Privacy Policy

1. Controller

The controller responsible for processing personal data in connection with Vanthis is:

You can use the email address above for privacy questions, access requests and deletion requests.

2. Data we process

Website and security data

When you access Vanthis, our hosting and security provider processes technical request information such as your IP address, request time, requested URL, browser information and security signals. We use this data to deliver the website, prevent abuse and maintain service security.

Access requests

While access is limited to invited people and you request it, we process your name, work email address and any optional description you submit. We use the request IP address only to apply a short rate limit. The request route does not store that IP address with your request.

Account and Google sign-in data

If you choose Google sign-in, Google and our identity provider Clerk provide the information needed to authenticate you. This can include your Google account identifier, name, email address, profile image and authentication or session information. Vanthis requests only the openid, email and profile scopes for Google sign-in.

Google sign-in does not give Vanthis access to Gmail, Google Drive, Google Calendar or other Google Workspace content.

Workspace and service data

When you use Vanthis, we process the information you and authorized collaborators add to the service. This can include Workspaces, Motions, steps, Resources, source links, comments, invitations, saved versions, agent proposals, work records and run evidence. We also process account identifiers, Workspace membership and permissions so that we can control access.

Trial, subscription and payment

For each workspace we store its access state: a running trial and when it ends, free access and until when, or a subscription and its status, together with the identifiers Stripe gives us for the customer and the subscription. We use them to open or close the workspace and to show its state to owners and admins.

When a workspace subscribes, you order and pay at Stripe, which sells the subscription as merchant of record. Stripe collects and processes your payment details, billing address, tax details and invoices as its own controller under the Stripe Privacy Policy. Vanthis does not receive your card or bank details. Stripe tells us whether a payment succeeded and how many editors the subscription covers.

Email

We send service emails, such as invitations to a workspace and replies to access requests, through Resend. These emails contain the recipient's address, the sender and the message.

AI agents connected through MCP

You can connect an AI agent such as Claude, ChatGPT or Codex to Vanthis through the Model Context Protocol (MCP). You sign in with your Vanthis account and approve the requested permissions once. Clerk then issues an access token that identifies your account and the agent's client to Vanthis.

Vanthis receives only what your agent sends in a request to Vanthis: for example which Workspace or Motion it asks for, a draft or proposed change, or a record of work on a step. Vanthis does not receive your conversation with the agent, your files in other services or the data of your other connectors. Content your agent submits is stored like content you add in the web app. For the Start page we also store, per account and agent client, the client's name as the agent reports it and when it first and last reached Vanthis.

Vanthis returns the Workspace content your agent requests. The provider of your agent, for example Anthropic or OpenAI, then processes that content under its own terms and privacy policy. Removing the Vanthis connector in your agent stops its access.

Local browser data

Vanthis can store drafts, interface preferences and connection preferences in your browser. This data stays on that device unless you submit or save it to the service. You can remove it through your browser settings.

3. How we use data

We process personal data to:

• provide, secure and operate the Vanthis website and service;
• create accounts, authenticate users and manage access to workspaces;
• run trials and subscriptions and open or close workspaces accordingly;
• store and present the Workspaces and Motions that authorized users create;
• respond to access requests, support requests and privacy requests;
• prevent fraud, abuse and unauthorized access;
• meet legal obligations and establish, exercise or defend legal claims.

Where the GDPR applies, these purposes rely on steps requested before entering an agreement and performance of an agreement under Article 6(1)(b), our legitimate interests in providing and protecting the service under Article 6(1)(f), and legal obligations under Article 6(1)(c). We rely on consent under Article 6(1)(a) only where we specifically ask for it.

4. Service providers and sharing

We share personal data only where needed to provide or protect Vanthis, comply with law, or respond to your request.

• Cloudflare provides hosting, network delivery, security, rate limiting and data storage infrastructure.
• Clerk provides account, authentication and session services.
• Google provides Google sign-in when you choose that method.
• Stripe sells subscriptions as merchant of record and processes payments, taxes and invoices, as described in section 2.
• Resend delivers service emails.
• The provider of your AI agent receives the Vanthis content your agent requests through MCP, as described in section 2.
• Configured AI providers process the content included in an AI-assisted request only when an authorized user invokes that feature. Vanthis keeps agent proposals separate from authored Workspace content until a user explicitly approves a change.

We may also disclose information when required by law, to protect rights and security, or in connection with a business transfer subject to appropriate protections. We do not sell personal data or Google user data. We do not use it for targeted advertising, credit decisions, lending, data-broker services or training generalized or non-personalized artificial intelligence models.

5. International processing

Some service providers may process data outside Germany or the European Economic Area. Where required, those transfers must rely on an applicable legal transfer mechanism and supplementary safeguards. You can contact us for information about the safeguards relevant to your data.

6. Retention and deletion

We retain personal data for as long as it is needed to provide the service, maintain account and Workspace continuity, meet security and legal requirements, or resolve disputes. The appropriate period depends on the type of data and why it is processed.

When a workspace is closed because its trial, free access or subscription ended, we keep its content for 90 days, so a subscription can open it again unchanged. After 90 days we delete the workspace's content. Records we must keep for tax or commercial law, such as subscription and payment records, are kept for the periods the law requires; Stripe keeps its own records under its policy.

You can request account or personal-data deletion at tony@vanthis.com. We will delete or anonymize data when it is no longer required, unless we must retain it for a legal obligation or legal claim. Data held in security logs or backups may remain for a limited period until those systems cycle. Records of your agent connections are deleted with your account.

7. Security

We use technical and organizational measures designed to protect personal data. These include encrypted HTTPS transport, access controls, Workspace permissions, security headers, managed identity services, guarded changes and infrastructure security controls. No internet service can guarantee absolute security.

8. Your rights

Depending on applicable law, you may have rights to access, correct, delete or restrict your personal data, object to processing, receive portable data, and withdraw consent for future processing. You may also complain to a competent data protection supervisory authority. In Bavaria, information about supervisory authorities is available through the Bavarian data protection authorities.

Contact tony@vanthis.com to exercise a right. We may need to verify your identity before acting on the request.

9. Changes to this policy

We may update this policy when the service or legal requirements change. We will publish the current version here and update the effective date. If a change materially affects registered users, we will provide an appropriate notice.