1. Scope
This policy explains how Vantafold, Inc. and Vantafold GmbH (together, “Vantafold”, “we”) handle personal data when you visit our website, create an account, or use the API.
It does not cover the content our customers send through the API on behalf of their own users. Where we process that content, we act as a processor on the customer's instructions under our Data Processing Addendum.
2. Data we collect
We collect three categories of data, and we try to keep each of them small:
- Account data you give us: name, work email, company, and billing details.
- Usage data generated by the service: request counts, token counts, latency, model routed to, cost, and error rates.
- Technical data from your browser or client: IP address, user agent, and the pages or endpoints you requested.
- Request content — prompts and completions — only where the customer has not enabled zero-retention mode, and only for the retention period on their plan.
3. How we use it
We use personal data for the following purposes, and no others:
- Providing the service, including routing requests and returning usage and cost data.
- Billing, invoicing, and collecting payment.
- Security: detecting abuse, fraud, and attacks against the platform.
- Support: diagnosing problems you report to us.
- Improving the service through aggregate, non-identifying analysis.
- Sending service and security notices. Marketing email is opt-in and separately unsubscribable.
4. Legal bases
Where the GDPR applies, we rely on the following legal bases: performance of a contract for providing the service and billing; legitimate interests for security, abuse prevention, and product improvement; consent for marketing communications; and legal obligation for tax and accounting records.
You may withdraw consent at any time without affecting processing carried out before withdrawal.
5. Model training
We do not train models on customer request content, and we do not permit our model providers to do so. Provider agreements include contractual prohibitions on training against data routed through Vantafold.
Aggregate, non-identifying signals — such as latency distributions and error rates by model — are used to improve routing quality. These signals contain no request content.
6. Sharing
We share personal data with the subprocessors listed on our subprocessors page, each under a written agreement with confidentiality and security obligations at least as protective as this policy.
We disclose data to law enforcement only where legally compelled, and we notify the affected customer unless prohibited by law. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
7. International transfers
Data may be processed in the United States and the European Union. Transfers out of the EEA and the UK rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with a transfer impact assessment we review annually.
Customers on plans with data residency may pin inference and storage to a region, in which case content does not leave that region.
8. Retention
Account data is retained for the life of the account and for seven years afterwards where tax law requires it. Usage data is retained for 24 months. Request content follows the retention period on the customer's plan — 7 days on Free, 90 days on Pro, and up to 24 months on Enterprise — and is not retained at all in zero-retention mode.
Deletion requests are honoured within 30 days, subject to legal retention obligations.
9. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Delete data, subject to our legal retention obligations.
- Export your data in a portable format.
- Object to or restrict processing based on legitimate interests.
- Lodge a complaint with your supervisory authority.
Write to privacy@vantafold.ai to exercise any of these. We respond within 30 days and do not charge a fee for reasonable requests.
10. Cookies
The dashboard uses strictly necessary cookies for authentication and session security. The marketing site uses a privacy-preserving analytics tool that sets no cookies and does not fingerprint visitors.
We do not use advertising cookies or third-party trackers.
11. Children
The service is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, write to us and we will delete it.
12. Changes
We will post material changes to this policy here and notify account holders by email at least 30 days before they take effect. The date at the top of this page reflects the most recent revision.
Questions about this document? Write to legal@vantafold.ai, or see the contact page for our registered entities.