Privacy Policy

Effective date: October 8, 2026

This Privacy Policy explains how Vantis processes information through the Vantis public website, business-operations application, customer-facing features, and connected services.

Operator and privacy accountability

Vantis is operated by Patrick McEnaney, an individual based in Ontario, Canada, who is responsible for overseeing Vantis privacy practices. Vantis is not currently incorporated. Privacy questions and requests may be sent to support@vantisops.com.

1. Scope and roles

Vantis is a business-oriented service used by organizations to manage accounts, staff and contractors, customers, work, scheduling, communications, billing, payments, and related operations. This policy applies to information Vantis processes to operate the service and to information that organizations and their authorized users submit or control through Vantis.

Organizations generally decide what customer, employee, contractor, and business records they enter and how they use those records through Vantis. Vantis processes those records to provide and operate the service functions the organization uses. The legal privacy role of Vantis and an organization can depend on the information, the activity, and applicable law; this policy does not assign one universal controller, processor, service-provider, or similar legal label to every activity.

If your request concerns records managed by an organization that uses Vantis, that organization may be the best first contact. Vantis may direct a request to, or coordinate with, the relevant organization as appropriate.

2. Information Vantis processes

Depending on the features an organization enables and uses, Vantis processes the following categories of information:

• Signup, account, and authentication information: name, email address, role, organization association, account status, password hashes, session and authentication records, and related security information. The public signup form sends name, email address, and password to Vantis to create a pending account request; the confirmation-password field is checked in the browser and is not included in that request.
• Organization configuration: organization profile, company and contact information, departments, job types, operational settings, finance and invoice settings, labour-rate and payroll configuration, communication settings, and other administrator-managed configuration.
• Customers, work, and service records: customer and contact information, service and billing addresses, work orders, schedules, assignments, checklists, notes, completion records, materials and inventory use, time sessions, and related operational records.
• Employees, contractors, attendance, and payroll-related information: user and team profiles, roles, job and department information, profile photographs where supplied, attendance and timecard records, payroll modes, pay-rate or compensation-related configuration, payroll review or status information, and operational notes where those features are used.
• Portal, booking, prospect, and quote information: customer Portal identities, accounts and sessions; public or Portal booking requests; prospect information; quote requests; and related contact, service, scheduling, and request details.
• Files and images: customer documents, work-order photographs, user profile photographs, company logos, email attachments, and associated file metadata where those features are used.
• Inventory, billing, invoices, and payment metadata: inventory items and units, allocations and consumption, billing records, invoice identifiers and line items, amounts, dates and statuses, delivery information, and the Stripe-related metadata described in Section 5 when an organization enables online invoice payments.
• Outbound communications and provider configuration: recipient addresses, sender and reply-to information, subjects, message bodies, attachments, provider identities, OAuth credentials, or SMTP configuration used for authorized outbound email.
• Notifications and browser push subscriptions: notification records and, when a user enables browser push, the browser push endpoint and cryptographic subscription keys needed to deliver notifications.
• Technical, synchronization, security, and audit information: session, authorization, expiration and revocation records; offline synchronization and records used to prevent duplicate updates; operational logs; security and audit records; and other technical records used to authenticate users, enforce access rules, diagnose failures, and operate the service. Network and hosting infrastructure can also receive ordinary connection metadata such as IP addresses. Vantis's application data model does not use a dedicated field for storing IP addresses as a general account or business record. Infrastructure and service-provider logs may nevertheless contain IP-related connection information, and Vantis does not state a universal retention period for those logs.
• Backup copies: Production database backups created for recovery and continuity purposes.

3. How Vantis uses information

Vantis uses information to provide, secure, maintain, and support the functions requested by organizations and authorized users. These purposes include account and session operation, organization administration, customer and work-order management, scheduling, attendance and time tracking, payroll-related workflows, inventory, quotes, billing and invoicing, customer Portal and booking functions, online invoice-payment support, notifications, configured outbound communications, synchronization, troubleshooting, security, audit, backup and recovery, and service administration.

When an organization connects or enables a third-party service, Vantis uses and transmits information as needed to provide that selected feature, as described below.

4. Hosting, storage, and service providers

Per Vantis's infrastructure records, the Production application, primary Production database, and associated public websites and pages run on a netcup GmbH virtual private server whose provider-displayed location is Nuremberg, Germany.

Vantis also uses third-party infrastructure and services for specific functions. Cloudflare R2 is used for supported object storage, including work-order photographs, customer documents, user profile photographs, and company logos. A separate private Cloudflare R2 bucket is used for Production database backups. Stripe is used for the organization-connected invoice-payment functionality described in Section 5. Connected email providers and browser-associated push services process information when the relevant organization or user enables those functions.

Cloudflare R2 is not the primary Vantis Production database. Vantis does not state a fixed geographic residency location for R2 objects because the current Vantis configuration does not establish one. Other providers may process information in locations outside the primary netcup hosting location according to their infrastructure and the applicable configuration.

5. Organization-connected Stripe invoice payments

An organization can connect its own Stripe account and use Vantis to create Stripe-hosted payment links for customer invoices. Customers enter card information into Stripe's hosted payment experience rather than into a Vantis card-entry form. For this implemented Stripe invoice-payment flow, Vantis does not receive or store raw card numbers or card security codes in its application records.

To create and reconcile these payments, Vantis sends invoice and transaction information needed for the requested Stripe operation and receives and stores associated Stripe account, payment-link, checkout-session, payment-intent, amount, currency, status, invoice, and reconciliation identifiers or metadata. Stripe processes information under its own terms and privacy practices.

This Stripe integration supports payments by an organization's customers. It is separate from any future billing for Vantis service itself.

6. Connected email providers

An authorized administrator can configure an organization-selected outbound email provider. Supported reusable SMTP passwords and Google or Microsoft OAuth refresh tokens are encrypted before database persistence and handled server-side. Stored provider passwords, OAuth refresh tokens, client secrets, and access tokens are not returned to the Vantis client interface through the email settings flow.

Google / Gmail

When an authorized administrator connects Google, Vantis requests openid, email, profile, and https://www.googleapis.com/auth/gmail.send.

• Vantis uses Google OpenID user information to identify the connected sending account, including the Google account ID, email address, and display name when Google supplies it.
• The gmail.send permission is used to send outbound messages that the organization or its authorized users cause Vantis to send. Vantis does not request Gmail mailbox-read or mailbox-modify scopes for this connection, and the current Google email connection does not implement Gmail mailbox reading.
• Vantis stores the connected account ID, email address, optional display name, connection timestamp, and an encrypted OAuth refresh token in the organization's Email Settings. The refresh token is used server-side to obtain an access token when an authorized outbound send is needed.
• For a send, Vantis transmits the outbound recipient and message content, including included attachments, to the Gmail API users/me/messages/send endpoint for delivery.
• Disconnecting Google clears the locally stored OAuth refresh-token credential and connected Google identity fields from Vantis Email Settings. It does not itself revoke authorization at Google or delete unrelated Vantis business, invoice, audit, or operational records.

Google user data sharing and Limited Use

Vantis does not sell Google user data or use or transfer Google Workspace API data for advertising, data brokerage, creditworthiness, lending, or unrelated purposes. Vantis uses Google user data to provide the connected-Google functions described above. When an authorized Vantis user or workflow causes Vantis to send email, Vantis transmits the recipient and message content needed for that requested delivery to Google through the Gmail API. Vantis does not request or obtain Gmail mailbox-read data for this connection.

Protection, retention, and deletion of Google connection data

Google OAuth refresh tokens are encrypted before persistence using authenticated encryption and are handled server-side. Vantis retains the connected Google account ID, email address, optional display name, connection timestamp, and encrypted refresh token while the Google connection remains configured and the data are needed to provide outbound email. When an authorized administrator disconnects Google, Vantis clears the locally stored refresh token and connected Google identity fields. A user or organization may request deletion of Google-related data held by Vantis by contacting support@vantisops.com. Disconnecting Google does not automatically delete unrelated business, invoice, audit, or operational records.

Microsoft / Outlook

When an authorized administrator connects Microsoft, Vantis requests openid, profile, email, offline_access, User.Read, and Mail.Send.

• Vantis uses Microsoft Graph /me to identify the connected account using account ID, display name, mail address, and user principal name.
• Mail.Send is used to send outbound messages through Microsoft Graph /me/sendMail. Vantis does not request Mail.Read or Mail.ReadWrite for this connection.
• Vantis stores the connected account ID, email address, optional display name, connection timestamp, and an encrypted OAuth refresh token. Token refresh occurs server-side, and a replacement refresh token returned by Microsoft can replace the stored encrypted credential.
• For a send, Vantis transmits the outbound recipient and message content, including included attachments, to Microsoft Graph for delivery.
• Disconnecting Microsoft clears the locally stored OAuth refresh-token credential and connected Microsoft identity fields. It does not itself delete unrelated Vantis business or operational records.

Yahoo Mail

Vantis's Yahoo connection uses SMTP with a Yahoo app password rather than Yahoo OAuth.

• The administrator supplies the Yahoo email address, sender display name, and Yahoo app password. Vantis uses smtp.mail.yahoo.com on port 587 and requires TLS for this Yahoo transport.
• The Yahoo app password is encrypted before persistence and is not returned to the client interface. Vantis decrypts it server-side only when needed for SMTP transport.
• For a send, Vantis transmits the recipient, sender or reply-to information, subject, message body, and included attachments to Yahoo SMTP for delivery. The current Yahoo email connection does not implement mailbox reading.
• Disconnecting Yahoo clears the stored SMTP host, username, encrypted password, and sender-address fields used for the connection. It does not itself delete unrelated business or operational records.

Custom SMTP

For Custom SMTP, an authorized administrator supplies the SMTP host, port, username, password, sender address and name, with an optional reply-to address.

• The SMTP password is encrypted before persistence and is not returned to the client interface. Vantis decrypts it server-side only when needed for transport.
• Custom SMTP transport security depends on the selected service and configuration. Vantis uses a secure SMTP connection for port 465 and otherwise relies on the configured service's SMTP negotiation.
• For a send, Vantis transmits the recipient, sender or reply-to information, subject, message body, and included attachments to the administrator-selected SMTP service for delivery. SMTP sending does not itself give Vantis mailbox-reading access.
• Disconnecting Custom SMTP clears the stored SMTP host, username, encrypted password, and sender-address fields used for the connection. It does not itself delete unrelated business or operational records.

7. Browser push notifications

Browser push notifications are optional. When a user enables them, Vantis stores the push subscription endpoint and the subscription's cryptographic keys. For a notification, Vantis sends the subscription information and a limited notification payload to the browser-associated push delivery service. The payload can include a Vantis notification identifier and type and, when relevant, limited job-title or customer-name information. Vantis removes a stored subscription when the push service reports that the endpoint no longer exists.

8. When information is disclosed or transmitted

Vantis transmits or discloses information when needed to provide features selected by an organization or user, operate and secure the service, or satisfy applicable legal requirements. Examples include transmitting outbound email to the configured email provider, storing supported objects and backups with Cloudflare R2, creating or reconciling a Stripe-hosted invoice payment, and delivering an enabled browser push notification.

Organizations can also make information available to their authorized users, contractors, Portal users, customers, or other recipients through features they choose to use. Each organization remains responsible for its own lawful collection, use, disclosure, notices, and consents for organization-managed information, except to the extent Vantis has an independent obligation under applicable law.

9. Cross-border processing

The primary Vantis Production application and database are hosted on the netcup VPS described in Section 4 in Nuremberg, Germany. That does not mean all Vantis-related processing occurs exclusively in Germany. Cloudflare, Stripe, connected email providers, browser push services, and other service providers used for specific features may process information in other jurisdictions according to their infrastructure and applicable configurations.

Information held or processed in another jurisdiction may be subject to the laws of that jurisdiction and to lawful requests from courts, law-enforcement agencies, regulators, or other authorities with jurisdiction. Organizations should consider the providers and features they enable when assessing their own data-location or contractual requirements.

10. Security

Vantis uses technical controls that include bcrypt password hashing; server-backed session and authorization controls; tenant and role checks for authenticated resources; and same-origin checks on cookie-backed authentication actions. Vantis uses HttpOnly session cookies for sign-in. Its main application and customer Portal session cookies use SameSite=Strict and use the Secure attribute in production. Some short-lived cookies used during Google or Microsoft account connections use Secure when the configured public origin uses HTTPS, with SameSite settings scoped to their purpose. Vantis also uses authenticated encryption for supported reusable SMTP passwords and Google or Microsoft OAuth refresh tokens before persistence, and authorization checks before signed object-read URLs are issued for supported files.

The security controls described in this policy do not include a blanket claim that every database record, object, or backup is encrypted at rest. No method of storage, transmission, authentication, or access control can guarantee absolute security. Users and organizations are responsible for protecting credentials under their control and limiting account access to authorized people.

11. Privacy requests and individual rights

Depending on applicable law and the circumstances, an individual may have rights relating to access, correction, deletion, or other handling of personal information. Requests can be sent to support@vantisops.com.

Vantis may request information reasonably necessary to verify the requester's identity, authority, account, organization, or relationship to the requested information before acting. Where the requested information is managed by a Vantis customer organization, Vantis may direct the individual to that organization or coordinate with it as appropriate. Requests remain subject to applicable legal exceptions, security requirements, contractual obligations, and records that Vantis or the organization is permitted or required to retain.

Vantis does not promise one universal response period, a comprehensive self-service privacy-request tool, or immediate deletion of every copy. Vantis will respond to privacy requests as required by applicable law.

12. Retention, deletion, and backups

Vantis uses different retention rules and criteria for different categories of information. Where no fixed period is stated below, retention depends on the identified account or record lifecycle and on operational, security, audit, legal, or contractual needs:

Vantis has operator tools for suspending and deleting organization accounts, but the current service does not provide a comprehensive organization-wide self-service export or self-service deletion process, and Vantis does not represent that an organization deletion removes every record or backup immediately. Limited lifecycle, audit, cleanup, security, legal, or backup records can remain where appropriate.

13. Security incidents

If Vantis becomes aware of a security incident involving information it processes, Vantis will assess and respond to the circumstances, notify affected organizations without undue delay when their information is involved and notification is appropriate, and make reports or notifications required by applicable law. Vantis does not state one universal numeric incident-notification deadline.

14. Children and minors

Vantis is a business-oriented service and is not directed to minors. Organization-account users must meet the eligibility requirements in the Terms of Service. Vantis does not represent that it performs age verification. Organizations are responsible for ensuring they have appropriate authority for information they submit to Vantis.

15. Public-site and application technologies

The current Vantis public website pages do not include third-party analytics or advertising scripts and do not use browser localStorage or sessionStorage. The Vantis application uses sessionStorage for short-lived authentication and session context and some session-scoped operational data, and it uses server-managed session cookies for authenticated sessions.

The current Vantis application does not include a third-party advertising, behavioral-profiling, or analytics SDK. This statement concerns Vantis application software; hosting, network, and other service providers may keep operational, access, security, or service logs under their own systems and configurations.

16. Privacy contact and accountability

Privacy questions, requests, and complaints can be sent to Patrick McEnaney as the Vantis privacy contact at support@vantisops.com. Vantis may coordinate a request with the relevant customer organization where that organization manages the information involved.

Vantis handles personal information as described in this policy and responds to privacy requests as required by applicable law. This policy does not state that a particular privacy statute applies to Vantis, to every organization using Vantis, or to every individual whose information appears in the service.

17. Changes to this policy

Vantis may update this Privacy Policy as the service, service providers, or information practices change. The version date shown at the top identifies this version. A revised version becomes effective when Vantis publishes it or otherwise puts it into effect.