Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

No data protection officer has been appointed — the statutory thresholds under Art. 37 GDPR are not met.

2. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

The competent supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany — datenschutz.hessen.de.

3. Hosting (Website)

The website is hosted by Vercel Inc. (USA, with edge locations in the EU). When the website is accessed, Vercel processes technically required data (IP address, user agent, timestamp) to deliver the page. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional, secure web offering). A data processing agreement (DPA) with Vercel is in place.

4. Cookies and Local Storage

By default we use only technically necessary browser storage to remember features such as theme selection (light/dark) and accent colour. Optional reach measurement (PostHog, section 7) and ad measurement (Meta Pixel and Conversions API, section 8) load only if you choose “Accept all” in the cookie banner. You can change your choice at any time via “Cookie settings” in the footer, with effect for the future.

5. Newsletter / Waitlist Sign-up

If you sign up for the Vantom waitlist on this website, we process your email address to send a one-time confirmation email (double opt-in) and — after confirmation — occasional updates around the product launch.

Which data

• Your email address (entered by you)
• Timestamp of sign-up and of confirmation
• A technical hash of your IP address (SHA-256, truncated to 16 hex characters) — used solely to protect against bulk sign-ups / spam bots. The raw IP is never stored.

Legal basis

Art. 6(1)(a) GDPR (consent). You actively enter your email address and confirm the sign-up by clicking the confirmation link in the confirmation email. No further email is sent before confirmation.

Processors

• Vercel Inc. (USA, with function execution in the EU / Frankfurt fra1) — processes the sign-up request. DPA in place.
• Upstash, Inc. (USA, with data residency in the EU / Ireland) — stores only the hashed IP value + counter for the rate-limit logic. No email addresses. DPA in place.
• Resend, Inc. (USA, with sending region EU / Ireland) — sends the confirmation and welcome email and stores your contact data as a recipient. DPA in place.

Retention

Your email address remains stored at Resend until you unsubscribe (unsubscribe link in every email) or request deletion. The IP hash at Upstash expires automatically after a maximum of 1 hour (rate-limit window).

Withdrawal

You can withdraw your consent at any time — by clicking the unsubscribe link in any of our emails or informally by email to info@vantom.pro. Unsubscribing does not affect the lawfulness of processing carried out before the withdrawal.

6. Processing within the Vantom App

The Vantom Producer Suite (desktop application) processes personal data only when you actively sign in or use cloud features. In detail:

Authentication (Firebase Auth)

On optional login: email address and user ID. Provider: Google LLC (USA), DPA in place. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Project metadata (Firestore, EU region)

Tags, notes and subscription status are stored in Firestore (region europe-west). Audio content does not leave your device. Provider: Google LLC, DPA in place.

Payment processing (Lemon Squeezy)

Lemon Squeezy LLC (USA) acts as Merchant of Record and is the contractual partner for the purchase. Name, email address and payment data are processed. The Lemon Squeezy Privacy Policy applies in addition. Legal basis: Art. 6(1)(b) GDPR.

Cloud sync (Google Drive · Dropbox · SoundCloud)

These connections are initiated exclusively and actively by you (OAuth). The tokens are stored encrypted locally on your device and are not transmitted to our servers. Legal basis: Art. 6(1)(a) GDPR (consent), revocable in the app settings.

No device identifier / no device fingerprint

The Vantom Producer Suite does not generate or process any device- or hardware-based identifier (e.g. hardware fingerprint or device hash). Your subscription and trial status is managed exclusively via your user account and the subscription held at Lemon Squeezy, not via a characteristic bound to your device.

7. Reach Measurement (PostHog)

If you choose “Accept all” in the cookie banner, we use PostHog for anonymised reach and funnel measurement (PostHog, EU hosting, eu.i.posthog.com). We process page views, triggered interaction events, truncated device/browser data and UTM parameters; storage is in your browser's LocalStorage, not via cross-site cookies. Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG for storage on your device. Without your consent PostHog is not loaded. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer.

8. Meta Pixel and Conversions API (Facebook / Instagram)

If you choose “Accept all” in the cookie banner, we use the “Meta Pixel” and the server-side “Conversions API” of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”). We use these to measure the success of our ads on Facebook and Instagram and to optimise their delivery.

Data processed

IP address, browser/device information, the page visited and triggered events (e.g. page view, click on a call to action, waitlist sign-up) and an identifier stored on your device (_fbp). Transmission happens both from your browser (Pixel) and from our server (Conversions API); duplicate events are merged via an event ID. Server-side transmission also occurs only after your consent. We never transmit email addresses or phone numbers to Meta (no “Advanced Matching”).

Joint controllership (Art. 26 GDPR)

We and Meta are joint controllers for the collection and transmission of data via the Meta Pixel. The essential content of this arrangement is set out in Meta's Controller Addendum. Meta's further processing for its own purposes is Meta's sole responsibility; Meta's Privacy Policy applies in addition.

Legal basis

Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG.

Third-country transfer

Data is also transmitted to Meta Platforms, Inc. in the USA. Meta is certified under the EU-U.S. Data Privacy Framework (EU Commission adequacy decision of 10 July 2023); Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR apply in addition.

Retention

The device identifier _fbp is stored for up to 90 days. The retention of event data processed at Meta is governed by Meta's Privacy Policy.

Withdrawal

You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer; the Pixel and Conversions API will then no longer load or fire.

9. Third-Country Transfers

Where data is transferred to the USA (Firebase, Lemon Squeezy, Vercel, Upstash, Resend, Meta), this is done on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR or under the EU-U.S. Data Privacy Framework, where the respective provider is certified. The actual processing of your newsletter data takes place exclusively in the EU (Vercel fra1 Frankfurt, Upstash eu-west-1 Ireland, Resend eu-west-1 Ireland).

10. Retention Period

We store your personal data only for as long as necessary to fulfil the stated purposes or as required by statutory retention obligations (e.g. 6 years under commercial law, 10 years under tax law).

11. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy if technical or legal conditions change. The current version is always available on this page. In the event of material changes, we will inform active users by email.