Privacy Policy

This Privacy Policy explains how Vanta Booking collects, uses, shares, stores, and protects information when merchants, merchant staff, customers, visitors, applicants, and support users interact with Vanta Booking.

This policy applies to merchant signup, SMS verification, account recovery, merchant workspaces, hosted storefronts, booking flows, payment workflows, waivers, ID upload features, support requests, employee review tools, account closure workflows, and related platform services.

Merchants may have their own privacy obligations and customer-facing policies. When you book with a merchant through a Vanta-hosted storefront, the merchant may also collect and use your information for its own business purposes.

We may collect account and identity information, including name, email address, phone number, password credentials handled through our authentication provider, SMS verification status, account recovery information, business name, business role, staff role, support contact details, and related account-security information.

We may collect business and merchant onboarding information, including business type, website, country, city, region, postal code, timezone, currency, expected booking volume, business address, owner or staff details, approval status, Stripe onboarding status, setup progress, storefront status, account closure requests, and information submitted to support or employee review workflows.

We may collect storefront and booking information, including product details, images, locations, availability, calendars, customer types, pricing, taxes, fees, deposits, policies, checkout settings, waiver requirements, booking references, booking dates, participant counts, customer notes, emergency contacts, support requests, reviews, and merchant notifications.

We may collect customer checkout information, including customer name, email address, phone number, booking details, participant details, emergency contact information, service or pickup/dropoff address details, custom question answers, waiver information, typed or drawn signatures, ID upload references, payment status, refund status, deposit status, and related booking communications.

We may collect payment-related metadata, including Stripe customer IDs, connected account IDs, PaymentIntent IDs, charge IDs, refund IDs, dispute IDs, payment status, payout status, payment method references, currency, amount, fees, deposit holds, captures, releases, refunds, and charge routing details. We do not intentionally store full card numbers or card security codes; those are handled by Stripe or another payment provider.

We may collect technical information, including IP address, device and browser information, session cookies, authentication cookies, trusted-device status, usage logs, error logs, audit logs, timestamps, pages viewed, actions taken, and approximate location information inferred from technical data.

We collect information directly from users when they create accounts, complete forms, configure workspaces, submit support requests, book services, sign waivers, upload documents, request account recovery, or communicate with Vanta Booking.

We may receive information from merchants, merchant staff, customers, Stripe, Supabase, Twilio, Resend, hosting providers, calendar providers, analytics or infrastructure tools, fraud-prevention tools, and other service providers used to operate the platform.

We may generate information internally, including account status, approval decisions, setup status, risk flags, logs, support notes, employee review activity, notification status, and operational records.

We use information to create and secure accounts, verify phone numbers, authenticate sessions, support password resets, handle account recovery, manage trusted devices, review merchant applications, approve or restrict merchants, and provide employee or support workflows.

We use information to operate merchant workspaces, hosted storefronts, product listings, availability, calendars, booking flows, waivers, ID uploads, checkout requirements, customer records, reviews, support requests, analytics, notifications, account closure, and other platform features.

We use information to support payments and financial workflows, including Stripe onboarding, PaymentIntent creation, connected account routing, platform fee calculations, security deposit holds, captures, releases, refunds, disputes, payout visibility, transaction records, and payment support.

We use information to send service-related communications, including SMS verification codes, email verification, password reset messages, account recovery notices, booking confirmations, lifecycle emails, merchant alerts, support updates, account closure notices, security alerts, and operational notifications.

We use information to troubleshoot, debug, maintain, secure, improve, and develop the platform; investigate fraud, abuse, disputes, errors, and security incidents; enforce our Terms; comply with legal obligations; and protect Vanta Booking, merchants, customers, staff, and service providers.

Vanta Booking uses cookies and similar technologies that are reasonably necessary to operate the platform, keep users signed in, protect accounts, remember trusted devices, support SMS verification and session management, route users to the correct workspace, and maintain security.

Some third-party services used by the platform may set or read cookies or similar technologies for authentication, payments, fraud prevention, infrastructure, or security purposes.

Vanta Booking uses Google Analytics to understand site traffic, pages viewed, device and browser information, approximate location, and related usage patterns so we can improve the platform. Google Analytics may use cookies or similar technologies and may process analytics information according to Google's own terms and privacy practices.

Vanta Booking does not currently sell personal information for money or intentionally share personal information for cross-context behavioral advertising. If Vanta Booking introduces advertising or additional tracking technologies in the future, this Privacy Policy and any related consent practices may be updated to reflect those changes.

We share information with service providers that help operate the platform, including Supabase for authentication and database services, Stripe for payment and connected-account services, Twilio for SMS delivery, Resend or comparable providers for email delivery, hosting and infrastructure providers, storage providers, logging tools, and support tools.

We share information between merchants and customers as needed to support bookings. For example, merchants may receive customer names, contact details, booking details, participant details, emergency contacts, waiver status, ID upload status, service locations, notes, payment status, refund status, and deposit status. Customers may see merchant names, support contacts, storefront details, policies, and booking-related communications.

We may share information with authorized Vanta Booking personnel, contractors, and operators for support, approval, account recovery, security, payment review, incident response, operations, product improvement, and administration.

We may disclose information when reasonably necessary to comply with law, respond to legal process, enforce our Terms, protect rights or safety, investigate fraud or abuse, prevent security incidents, resolve disputes, support payment processing, or complete a business transaction such as a merger, acquisition, financing, reorganization, or sale of assets.

Payment processing, connected account onboarding, card collection, card authorization, payment confirmation, payouts, refunds, disputes, security deposit holds, and related payment services are provided by Stripe or another designated payment provider.

When Stripe is used, Stripe may collect and process payment, identity, business, fraud-prevention, tax, compliance, and payout information according to its own terms and privacy practices. Vanta Booking receives and stores payment metadata needed to operate bookings, deposits, refunds, disputes, reporting, and support.

Vanta Booking does not intentionally store full card numbers or card verification codes. Payment method details are tokenized or referenced through the payment provider.

If you provide a phone number, Vanta Booking may use it to send SMS verification codes, account-security messages, account recovery notices, and related operational communications. Message and data rates may apply.

If you provide an email address, Vanta Booking may send account notices, verification messages, password reset emails, booking notifications, support updates, merchant alerts, account closure notices, lifecycle emails, and other service-related communications.

Because these communications are necessary to operate the platform, users may not be able to opt out of all service-related messages while continuing to use certain features.

Some merchants may configure checkout flows that collect waiver signatures, participant details, dates of birth, age confirmations, guardian details, emergency contacts, ID upload references, service addresses, or custom answers. The merchant is responsible for deciding what information is required for its services and for using that information lawfully.

Vanta Booking processes this information to support the merchant's booking, safety, compliance, waiver, ID review, and customer-service workflows. Vanta Booking may also use this information for security, fraud prevention, support, legal compliance, and dispute handling.

Users should avoid submitting unnecessary sensitive information through free-text fields, support requests, or custom questions unless it is required for the booking or support issue.

Vanta Booking is not intended for children to create merchant accounts. Hosted storefronts may support bookings involving minors where a merchant's service requires participant or guardian information.

If a booking involves a minor, the merchant is responsible for obtaining any required guardian consent, waiver, eligibility confirmation, or legal authorization. Vanta Booking processes minor-related booking information only as needed to support the merchant's configured checkout and operational workflows.

Vanta Booking may support merchants and customers in multiple countries. Information may be processed and stored in the United States or other countries where Vanta Booking or its service providers operate.

Privacy laws may differ between countries. By using the platform, you understand that information may be transferred to and processed in countries outside your country of residence, subject to applicable law and service-provider safeguards.

For some customer data, merchants may act as independent businesses that decide what information to collect and how to use it for their services. For other platform operations, Vanta Booking may determine how information is processed to provide, secure, and improve the platform.

Merchants are responsible for providing any privacy notices, consent language, records, data processing terms, or customer-rights processes required for their own business, jurisdiction, services, and use of customer information.

Where applicable privacy law requires a written data processing agreement or similar terms, merchants should contact Vanta Booking before using the platform in a way that requires those terms.

We retain information for as long as reasonably necessary to provide the platform, maintain account and booking records, support merchants and customers, process payments and refunds, handle disputes and chargebacks, meet tax, accounting, compliance, legal, and audit obligations, prevent fraud, maintain security, and resolve issues.

Account closure or deletion requests may not immediately delete all information. Vanta Booking may retain booking records, payment metadata, customer records, waiver records, ID upload references, support records, logs, and related information where needed for active bookings, disputes, refunds, deposits, legal compliance, fraud prevention, backup integrity, or legitimate business purposes.

When information is no longer needed, Vanta Booking may delete, anonymize, aggregate, or archive it according to platform practices and applicable law.

Vanta Booking uses administrative, technical, and organizational safeguards intended to protect information, including authentication, account verification, access controls, internal review practices, provider security features, and logging.

No storage, transmission, authentication, or payment system can be guaranteed to be completely secure. Users are responsible for keeping passwords, verification codes, devices, email accounts, and phone numbers secure.

You may update certain account, business, and storefront information through the platform where available. You may also contact Vanta Booking for help with account access, account recovery, support requests, correction requests, or account closure.

Depending on where you live or operate, you may have rights to access, correct, delete, restrict, object to, or receive a copy of certain personal information. You may also have rights related to certain disclosures or uses of sensitive information.

To make a privacy request, contact hello@vantabooking.com. We may need to verify your identity, account authority, merchant role, or relationship to the relevant booking before processing a request. Some requests may be limited by legal, security, payment, fraud-prevention, dispute, tax, backup, or operational obligations.

Vanta Booking does not currently sell personal information for money or intentionally share personal information for cross-context behavioral advertising. If that changes, Vanta Booking will update this policy and provide any required choices.

California, EU, UK, and other regional privacy laws may require additional notices, disclosures, or rights depending on the user, business, data, and processing activity. Vanta Booking will review reasonable verified requests in light of applicable law and the platform's technical and legal obligations.

If you are a merchant operating in a jurisdiction with specific privacy notice, consent, cookie, data processing, or customer-rights requirements, you are responsible for ensuring your own customer-facing practices satisfy those requirements.

Vanta Booking may update this Privacy Policy from time to time. If changes are material, Vanta Booking may update the date above and provide additional notice where appropriate.

Questions, privacy requests, or data-related support requests can be sent to hello@vantabooking.com.