Privacy Policy

Who we are

Vanto (vanto.cards) is a collection platform for die-cast collectors. “We” and “us” in this policy mean Vanto. Questions about your data go to hello@vanto.cards.

What we collect

When you join

• Email and password. Your password is stored only as a one-way hash by our sign-in provider; nobody at Vanto can read it.
• Or your Google account, if you choose “Continue with Google”: Google tells us your name and email address. We never see your Google password.
• A username (your public garage address) and the currency you keep your values in.
• Who invited you, if you join through a friend's invite link, so they get their extra AI scans. They see how many friends joined, never who.

What you add

• Your profile: name, bio, and a region if you enter one (a city or area you type, never an address).
• Your collection: each car's details, the photos you upload, its condition, what you paid, when and where, its estimated value, where you store it, and your notes.
• Your wishlist and target prices, pre-orders and payments, the collectors you follow, and your medals.
• Feedback you send us, including a screenshot if you attach one.
• Reports you send about another collector's garage. Only Vanto reads them, and that collector isn't told who sent one.

If you pay

• Your membership and what you bought: the plan or pack, the amount, the date and Razorpay's reference for the payment, and your Founding Member number if you have one. Your card, UPI or bank details go to Razorpay, never to us.

When you visit

• How the site is used, through Microsoft Clarity: pages visited, clicks, scrolling and the device and browser used, which we watch as anonymous recordings and heatmaps to find what's confusing or broken.
• Whether our ads work, through the Meta Pixel: page views and a few events (an account was created, the rank calculator was used). It is never sent a car, a value, a city or your email.
• Where you came from, when you join: the ad campaign or the website whose link brought you (for example “instagram”), and the page you arrived on, saved with your new account so we can count which ones bring members.
• Ordinary server logs kept by our hosting provider, such as IP addresses and the time of a request.

What other collectors can see

One switch decides it: your garage is public or private.

• Private: nobody else sees your collection or your profile (name, bio and picture), and you're not on the map or the leaderboard. Your garage link only says the garage is private.
• Public: your username, name and bio, and the cars you put on display or on your swap shelf (their photos, model, condition, special edition and estimated value), your follower count, and your place on the club leaderboard unless you hide yourself from it.
• In the catalog, only if you switch on sharing your photos: your cover photo of a car can become that car's catalog picture, shown to everyone with your username. Switch it off and they're taken out.
• On the map, only with a public garage and a region filled in: an approximate point a few kilometres from the centre of your city. We never store your exact location or any address.
• Never shown to anyone else: your email, what you paid, purchase dates and sellers, where you store your cars, your notes, your wishlist and your pre-orders.
• In price estimates, what you paid counts towards the typical price collectors paid for the same car, shown only once five or more collectors have logged one, as a range, and never with a name or anyone's single price.

How we use it

• To run Vanto: your vault, garage, map, club, medals, price estimates and reminders.
• To send the emails the account needs, such as confirming your address and resetting your password.
• To find and fix problems, and to see which parts of the site people use.
• To measure whether our ads bring people who join, so we spend less on the ones that don't.

We don't sell your personal data, and we don't use your collection to target advertising.

Who helps us run it

These services process data for us, only to do their part. Some are outside your country, so your data may be handled in other countries, including Japan and the United States.

• Supabase: the database, sign-in and photo storage (servers in Tokyo, Japan).
• Vercel: hosting the website.
• Resend: sending account emails.
• Cloudflare: Turnstile, which checks that a person, not a bot, is joining or signing in. It sees your IP address and browser details for that check.
• Razorpay: taking payments for memberships and scan packs (India). It receives your email and what you're paying for, and handles your payment details itself.
• Anthropic: the AI photo scan in Add a car. The photo you scan is sent to identify the car; we keep it only if you add it to the car, and we count your scans. When you ask it to find a set's missing cars, it's sent the set's name and the names of your cars in it, and searches the web; the list it finds is kept for every collector, never with your name on it.
• Google: “Continue with Google”, and the fonts the site uses.
• Microsoft Clarity: usage recordings and heatmaps.
• Meta: measuring Instagram and Facebook ads.
• eBay: live listing prices for estimates. We send only the car's name, brand and scale, never anything about you. Listing links marked as affiliate links carry Vanto's eBay Partner Network ID, so eBay can pay Vanto a commission if you buy; they carry nothing about you.
• OpenStreetMap: turning the region you type into a map point, and the map itself. Only the region text is sent.

Cookies and storage in your browser

• Needed: sign-in cookies that keep you signed in.
• Preferences: small settings kept in your browser, such as your currency, and which link or website brought you, until you join (for 30 days at most).
• Analytics and ads: Microsoft Clarity and the Meta Pixel set their own cookies. You can block them in your browser's settings or with a tracker blocker, and Vanto keeps working.

How long we keep it

As long as your account is open. When you delete your account we remove it, your collection and your photos within 30 days; copies in our providers' backups are overwritten on their regular cycle after that. Records of payments are the exception: tax law makes us keep them for years, so they stay, no longer linked to your account.

Your choices and rights

• See and change your details and collection at any time in the app.
• Download your collection as a spreadsheet from the Collection page.
• Make your garage private, leave the region blank to stay off the map, or hide from the leaderboard.
• Delete your account yourself, straight away, at the bottom of Profile.
• To have us delete it, or to ask what we hold about you, write to hello@vanto.cards from the email address on your account. We answer within 30 days.

Depending on where you live (for example under the GDPR in the EU and UK, or India's Digital Personal Data Protection Act), you may have further rights, such as to object to some uses or to complain to a data protection authority. Write to us and we'll help.

Children

Vanto isn't meant for children under 13. If you believe a child under 13 has an account, tell us at hello@vanto.cards and we'll delete it.

Keeping it safe

Everything travels over encrypted connections, and the database only lets each collector read and change their own private data. Photo files are kept at long, hard-to-guess addresses; anyone who is given the exact address of a photo can open it, so share those links with care. No system is perfectly secure, and if something ever goes wrong we'll tell those affected.

Changes

When this policy changes we update the date at the top, and for important changes we tell members on the site or by email first.

Contact

hello@vanto.cards. See also our Terms of Service.