Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

Franco Consulting GmbH
Maria-Theresia-Straße 17
89331 Burgau
Germany

Phone: +49 8222 4183998
Email: kontakt@franco-consulting.com
Website: https://vantero.chat

Managing Directors: Kilian Franco and Lukas Kraus
Commercial Register: Amtsgericht Memmingen, HRB 20230
VAT ID: DE358098950

Vantero is an AI-powered chat and productivity platform that provides access to various large language models through a unified interface. The platform is offered as a web application and as a mobile app (iOS/Android). Personal data is processed during use insofar as this is necessary to provide the service, ensure security, and fulfil legal obligations.

Vantero is currently in an early alpha phase and has not yet launched publicly. A paid subscription cannot currently be concluded; the payment and App Store processing described below as a precaution will only become relevant if such an offering is activated later.

In the course of using Vantero, we process the following categories of personal data:

a) Account Data

• Email address (for registration, login, and communication)
• First and last name (optional, for personalisation)
• Profile picture (optional, uploaded or imported from Google account)
• Password hash (when registering with a password; the password itself is not stored)
• Enabled test scope and team membership
• Preferred language setting (German/English)

b) Usage Data

• Chat histories and message content
• Uploaded documents and files (in knowledge management)
• Created assistants, presentations, and documents
• Token consumption and model usage (for service delivery, limits, and technical abuse prevention)
• Selected AI model and data zone per request
• Workspace and project structure

c) Technical Data (Log Data)

• IP address
• Date and time of access
• Browser type and version or app version
• Operating system
• User agent string
• Referrer URL (for website access)

Your personal data is processed on the following legal bases:

a) Performance of contract (Art. 6(1)(b) GDPR)

This applies in particular to account management, authentication including a Google or Apple login selected by you, chat, file and AI processing, workspaces, billing and transactional emails.

b) Legitimate interests (Art. 6(1)(f) GDPR)

Our legitimate interests include IT security, abuse and fraud prevention, error analysis and improving the service using aggregated or anonymised statistics. Where required, we document the balancing assessment.

c) Consent (Art. 6(1)(a) GDPR)

We obtain consent where legally required for optional notifications, non-essential terminal access or another voluntary feature. It may be withdrawn at any time with effect for the future.

d) Legal obligation (Art. 6(1)(c) GDPR)

We process billing, tax and accountability data that must be retained by law to meet the respective obligation.

A third-country transfer is not based solely on selecting a feature or on blanket consent. The requirements of Arts. 44 to 49 GDPR must also be met.

Vantero supports email/password, magic link, email one-time code and optional Google or Apple login. Passwords are stored only as cryptographic hashes; magic links and one-time codes are time-limited.

Google

If you choose Google login, we receive the data you approve, particularly your name, email address and profile image, from Google Ireland Limited. Google may transfer data in its own role to affiliated companies, including in the United States. Privacy information: policies.google.com/privacy.

Apple

If you choose Apple login, Apple Distribution International Limited or Apple Inc. provides the login information you approve; when Hide My Email is used, this may be an Apple relay address. Privacy information: apple.com/legal/privacy.

Better Auth runs on our own infrastructure. Data is sent to an identity provider only when you select that provider's login method. The legal basis is Art. 6(1)(b) GDPR.

a) Persistent platform data

Account data, chat histories, documents, workspace data and assistants are stored on self-operated database, object-storage and cache systems within IONOS Cloud infrastructure in the de/fra virtual data centre in Frankfurt am Main, Germany. No external managed Supabase service is used.

b) AI and feature data zones

When an AI model or tool is used, only the inputs, selected attachments, search terms and technical metadata required for the specific request are sent to the identified provider. Account master data is not included in the model prompt.

The model or feature selection is the technical instruction for the identified zone. It does not replace a required DPA or the conditions for third-country transfers.

Depending on the model, search service, identity provider or customer-linked target system that is actively selected, processing outside the EEA may occur. This particularly concerns Mistral's global endpoint, Perplexity in the United States, possible remote access or sub-processors of cloud providers, Google or Apple login, and customer-linked target systems.

A transfer takes place only where the requirements of Arts. 44 to 49 GDPR are met. We primarily use an applicable adequacy decision under Art. 45 GDPR. Otherwise, appropriate safeguards, normally the EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914, are used together with a documented transfer risk assessment and necessary supplementary measures.

Any DPF certification is verified in the official register before it is used as a legal basis. Provider, location, transfer mechanism and material retention terms are disclosed by feature in the DPA sub-processor list.

Depending on the selected feature, we use the following recipients. Their role depends on the specific service. A provider receives data entrusted under a DPA only after any required Art. 28 GDPR agreement, transfer mechanism, training control and retention evidence have been documented.

The current DPA contains the detailed sub-processor list, including location, transfer, training and retention conditions. Customer-linked target systems are accessed only on instruction and with permissions granted by the customer.

Your inputs (prompts), chat histories, and uploaded documents are used to generate the AI response you requested. Vantero does not use this data to train its own models.

Third-party terms on training, retention and purpose limitation must be reviewed and documented before each production approval, taking account of the model, plan and account configuration. The terms currently applicable to the intended use are authoritative.

Under Art. 50 of Regulation (EU) 2024/1689 (EU AI Act), we inform you of the following:

• When using the chat and assistant features, you interact with an AI system.
• Texts, summaries, analyses, images and other correspondingly identified outputs may be generated wholly or partly by AI.
• AI-generated content may contain errors, inaccuracies or so-called "hallucinations" and should be independently checked before consequential use.
• When web search is enabled, search queries are sent to the identified search or model provider; sources are displayed where the feature provides them.

Vantero integrates third-party models into its own application features. Its specific role as provider, downstream provider or deployer under the EU AI Act depends on the feature, technical design and intended purpose and is not determined generically for every use case. Technical marking and information duties are implemented by feature where they apply to Vantero.

Vantero itself does not make solely automated individual decisions concerning users within the meaning of Art. 22 GDPR that produce legal or similarly significant effects. Customers remain responsible for whether and how they use AI outputs in their own decision processes.

Vantero currently uses only technically necessary cookies and storage-like technologies required for the operation of the website, login, security, language selection, and interface functions explicitly triggered by you. Third-party analytics, advertising, and marketing technologies are not currently active.

You can access current information about these technologies at any time via the "Privacy Settings" link or button. We also provide our consent management for future optional categories there.

No optional analytics, marketing, or advertising trackers are set. No cross-site tracking takes place. Should we deploy optional technologies in the future, they will be described separately in the privacy settings before activation and will only be activated on the basis of required consent.

We send transactional emails such as magic links, one-time codes, verification, password reset, security, account and deletion notices. Email is currently sent through IONOS SE using TLS-protected SMTP. This involves processing the recipient address, subject, message content, delivery metadata and technically necessary log data.

The legal basis is Art. 6(1)(b) GDPR and, for security and accountability purposes, additionally Art. 6(1)(f) or (c) GDPR. Marketing and newsletter distribution are currently not part of this service.

A paid Vantero subscription cannot currently be concluded through either the website or the mobile app. Accordingly, no payment, order or App Store subscription data is presently processed for Vantero plans.

If a paid offering is activated later, Armitage Labs OU (Creem) is intended to act as Merchant of Record for website purchases and Apple as the distribution channel for iOS in-app purchases. These providers would process payment, invoice, tax, fraud-prevention or App Store data in their own respective roles. Vantero is intended to receive only the status, product, customer, order, term and subscription references necessary for contract, plan and team assignment, but no complete card or bank data. This privacy policy will be checked again against the actual flow before any such activation.

We store personal data only for as long as necessary for the relevant processing purpose or as required by statutory retention obligations:

Account deletion ends access. Associated production data is then deleted or anonymised through the documented deletion process; data subject to statutory retention is restricted until the period expires. Backup copies are not restored to production and are overwritten or deleted through the applicable backup cycle.

We implement appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data:

• Encrypted data transmission (TLS/HTTPS) for all connections
• Cryptographic password hashing (plaintext passwords are not stored)
• Rate limiting to protect against brute-force attacks and abuse
• Secure cookies (HttpOnly, Secure flag, SameSite)
• Regular security reviews and monitoring
• Access control and data processing minimisation (data minimisation principle)

You have the following rights with regard to your personal data:

• Right of Access (Art. 15 GDPR): You have the right to obtain information about the personal data we process. This includes information on processing purposes, data categories, recipients, and retention periods.
• Right to Rectification (Art. 16 GDPR): You may request the rectification of inaccurate data and the completion of incomplete data.
• Right to Erasure (Art. 17 GDPR): You may request the erasure of your personal data, provided no statutory retention obligations apply. You can delete your account at any time via the account settings.
• Right to Restriction of Processing (Art. 18 GDPR): Under certain conditions, you may request the restriction of the processing of your data.
• Right to Data Portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): You may object at any time to the processing of your personal data based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.

To exercise your rights, please contact:
Email: kontakt@franco-consulting.com
Post: Franco Consulting GmbH, Maria-Theresia-Straße 17, 89331 Burgau

We will process your request without undue delay and in any event within one month of receipt (Art. 12(3) GDPR).

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR).

The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de

Providing your email address is required to use Vantero (contract conclusion). Without providing an email address, no user account can be created and the service cannot be used.

Providing a name is voluntary and serves solely for personalisation. All other data (chat content, documents) is provided voluntarily by you during use of the platform.

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place that produces legal effects concerning you or similarly significantly affects you.

The AI models generate text responses and other content based on your input. These serve as assistance and do not constitute automated decisions that have direct legal or factual consequences for you.

The mobile app uses the same backend infrastructure and supports an email one-time code and optional Google and Apple login. For iOS in-app purchases, the App Store processing described in section 13 also applies.

Under the current feature set, the app does not request access to location or contacts. Device-specific data, local settings and file metadata are processed only where required for login, display, file selection, security or a user-triggered feature. Permission for push notifications is used only after an active user choice.

We reserve the right to amend this privacy policy to adapt it to changed legal requirements or changes to the service or data processing. The current version is always available at https://vantero.chat/en/legal/datenschutz. In the event of material changes, we will inform registered users by email.

Depending on the purpose, we rely on Art. 6(1)(b) GDPR (service, account, authentication, AI and file processing, payment assignment), Art. 6(1)(f) (IT security, abuse prevention, error analysis and service optimisation), Art. 6(1)(a) (legally required consent for optional features) or Art. 6(1)(c) (tax, commercial, security and accountability duties). Third-country transfers additionally require Arts. 44 to 49 GDPR; selecting a feature alone is not a transfer mechanism.

Relevant frameworks: GDPR, BDSG, TDDDG and, for AI features, Regulation (EU) 2024/1689.