Vanta submits the owner-selected recipient addresses, subject, and message to Google. Owners can send a saved template to an individual client or confirm a campaign to selected clients with marketing consent. The Gmail integration does not read inbox messages, retrieve existing email content, manage drafts, or delete email.
Google Calendar: If an artist connects Google Calendar, we access authorized calendar events and availability to display appointments, check scheduling conflicts, and create, update, or delete events for booking management. This connection is separate from the Gmail connection.
Connected services provide OAuth access and refresh tokens that allow Vanta to perform these authorized actions. We store the connected account details and the credentials needed to maintain the connection.
We use Google user data to provide the connected-account identity, email sending, and calendar features described above. We do not sell Google user data, use it for advertising, or use it to train generalized artificial intelligence or machine-learning models.
Google user data is processed by the infrastructure providers we use to host and operate these features. Gmail messages are submitted to Google for delivery to the recipients selected by the studio owner; calendar actions are submitted to Google Calendar. Studio-selected email content is shared with its intended recipients. We do not share connected-account data with unrelated third parties.
Access by people is limited to circumstances permitted by the Google API Services User Data Policy, such as support with your consent, security investigations, or legal requirements. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
We protect access to connected-account data through authenticated account access, studio or artist permissions, and HTTPS connections to Google. Gmail OAuth credentials are encrypted at rest.
We retain connected-account credentials while the connection remains active so the authorized features can operate. Disconnecting Gmail in Marketing → Sender deletes the stored Gmail connection and tokens from Vanta and stops queued messages using that connection. Disconnecting Google Calendar removes the stored calendar connection. Disconnecting does not delete messages already sent through Gmail or events already created in Google Calendar.
Email templates, submission records, and booking records remain subject to our general data-retention policy. You may request deletion of Vanta-held account and integration data by emailing matthew.m.kwon@gmail.com. Records may be retained where required for legal obligations, security, or resolving disputes.
You can disconnect Gmail from Marketing → Sender in Vanta Studio, disconnect the calendar in the calendar connection settings, or revoke Vanta’s access through your Google Account’s third-party connections page. Revoking Google access prevents further authorized API operations, but does not automatically erase Vanta-held templates or historical booking and send records. Contact matthew.m.kwon@gmail.com to request deletion of that data.
Clients can unsubscribe using the link included in marketing emails. Vanta excludes unsubscribed addresses from further marketing sends.
Key points:
Google API Services User Data Policy and Limited Use requirements