This policy explains what information [legal entity name] ("Vantage-FI", "we", "us") collects through vantage-fi.com and the VantageFi application at app.vantage-fi.com (together, the "Service"), how we use it, and the choices you have.
VantageFi is sold to organizations such as credit unions. When we process information that an organization puts into the Service, we do so on that organization's behalf and under our agreement with it.
Information we collect
Account information
Your name, work email address, the organization you belong to and your role in it. Your password is stored only as a one-way hash. If you turn on two-factor authentication, its secret is stored encrypted.
Data you put into the Service
Institution details and the financial model you build: balance-sheet figures by account category, rates, assumptions, scenarios, snapshots and reports. Your first model can start from your institution's NCUA 5300 Call Report, which is public. The Service models account categories and does not ask for member or customer records; please don't enter them.
Billing information
Payments are processed by Stripe. Card details go directly to Stripe and are never stored on our servers. We keep your plan, seat count, billing period and Stripe customer reference.
Security and usage records
For each sign-in session we record the IP address, browser and device description, and sign-in and last-activity times, so that you and your organization can review active sessions and so we can protect accounts. We keep an audit record of account, membership, billing and administrative changes.
Communications
When you email us or use our contact form, we keep that correspondence to respond and to support you.
The website
vantage-fi.com sets no cookies and uses no analytics or advertising trackers. Our hosting provider keeps standard request logs, such as IP address and pages requested.
Browser storage in the application
The application uses your browser's local storage to keep you signed in and to remember preferences such as your selected institution and display theme. It does not use advertising cookies.
How we use information
- To provide, maintain and support the Service.
- To secure accounts, prevent abuse and investigate problems.
- To bill for subscriptions and manage seats.
- To send service email, such as email verification, password resets, invitations, security notices and billing messages.
- To meet legal and regulatory obligations.
We do not sell personal information and we do not use it for advertising.
Who we share it with
We use a small number of service providers, each only for what the Service needs:
- DigitalOcean hosts the application, its database and the website.
- Stripe processes payments.
- [email provider] delivers service email.
- Have I Been Pwned lets us check new passwords against known data breaches. Only the first five characters of a hash of the password are sent; the password itself never leaves our servers.
Members of your organization with owner or admin roles can see the members, sessions and activity of that organization. We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy would continue to apply.
Where information is stored
The Service is hosted in the United States.
How long we keep it
- Active accounts: for as long as the account exists.
- Deleted accounts: sign-in stops immediately. The account can be restored for 30 days; after that, personal information in the account is anonymized. A sealed record of the deletion is kept for 7 years for legal and audit purposes and then destroyed, unless a legal hold applies.
- Audit records are kept to meet our security and legal obligations.
- Backups are taken nightly and kept for up to 14 days.
Security
We protect information with encryption in transit, two-factor authentication, breached-password checks, sign-in rate limits, organization-level isolation and tested backups. See our Security page for details. No system is perfectly secure; if we learn of a breach that affects your information, we will notify you and your organization as the law requires.
Your choices
You can update your name and password and manage two-factor authentication and your sessions from your profile in the application. To access, correct, export or delete your information, email [email protected]. If your account belongs to an organization, we may refer your request to that organization, which controls its own data.
Children
The Service is for businesses and is not directed to anyone under 18.
Changes to this policy
We will post any changes here and update the effective date. If a change materially affects how we use personal information, we will notify account owners by email before it takes effect.
Contact
[legal entity name]
[mailing address]
[email protected]