Privacy Policy

1. Who is responsible

Vanta is a division of Vanguardtech (Pty) Ltd, with registration and contact details above. Address privacy requests to the Information Officer at info@vanguardtech.co.za. We determine how account, billing, support and operational information is used to provide the service. People entering information about others remain responsible for having lawful authority and giving appropriate notices.

2. Information handled

Account records include full name, cell number, email, password hashes, email-verification status, protected verification PIN records, authentication and security settings. Billing records include plans, coupon use, order/payment references, amounts, status and subscription dates. PayFast handles payment credentials; we do not store full card numbers or security codes.

Your entered records may include salaries and allowances, payslip deductions, spending, account balances, savings, goals, debts, assets, policies, investment contributions, task costs and descriptions. Vault files can contain wills or other sensitive personal documents. Policy references and downloaded reports can contain information about you or other people.

Family invitation records, permission choices, device push endpoints, delivery records, necessary browser preferences and technical/security logs support the features you use. We do not add banking data automatically or infer that a policy or will is legally valid.

3. Purposes and service providers

We use relevant information to operate accounts, verify email, deliver chosen tools, calculate reports, enforce sharing choices, verify payments, send requested notifications, provide support and protect the service. Processing relies on the service agreement, applicable lawful operational interests, legal obligations and consent where required. We do not sell personal information.

Necessary details are required for the corresponding feature. Email verification cannot work without a reachable email address; push is optional. Service providers may include hosting/database infrastructure, PayFast, platform and household SMTP providers, and browser/device push services. Only the information needed for the relevant function is supplied. General push messages avoid detailed financial amounts.

Providers can process information outside South Africa. Transfers under our control are subject to applicable protection requirements. Your connected SMTP provider also applies its own terms. We may disclose information where lawfully required or reasonably necessary to investigate fraud, security incidents or protect lawful rights. See PayFast legal information.

4. Family access and reports

Private personal records are separate. Budget sharing requires the owner's per-person view or edit permission and can be paused. Personal reports are not shared by default. Owners separately choose who can view each report, download its PDF or include protected policy numbers. Numbers require fresh two-factor verification. Business records and vault documents are not automatically shared through family membership.

Recipients can retain downloaded files or capture what they are authorised to view. Revocation cannot erase copies held elsewhere. Review permissions before sharing sensitive policy, financial or third-party information. Leaving or removal from a family ends related online permissions but does not delete your private workspace.

5. Storage, security, cookies and retention

The application uses configured database storage, access controls, request protection and password hashing. Vault documents, policy numbers and saved service credentials are encrypted/protected at rest. Ordinary budget figures are not end-to-end encrypted. Authorised application processing decrypts protected details when needed, including an explicitly requested report. Protect exported PDFs yourself; downloads are readable files, not encrypted vault archives.

Necessary cookies and browser storage support login, request security, selected workspaces, scroll position and interface preferences. Optional installed-app push requires device consent and can be disabled. Private financial records and vault documents are not stored in the offline service-worker cache. No optional visitor advertising or analytics tracking is included in this build; a change would require an applicable notice and choices.

Records are retained while needed for the service, legal obligations, disputes, security and legitimate operational purposes. A downgrade retains records but can lock features. Cancellation, family removal and uninstalling do not automatically delete account data, provider records or independently downloaded copies. Request deletion or export through support; identity verification and lawful retention exceptions may apply. Backup copies can remain until their normal rotation. For self-managed installations, the operator controls database location, backups and retention and must safeguard persistent encryption keys.

No security measure eliminates every risk. Contact us promptly about suspected compromise. Security incidents will be assessed and notifications made where applicable law requires them.

6. Your rights and complaints

Subject to applicable law, you may request access, correction or deletion, object on appropriate grounds, or withdraw consent where processing relies on it. Withdrawal does not invalidate earlier lawful processing. Email info@vanguardtech.co.za with your account email and request; do not send passwords, complete card details or unnecessary identity documents. We may verify identity and explain any request we cannot fully fulfil.

You can also contact South Africa's Information Regulator through its official contact and complaints channels. This policy does not limit your rights under POPIA. Material updates will carry a revised date and version and be communicated where required.