Privacy Policy

Effective date: [EFFECTIVE DATE] · Last updated: [DATE]

This Privacy Policy explains how Vantra ("the Service", "we", "us") collects, uses, and protects personal data in connection with our AI-powered business assistant service for small and medium-sized businesses. This policy is written in accordance with the EU General Data Protection Regulation (GDPR) and applicable Hungarian data protection law (Act CXII of 2011).

1. Data Controller

Legal name	Péter Zsóka e.v. (sole proprietorship, Hungary)
Registered address	8444 Szentgál, Hunyadi utca 13., Hungary
Tax number	92077407-1-39
Business registration number	92077407
Contact email	info@vantra.hu
Website	vantra.hu

2. What Vantra Does

Vantra is an AI-powered customer service and business operations assistant for small and medium-sized businesses. On behalf of a business ("Partner") that subscribes to the Service, Vantra processes incoming messages (email, Facebook Messenger), uses artificial intelligence (via the Anthropic Claude API) to draft or send responses, manages calendar bookings, and — depending on the Partner's configuration — either sends responses automatically or queues them for the Partner's manual approval before sending.

Important — roles under GDPR: With respect to the Partner's own account data, Vantra acts as a data controller. With respect to the personal data of the Partner's end customers (the people emailing or messaging the Partner's business), Vantra acts as a data processor, processing that data solely on the Partner's instructions and for the purpose of providing the Service.

3. What Data We Process

3.1 Partner (business customer) account data

Registration data: business name, email address, password (stored as a bcrypt hash, never in plain text)
Business contact details: phone number, business address, opening hours
Integration access credentials: Google OAuth tokens (Gmail, Google Calendar), Facebook Page access tokens, WooCommerce API keys — all stored encrypted using Fernet symmetric encryption
Usage data: login history, configuration settings (automatic vs. approval-required mode)

3.2 End-customer data (processed on behalf of the Partner)

Content of incoming messages (email body, Facebook Messenger message text)
Sender identifying information (email address, Facebook profile identifier)
Data derived from the message content: booking requests (date, time, party size), special requests where applicable (e.g. dietary restrictions, if the Partner has enabled this optional feature)
Generated draft responses and their approval history

4. Google API Services — Scope Usage and Limited Use Disclosure

Vantra integrates with the following Google APIs, accessed only after the Partner explicitly connects their own Google account via OAuth:

Scope	Purpose
`gmail.readonly`	Read incoming emails to the Partner's business inbox for the purpose of drafting or sending automated customer service responses
`gmail.send`	Send the AI-generated response (after Partner approval, or automatically if the Partner has enabled auto-mode) to the Partner's customer
`gmail.modify`	Mark processed emails as read to prevent duplicate processing
`calendar`	Check availability and create booking events in the Partner's calendar based on customer reservation requests

Vantra's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: Google user data accessed through these scopes is used solely to provide and improve the customer-facing features of the Service described above. This data is not sold, not used for advertising purposes, and not used to train general-purpose AI/ML models. Human access to this data is limited to what is necessary for security, legal compliance, or with the Partner's explicit consent (e.g. customer support requests).

5. Facebook / Meta Platform Data

Vantra integrates with the Facebook Messenger Platform, accessed only after the Partner connects their own Facebook Page and grants a Page Access Token. This is used exclusively to receive and respond to messages sent to the Partner's Facebook Page, on the Partner's behalf and under the Partner's configuration (auto-send or approval-required).

6. Sub-processor: Anthropic (Claude API)

To generate response drafts, Vantra sends the relevant message content to the Claude API, operated by Anthropic PBC (United States). This is necessary to provide the core AI functionality of the Service. Anthropic processes this data solely to return a generated response and does not use business customer data submitted via the API to train its models, per Anthropic's API terms of service.

This transfer outside the EU is based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses, as applicable.

7. Data Retention

Partner account data: retained for the duration of the account's active status, or until deletion is requested
Processed messages and generated responses (email and Facebook Messenger alike): retained for 180 days, after which they are automatically deleted
Integration access tokens: retained until the Partner's account is deactivated or access is revoked

8. Data Security

Sensitive credentials (API keys, OAuth tokens) are stored encrypted using Fernet symmetric encryption
Passwords are stored using one-way bcrypt hashing and cannot be recovered by us
Data belonging to different Partners is logically isolated in a multi-tenant architecture — one Partner cannot access another Partner's data
Authentication uses time-limited JWT tokens, with rate limiting on login attempts

9. Data Subject Rights

Under GDPR, data subjects have the right to: access their data, request correction, request deletion, request restriction of processing, request data portability, and object to processing. To exercise any of these rights, please contact us at info@vantra.hu.

You also have the right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
1055 Budapest, Falk Miksa utca 9-11., Hungary · ugyfelszolgalat@naih.hu · www.naih.hu

10. Revoking Access

Partners may revoke Vantra's access to their Google account at any time via Google Account security settings, and to their Facebook Page via Facebook Page settings, or by disconnecting the integration directly in the Vantra admin dashboard.

11. Contact

For any privacy-related questions or requests: info@vantra.hu