Privacy Policy

Your customers, jobs, invoices and books are yours. We hold them so we can run the product for you. We do not sell them, we do not share them with other customers, and we do not use them to advertise to anyone.

• Account details. Your name, email address, the name of your business, and who you invite into the workspace.
• The records you put in. Customers, properties, jobs, visits, estimates, invoices, payments, expenses, bank transactions and the accounting entries behind them.
• What you type into our enquiry form, including a part-filled one. The form on our site asks about your business over eight screens and asks how to reach you on the last one. We save your answers as you move through it, so that if you stop part way we still have what you told us and can follow it up. That means we may hold a part-filled enquiry you never sent. We keep it to reply to you about Vantage Books and nothing else: it is not marketing consent, we do not add you to a mailing list on the strength of it, and we do not sell it or pass it to anyone outside the people listed below. We store a one-way hash of your network address to stop the form being abused, never the address itself. Ask us and we will delete it.
• Product usage events. A small stream of markers such as finished setup, created an estimate, sent an invoice. Each one records which workspace, which person, and when. No names, no amounts and no free text ever go into them.
• Which screens you open. While you are signed in to a workspace, on the website or the phone app, we record each screen you open and when: Invoices, say, or one job's page, with that job's number or id. Anything after the ? in the address is dropped first. We keep that trail for 90 days and then delete it. We also keep one line per person with the last screen they had open and when, which is how we see who is online; it is overwritten as you move around and deleted with your account. Only our own staff can see either one, not the other people in your workspace.
• Error reports and session replays. When something breaks we get a report with the technical detail we need to fix it, and a replay of what the screen was doing in the moments before. We keep a replay only when something breaks: your browser holds the last short stretch of it and sends it to us only together with an error report. Every piece of text in a replay is masked before it leaves your browser, and images and files are blocked entirely, so we see the shape of the page and where you clicked, not your customers or your numbers.
• On the phone app. Photos you take for a job, when you take them. Where the phone is, only while the app is open and only when a screen asks: the drive to a job, the safety stamp on a signed form, and your dot on the crew map if you switch sharing on. A token that lets us send notifications to that phone. Face ID and fingerprint unlocking happen on the phone itself; we never receive anything about your face or your fingerprint.
• Ordinary server logs. Requests, timings and errors, kept for a short while so we can keep the service up.

Account details identify who is signing in. Your records are the product. Usage events tell us whether people are getting through setup, and where they get stuck, which is how we decide what to build next. The screen trail tells our support staff where you were when you ask for help, and which parts of the product people actually use. Error reports and replays are how a bug you hit on a Tuesday gets fixed by Thursday instead of waiting for somebody to reproduce it.

The contents of your estimates, invoices, receipts, bills and ledger entries belong to your business. We store and process them on your behalf, and that is the only reason we hold them. We do not read them for our own purposes and we do not use them to train an AI model. Nobody outside your workspace sees them except where something you do sends them out: emailing an invoice to your customer, and the AI features listed below.

Those AI features are the part worth spelling out, because each one sends some of your data to an outside model provider. Every one of them runs only when somebody in your workspace asks for it:

• Scanning a receipt. When you photograph a receipt to fill in an expense, the photo itself is sent to the model provider so it can read the vendor, the amount, the tax and the date off it. That is a picture of a real receipt, which may show more than those four things, so it is worth knowing before you scan one.
• Asking the AI consultant for a report. A summary of your workspace's figures is sent to the provider that writes the report.
• Asking for a growth plan. Same again: the projection and the assumptions behind it go to the provider that writes the plan up.
• Using the in-app assistant. What you type, and whatever records the assistant looks up to answer you, are sent to the provider. So is a short running summary of the conversation, so it can follow what you are talking about.
• Sending the assistant a photo. A photo you attach to a message goes to the provider with it. So that the assistant can still act on it a message or two later, a recent photo is sent again with the next few messages in the same conversation.
• Talking to the assistant out loud. If you speak to it, the recording of your voice goes to OpenAI to be turned into text. If you have it read answers back, the text of the answer goes to OpenAI to be turned into speech.
• Talking with the assistant live. When you press Talk, your voice goes straight to OpenAI's real-time voice model, which hears it and answers out loud. What both of you say is written into the chat like typed messages. The records it looks up are read on our servers with your own permissions, and a job it hands back to the assistant goes to that assistant's provider as above. OpenAI does not train on any of it, and keeps it for up to 30 days only to check for abuse.
• Drafting an estimate from a site visit. The photos taken on the visit, and the notes typed or dictated about it, go to the provider so it can say what equipment it sees. A second request sends what it saw, with your price list, your labour rate and a few of your recent similar estimates, and gets back the lines for the draft. The prices on the draft come from your price list, not from the model.
• Reading an invoice to make a template. When you upload an invoice you already send, as a PDF or a picture, the file itself goes to the provider so it can copy the layout. It carries whatever is printed on it, customer details included.
• Finding your logo. A picture of the first page of the document you uploaded, or the photo you took, goes to the provider so it can find your logo and cut it out.

Each of these sends only what that particular job needs, and only at the moment it is asked for. None of it is used to train anything of ours. Through OpenRouter, we instruct the model providers not to keep your data and not to train on it. OpenAI, which handles the voice, says in its own policy that data sent to its API is not used to train its models unless the customer chooses to share it. These features are switched on for a whole installation rather than workspace by workspace, so if you would rather they were not available in yours, that is a conversation to have with us rather than a setting you can change yourself today.

If you connect a bank account, the connection is made through Plaid. You sign in to your bank on Plaid's screen, not ours: we never see your online banking username or password. Plaid gives us a token for the connection and, through it, the account's transactions and balances, which we use for one purpose: to show your bank activity beside your books, match deposits to invoices and purchases to expenses, and reconcile. The token is kept encrypted in a vault and never appears in a plain database column or a log.

You can disconnect a bank at any time from Money → Banking. That removes the connection at Plaid the same moment and destroys the token; a connection that keeps failing is removed automatically after a grace period, 30 days by default. The transactions already brought in stay with your books, because they are part of your records, and go when the workspace does. By connecting a bank you also agree to Plaid's own End User Privacy Policy, which describes what Plaid itself collects and keeps.

Not to advertisers, not to data brokers, not to anyone. We have no business model that involves selling what is in your workspace, and we are not planning one.

Running the product means using a few suppliers, each of whom sees only the part they need, and each bound to use it only to provide their service to us:

• Supabase: the database, file storage and sign-in, hosted in Canada.
• Vercel: runs the application itself, in the United States.
• Plaid: bank connections, as described above.
• Stripe: card payments your customers make to you.
• Resend: sends the email the product sends on your behalf.
• Mapbox: draws the maps, finds addresses and plans the drive to a job, so it receives the addresses on a map and, for a drive, where the phone is.
• Google Firebase Cloud Messaging: delivers notifications to phones (through Apple’s push service on an iPhone), so it receives the phone’s notification token and the notification itself.
• Sentry: collects error reports and the masked replays that come with them.
• PostHog: product analytics, as described below.
• OpenRouter: the gateway every AI feature above goes through, except the voice. The models behind it are Anthropic’s Claude, which runs the assistant, the reports, the plans and site visits, and Google’s Gemini, which reading a receipt, an invoice or a logo uses by default. Qwen and OpenAI models stand in for the assistant only when its first choice is unavailable.
• OpenAI: turns what you say to the assistant into text, and its answers into speech, and carries a live talk with the assistant, as described above. We send those to OpenAI directly, not through OpenRouter.
• Slack: where our own team gets its notices. A website enquiry reaches us there with the name, business, role, email, phone number and answers you gave us. A problem report sent from inside the product arrives with the reporter’s name, the workspace, what they wrote and their screenshot, which shows whatever was on the screen. A request to delete an account whose workspace we must close by hand arrives with the requester’s name, email address and workspace; a first sign-in with the person’s name and business; a card payment we could not book with its amount and reference numbers.
• Inngest: runs background jobs, such as writing a report away from the page that asked for it. It receives record and workspace ids, counts and amounts, and the one-line headline of a report it has just written; never a name, an email address or what is in a document.

PostHog is how we see whether people are getting through setup and where they get stuck. It receives event names, the screen path you were on, your account id, your workspace id, and a handful of technical markers the tool needs to count a visit at all: a session id, and which version of its own software sent the event. Anything after the ? in a web address is cut off before the event leaves your browser, so a link you followed from an email never carries its token to PostHog. It never receives your name, your email, a dollar amount, or anything from inside a document — an estimate, an invoice, a customer record.

We also strip the things analytics tools normally take and we have no use for: the page you arrived from, your browser and operating system, your screen size, your time zone, and your IP address. Location lookup from IP addresses is switched off in our PostHog project, so PostHog neither stores your address nor derives a town from it. It runs without cookies, on our own servers’ say of who a visitor is rather than anything stored in your browser, and we have switched off its session recording feature entirely: nobody watches a replay of your screen through PostHog.

Your records stay while your workspace is open, because accounting records have to be kept. After a workspace closes, the financial records that bookkeeping law requires us to keep (invoices, payments, the ledger and the documents behind them) are retained for seven years from the end of the financial year they belong to, then deleted; everything else is deleted within 30 days of your request. Bank connection tokens are destroyed the moment a bank is disconnected. A part-filled enquiry you never sent is kept for 12 months from the last time you touched the form and is then deleted automatically; an enquiry you did send is kept while we are still talking, and deleted on request. Usage events are kept for 24 months, the trail of screens you opened for 90 days, error reports for 90 days and session replays for 30, server logs for no more than 30 days, and daily backups for 7 days. The full schedule is in our data retention and disposal policy, which we will send you on request.

You can export your workspace from the settings inside the product at any time. Owners can also log a deletion request there, and we handle those by hand rather than with a one-click button, because deleting financial records is not something anybody should be able to do by mistake.

Anyone can delete their own account, in the phone app or on the website: from Settings, Your account (on the crew screens, Workspace, Settings). Your sign-in and personal details go at once; the records you made for a business stay with it, under your name, because they are its records, and so does its audit trail, with the email address and profile details it wrote down at the time. If you are the only owner of a workspace, we close it for you as described above. Deleting your account has the detail, and works without the app.

Every workspace is separated from every other at the database level, so one customer's query cannot reach another customer's rows. Data is encrypted in transit. Changes to anything financial are written to an audit trail that records who did it and when. Our own staff can see a workspace's plan and activity counts so they can answer a support question, and when a member of our staff opens your workspace's own records, we log who did it, when, and which screen they opened. Where a member of our staff changes something in your workspace, that change lands in your audit trail like any other.

Your records, files and backups are stored in Canada (Supabase on AWS, Montréal region), encrypted at rest. The application that reads and writes them runs in the United States (Vercel), so your data passes through the United States while a page is being served, and the suppliers named above process the part they handle in the United States, except that an AI model reached through OpenRouter runs wherever its provider’s servers are. Nothing is stored in the European Union.

UK businesses can run Vantage Books, and their records include their own customers. For them, and for those customers, the UK General Data Protection Regulation and the Data Protection Act 2018 apply, and this is how they apply here.

• Who decides what happens to the data. A business that uses Vantage Books is the controller of its customers' details and the records about them; we process them on its behalf and on its instructions. A customer who wants to see, correct or remove what a business holds should ask that business first, and we help it answer. We are the controller of the business's own account with us: who signs in, the plan, and how the product is used.
• Why we may use it. To provide the account the business signed up for, which is a contract. To keep the service secure, stop abuse and send the emails the service needs, such as a sign-in code or a failed payment, which are our legitimate interests. And to keep the financial records the law requires us to keep.
• Where it goes. Nothing is stored in the UK. Records, files and backups are kept in Canada, and the UK's adequacy regulations for Canada cover organisations subject to PIPEDA, Canada's private-sector privacy law, as we are, so that transfer needs no further agreement. The application runs in the United States, and the suppliers named above handle their part there; they receive it under the UK Extension to the EU-US Data Privacy Framework, or under the UK's International Data Transfer Agreement or its Addendum to the EU standard contractual clauses, where they rely on those.
• Bank feeds and Direct Debit. UK bank feeds are not switched on yet. When they are, a UK bank connects through Open Banking via Plaid (Plaid Financial Ltd is authorised by the Financial Conduct Authority): you give your consent at your own bank, it lasts about 90 days, and Vantage Books asks you to re-connect before it runs out. We receive the same transactions and balances as anywhere else, and nothing more. When a customer pays a business by Direct Debit, the customer's bank details go to Stripe, not to us.
• Your rights. To be told what we do with your data, to see it, to have it corrected or erased, to have its use restricted, to take it with you in a usable form, to object to how we use it, and not to be subject to a decision made by a machine alone that seriously affects you. We make no such decisions. Write to the address below to use any of them.
• Complaints. You can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk. We would rather hear from you first, but you do not have to. Write to the Privacy Officer at the address below, and we acknowledge every complaint within 30 days and then tell you what we did.

We are not established in the UK, so UK GDPR asks us to name a representative there. We will name ours on this page before Vantage Books opens to UK businesses.

Our Privacy Officer is responsible for how Vantage Business Systems Ltd handles personal information, and answers questions and complaints about it. Email dev@vantagebusinesses.com to reach the Privacy Officer, to ask what we hold about you, to correct it, or to have it deleted. A person reads it. The Terms of Service cover the rest of the arrangement.