Privacy Policy

Vantage Data Room (the "Service") is operated by Vantage Businesses Inc. ("Vantage", "we", "us"). The Service provides a secure, AI-assisted investor data room used by property developers and their authorised sales representatives to share materials with prospective investors.

Contact: dev@vantagebusinesses.com.

Account data — name, email address, password hash, organisation, role.

Workspace data — your business profile, project details, regional knowledge, comparable transactions, investor records, meeting notes, sales activity events.

Investor data — for each investor you invite: name, email address, NDA acceptance state, session activity in the data room (pages viewed, documents downloaded, time spent), notes you record about them, and any reply correspondence you initiate through the Service.

Connected services — when you connect Gmail, Outlook, HubSpot, Salesforce, or other integrations, we store the OAuth tokens required to call those services on your behalf. Tokens are encrypted at rest.

Operational telemetry — request logs, error reports, performance metrics. No content of the data room is included in operational logs.

Operate the Service — provision your workspace, render the data room to investors you invite, deliver email sent via the Service, sync data to your connected CRMs.

AI assistance — your workspace data and the investor activity you've recorded feed our AI assistants (Vantage Intelligence) to generate briefs, conversational responses, and email drafts inside your workspace only. We do not train shared AI models on your data.

Improve the Service — aggregated, de-identified usage telemetry informs reliability and product decisions.

Legal compliance — we may process or retain data when required by applicable law.

If you connect a Google account, Vantage receives Gmail permissions (gmail.send, gmail.modify, userinfo.email, userinfo.profile) so that approved drafts originating in your workspace are sent from your mailbox and so that reply notifications can be threaded against the originating message.

Vantage's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.

We do not use Google user data for advertising. We do not allow humans to read Google user data unless we have your explicit consent for specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or our use is for internal operations and the data have been aggregated and anonymized.

If you connect a Microsoft account, Vantage receives Mail.Send, Mail.ReadBasic, and User.Read permissions for the same purposes as the Google integration: outbound drafts sent from your mailbox, reply notifications. The same Limited Use posture applies.

We do not sell personal data.

Service providers — we use Supabase (database + storage), Vercel (hosting), Postmark / Resend (email delivery fallback), OpenRouter (AI model routing), Mapbox (mapping), and the CRM providers you choose to connect. Each is contractually bound to handle data only on our instructions.

Workspace boundaries — data inside your workspace is visible only to administrators of that workspace and to investors you invite by name. Vantage staff have access only when necessary for support and only with audit-logged escalation.

Account + workspace data is retained while your subscription is active. On termination, we delete or anonymize all workspace data within 30 days, except where retention is required by law.

Operational logs are retained for 90 days.

AI brief outputs and meeting note extractions are retained as part of workspace data.

You may request access, correction, deletion, or export of personal data we hold about you by emailing dev@vantagebusinesses.com.

Investors invited into a workspace may at any time view what we have stored about their session activity via the in-room "What we have on file" surface. They may also request removal of their record by writing to the workspace administrator who invited them or to us directly.

CASL (Canada) — recipients of any communication sent through the Service have an unsubscribe option in every email. Withdrawals are sticky.

All traffic is encrypted in transit (TLS 1.2+). All connected-service tokens are encrypted at rest using AES-256-GCM with workspace-scoped envelope encryption. Database backups are encrypted. Access to production systems is gated by multi-factor authentication and reviewed quarterly.

The Service is not intended for users under the age of 16. We do not knowingly collect personal data from children.

We may update this policy. We will notify workspace administrators by email at least 14 days in advance of any material change.

Questions, complaints, or rights requests: dev@vantagebusinesses.com.