Privacy Policy.

This policy is issued by Vantelyx Technologies Private Limited(“Vantelyx”, “we”, “us”), a company registered in Nepal under registration no. 400359/83/84, with its registered office at Kathmandu Metropolitan City, Ward No. 12, Bagmati Province, Nepal. We decide how and why personal data is processed, so for data-protection purposes we are the controller (the “data fiduciary” under India’s DPDP Act).

It covers:

• the public website at vantelyx.dev, including the free Digital Growth Audit;
• Vantelyx Studio, the signed-in client workspace at /studio;
• our emails and WhatsApp conversations about your projects.

It does not cover the websites and systems we build for clients. For those, we act on the client’s instructions and the client’s own privacy notice applies.

When you browse the website

Our hosting provider records standard server logs: IP address, browser user agent, the page requested and the time. We use them only to operate and secure the service. We also work out your approximate country from your IP address so we can show prices in a suitable currency. That country is saved to your workspace only if you start a project. No analytics profile is built.

When you use the Digital Growth Audit

We collect:

• the website address you submit;
• if you are not signed in, the email address the report should go to;
• the resulting scan scores and findings.

The scan fetches your public website and asks Google PageSpeed Insights to analyse it. Anonymous audits are protected by Cloudflare Turnstile, a bot check that processes your IP address and browser signals. To prevent abuse we keep a shortened, one-way hash of your IP address for about 24 hours.

When you contact us

If you email us or send an enquiry, we keep what you send: your name, email address, company, the service you are interested in, your budget and your message. We use it to reply and to follow up on your enquiry.

When you create a Vantelyx Studio account

• Sign-in details. Your email address and password, or your name, email address and profile image if you sign in with Google. Supabase Auth manages passwords, and we never see them in plain text.
• Identity. Your first and last name, and a mobile number we verify with a one-time SMS code. Google Firebase Authentication sends the code and uses invisible reCAPTCHA to prevent abuse. We keep the verified number and a Firebase reference to it.
• Preferences. Language, currency, which email notifications you receive, and your light/dark theme choice.
• Team members. Email addresses of people you invite to your workspace.

When we work on a project together

• Intake details. Business details, your website address, and the intake conversation (stored as written, together with an English version and the language detected).
• Project records. Briefs, blueprints, domain searches and watchlists, quotes, approvals, change requests, project updates and any files shared through Studio.
• Quote acceptance. When you accept a quote electronically, we record your typed name, your confirmation, a fingerprint of the document, the time, and your IP address and browser user agent, as evidence of the agreement.
• Messages.Replies to project emails (received through Resend) and WhatsApp messages from a number you have verified (through Meta’s WhatsApp Business Platform) are added to your project thread.
• Billing. Invoices and payment records such as amount, method and reference. We do not collect card details on this website.
• Care, monitoring and domains. Care-plan requests, websites you ask us to monitor, and domain details. If we register a domain for you, this includes the registrant contact details the registrar requires.
• Testimonials and referrals. We store the testimonial you submit, with your name and role if you add them. We review every submission and publish it only if you ticked the box giving us permission. For referrals we record the referral code and the credits earned.

Security and accountability records

We keep an activity log of significant account and project actions, such as project submissions, messages sent, account-deletion steps and failed deliveries. It helps us keep the service secure and resolve disputes.

We use personal data only for the purposes below. Where GDPR-style laws apply, the legal basis is shown for each.

• Delivering our services. We run your account, prepare proposals, deliver projects, invoice, and provide support. Basis: performing our contract with you, or steps you asked for before one.
• Security and fraud prevention. We verify phone numbers, run bot checks, enforce rate limits and keep activity logs. Basis: our legitimate interest in keeping the service safe, and legal obligations.
• Service communications. We send quotes, updates, invoices and alerts you have switched on. You can turn off non-essential email categories in Studio. Basis: contract and legitimate interests.
• Answering enquiries and audits. We reply to you and send the audit report you asked for. Basis: steps you requested, and legitimate interests.
• Legal and financial records. We keep accounting, tax and signed-agreement records. Basis: legal obligation.
• Testimonials. We publish only what you approve. Basis: your consent, which you can withdraw.

We do not send marketing emails without your permission. We do not use automated decision-making that has legal or similarly significant effects on you.

Some Studio features use large language models: the project intake conversation, follow-up questions, scope checks, blueprint drafting and help polishing a testimonial. For these features, the text you provide and relevant project details are sent to AI model providers. The requests go through OpenRouter, or directly to Anthropic. Members’ audit reports get AI commentary based only on the website scan findings.

AI features are available only to signed-in users, are rate-limited, and receive only the content needed for the task. Please don’t include sensitive personal information (such as health or financial account details) in intake conversations.

We use only cookies and browser storage that are strictly necessary: to sign you in, keep the service secure, complete a flow you started, or remember a setting you chose. None are used for analytics or advertising. The Cookie Policy lists each item, its purpose and how long it lasts.

We do not sell or rent personal data. We share it only with service providers that process it on our behalf, under contract, for the purposes above:

• Vercel: website hosting, server logs and scheduled jobs.
• Supabase: database, authentication and file storage.
• Resend: sending and receiving email.
• Google Firebase and reCAPTCHA: phone-number verification and bot protection.
• Google Sign-In: signing in with Google, only if you choose it.
• Cloudflare Turnstile: bot protection on the website audit.
• OpenRouter, Anthropic and the model providers OpenRouter routes to: AI-assisted features.
• Meta (WhatsApp Business Platform): WhatsApp verification codes and project messages.
• Google PageSpeed Insights: website performance scans (it receives the website address only).
• Porkbun: domain availability checks and registrations.

We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a merger or acquisition, subject to this policy. If we add a payment provider for online payments, we will update this policy first.

We are based in Nepal and serve clients internationally. Several of our providers process data in other countries, including the United States and the European Union. When data leaves your country, we rely on the safeguards our providers offer, such as standard contractual clauses, and require them to protect it to the standard set out in this policy.

• Account and project data is kept while your workspace is active, and deleted when we carry out a deletion request.
• Records we must keep are retained even after account deletion, but separated from your account where possible. These are signed quote records, invoices and payment records, and append-only message and activity logs. We keep them for as long as accounting, tax and legal limitation periods require.
• Enquiries and anonymous audit reports are kept for as long as needed to respond and follow up. You can ask us to delete them at any time.
• Rate-limit data (hashed IP addresses) is removed after about 24 hours.
• Phone and WhatsApp verification sessions expire after 10 minutes. Only a hash of each WhatsApp code is ever stored.
• The referral cookie expires after 7 days.
• Server logs are kept only as long as our hosting provider retains them.

Data is encrypted in transit. Database access is restricted with row-level security, so a workspace can see only its own records. Staff access is limited by role, and our admin area can require multi-factor authentication. WhatsApp verification codes and rate-limit keys are stored only as hashes, and we log significant actions. No system is perfectly secure. If a breach is likely to affect you, we will notify you and the relevant authorities as the law requires.

We give the following rights to everyone, wherever you live. They reflect Nepal’s Individual Privacy Act, 2075 (2018), the EU and UK GDPR, and India’s Digital Personal Data Protection Act, 2023.

• Access and portability. Get a copy of your data. Signed-in users can download a JSON export from Studio → Account → Data & privacy.
• Correction. Update inaccurate details. Most can be edited directly in Studio.
• Deletion. Ask us to erase your data. Request it in Studio or by email. We confirm before deleting and keep only the records the law requires.
• Objection and restriction. Object to processing based on legitimate interests, or ask us to limit it.
• Withdrawing consent. Where we rely on consent, such as testimonials, you can withdraw it at any time.
• Complaint. Complain to your local data-protection authority or grievance body. We would appreciate the chance to address your concern first.

To exercise a right, email hello@vantelyx.dev from the address linked to your account. We may need to verify your identity, and we aim to respond within 30 days.

Our services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Our website links to other services, such as our Instagram, TikTok and Facebook profiles and websites we have built. These are plain links, not embedded trackers. Once you follow one, that service’s own privacy policy applies.

We will update this policy when our services or data practices change and revise the date at the top. If the changes are significant, we will tell Studio account holders by email or in Studio before they take effect.

For any privacy question, request or complaint, contact us:

• Email: hello@vantelyx.dev
• Post: Vantelyx Technologies Private Limited, Kathmandu Metropolitan City, Ward No. 12, Bagmati Province, Nepal