Privacy
Policy.

At Vanta Flow, we take your privacy seriously. This policy explains — in plain English — what information we collect, why we collect it, and how we keep it safe.

Who we are

Vanta Flow is a UK-based workflow automation service for businesses in the home industry. When this policy mentions "we", "us", or "our", it refers to Vanta Flow.

For any privacy-related questions, you can contact us at hello@vantaflow.co.uk.

What information we collect

Information you provide directly

When you contact us through our website or sign up as a client, we may collect:

• Your name and business name
• Your email address and phone number
• Details about your business (industry, size, current workflows)
• Information you share during discovery or onboarding calls

Information collected automatically

When you visit our website, we may automatically collect:

• Basic usage data (pages visited, time on site)
• Device and browser information
• Approximate location (country/city level only)

We do not use invasive tracking or third-party advertising cookies.

How we use your information

We only use your information for purposes you'd reasonably expect:

• Responding to your enquiry or contact form submission
• Providing the automation services you've signed up for
• Sending occasional service updates or system notifications
• Improving our website and services
• Meeting our legal and contractual obligations

We will never sell your data to third parties. Ever.

Client data processing

For paying clients, we act as a Data Processor on your behalf. This means we handle data your business collects from its own customers (for example, enquiries, quotes, and aftercare communications), strictly according to your instructions.

Every Vanta Flow client signs a Data Processing Agreement (DPA) with us before any work begins. This formal contract outlines exactly how we handle your data, what tools we use, and what your rights are under UK GDPR.

Sub-processors we work with

To deliver our service, we use carefully selected third-party tools. Each of these has its own strong privacy practices and is GDPR-compliant:

• Make.com — workflow automation platform
• Google Workspace — email and document handling
• HubSpot — customer relationship management (CRM)
• Tally — form submissions
• Netlify — website hosting

For clients, the specific sub-processors used in your setup will be detailed in your individual Data Processing Agreement.

How long we keep your data

We only keep your data for as long as it's needed:

• Enquiry data — kept for 12 months, then deleted
• Client data — kept for the duration of the service agreement, plus 6 months
• Financial records — kept for 7 years (legal requirement)

You can request deletion of your data at any time by emailing us — we'll respond within 30 days.

Your rights under UK GDPR

You have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate information
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a portable format
• Objection — object to certain types of processing

To exercise any of these rights, email hello@vantaflow.co.uk. We respond within 30 days.

How we protect your data

We take security seriously. Our protective measures include:

• Encrypted data transmission (HTTPS/SSL)
• Two-factor authentication on all administrative accounts
• Strict access controls — only authorised team members can access client data
• Regular security reviews of our systems and processes
• GDPR-compliant data processing agreements with all sub-processors

Cookies on this website

Our website uses minimal cookies. These are limited to:

• Essential cookies needed for the website to function
• Basic analytics cookies to understand site usage

We do not use advertising cookies, social media trackers, or any third-party marketing pixels.

Complaints and contact

If you have any concerns about how we handle your data, please contact us first at hello@vantaflow.co.uk. We take all concerns seriously and will respond promptly.

You also have the right to lodge a complaint directly with the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

Changes to this policy

We may update this privacy policy from time to time. The latest version will always be available on this page, with the "Last Updated" date clearly marked at the top.

If we make significant changes that affect how we use your data, we'll notify you directly via email.