Privacy policy

Who we are

Vanthio is operated by [LEGAL ENTITY], [ADDRESS] ("we"). For the personal data described here we act as the data controller. You can reach us at [CONTACT EMAIL].

If you use Vanthio to support your own users, you are the controller of those conversations and we act as your processor.

What we collect

From visitors using a chat widget: the display name they enter or that your app supplies, the content of their messages, an email address if they provide one, and any context fields the site owner has explicitly whitelisted.

From people using a feedback board: the posts, comments, and votes they submit, tied to the same identity.

From operators and account holders: an email address, a name, and a password stored only as a hash. When you sign in we also record the IP address and browser user agent against that session, which is standard practice for detecting account misuse.

We do not run analytics, advertising, or third-party tracking scripts.

Cookies

vanthio_session identifies a visitor across their conversations. It is signed, cannot be read by JavaScript, and lasts thirty days.

vanthio_sso_attrs briefly carries context across a single sign-on redirect and expires after ten minutes.

vanthio_lang remembers your language choice.

A session cookie is set when an operator signs in, so they stay signed in.

All of these are strictly necessary for the service to function. We set no advertising or analytics cookies.

Why we process it

To provide the service you or a site owner asked for — that is, to deliver messages, show a board, and let the right people reply. This is performance of a contract.

To keep accounts secure and prevent abuse. This is our legitimate interest.

Who we share it with

Nobody. Vanthio makes no outbound calls to third-party services, and we do not sell or rent personal data.

The only processor involved is our hosting provider, which stores the database and runs the application on our behalf within the EU.

How long we keep it

Conversations, posts, and votes are kept until the site owner deletes them or closes the project. Deleting a project removes everything belonging to it.

Account records are kept while the account exists and are deleted on request.

Your rights

Under the GDPR you can request access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest.

Write to [CONTACT EMAIL] and we will respond within one month. If you are unhappy with how we handle it, you may complain to your national supervisory authority.

Changes

If we change this policy we will update the date at the top. Material changes affecting existing users will be communicated directly.