Privacy policy

1. Who this policy covers

Visitors of vantote.com, people sending the pilot request form and — in the app section — property owners and their staff using the panel and the tag screen.

2. The pilot request form

We collect: property name and type, number of rooms, e-mail address and — if you provide them — a phone number and a message. We use them solely to reply to your request and arrange the pilot.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Providing data is voluntary, but without a property name and e-mail the form cannot be sent.

The request is e-mailed to our contact inbox. We keep it for the duration of our conversation, no longer than 12 months after the last contact, then delete it.

3. Bot and abuse protection

The request form and the login screens are protected by Cloudflare Turnstile. The Turnstile script loads only when you click into the form — merely visiting the page runs no third-party script. Turnstile analyses browser signals to tell humans from bots; it is not used for advertising or profiling.

For form submissions and login attempts we record the IP address and time of the attempt to limit their number (protection against password guessing and spam). These records are cleared automatically after a successful login and on subsequent checks — we build no history from them.

4. Data inside the Vantote app

Operational property data (rooms, cleanings, issue reports, documentation photos, staff names and working times, reservations from connected calendars) is processed ON BEHALF of our clients — the property owners. They are the controllers of that data and we are the processor. We sign a data-processing agreement (DPA) at the client's request.

We collect a minimum of staff data: first name, working times, reports and photos taken during work. Staff PINs are stored only as hashes — nobody, including us, can read them. Panel access is limited by roles and permissions, and every sensitive administrator operation is written to an audit log.

Photos uploaded from a phone are stripped of metadata (including GPS location) before being stored.

5. Who processes data for us (processors)

We do not sell data and do not share it with anyone for marketing. We use infrastructure providers that process data on our behalf:

• Supabase — database and photo storage; European Union region (Ireland).
• Cloudflare — application hosting, content delivery network and bot protection (Turnstile); traffic is served by Cloudflare's global network, while data is stored in the EU database and photo storage.
• Brevo — e-mail delivery (form requests, client notifications).

6. How long we keep data

Pilot requests: for the duration of our conversation, at most 12 months after the last contact. App data: for the duration of the client agreement; afterwards we delete the client account together with its properties, rooms, staff and photos.

Documentation photos (finished cleanings, fixed issues, closed found items) are deleted automatically after about 2 months — working times and records stay, the photographs go.

7. Cookies and browser storage

The site uses no tracking, analytics or advertising cookies. We use only strictly necessary cookies: the logged-in user's session, the remembered language of the staff screen and Cloudflare's technical security cookies. Details are in the Cookie policy.

8. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data — one e-mail to contact@vantote.com is enough. We reply within 30 days.

If your data is in the app as staff data, the controller is your employer (the property owner) — contact them first; we will help them fulfil your request.

You may also lodge a complaint with your data-protection authority (in Poland: the President of the Personal Data Protection Office, uodo.gov.pl).

9. Changes to this policy

When we change the policy, we update the date at the top of the page. Changes material to app clients are announced by e-mail to the account address.

Data controller