Privacy Policy

1. Who is responsible for your data

Vanti is operated by Nikolay Venev, an individual (not a company), based in New York, United States.

If you are in the EU, the UK, or a US state with its own privacy statute, the word for this role is controller: the person who decides what is collected and why. For most of your data, that is us. For some of it, it is the tournament director, and section 2 explains the difference, because it changes who you should ask when you want something changed.

2. Two kinds of data, two people responsible

This matters more than it sounds, so it comes early.

A. Your Vanti account. Your login email, your profile, your notification settings, your saved devices. You gave these to us. We decide what happens to them, and we are responsible.

B. A tournament's roster. When a director runs an event, they enter or import their participants: names, emails, phone numbers, skill ratings, sometimes a date of birth for age divisions. The director decides what to collect and why. We hold and process it on their instructions. In legal terms they are the controller and we are the processor.

So:

• Want your account corrected or closed? Ask us.
• Think a director should not have your details, or has them wrong? Ask the director. Their contact address is on the event page. Tell us as well and we will help you reach them, but the decision is theirs.

Once a roster entry becomes a claimed Vanti account, the account half of it is ours under (A) and the event half stays theirs under (B).

3. What we actually collect

Everything in this section is a real field in the product. Nothing is listed "just in case".

Your profile

Playing in events

Registrations, team-mates, check-ins, seeds, match results, game scores, standings, and final placings.

Running the product

• Notifications. What we sent you, on which channel, and whether it was delivered, opened, bounced or failed.
• Push devices. If you turn on push notifications: the browser's push address, your device's user-agent string, and a label so you can recognise it in your settings.
• Sign-in. Magic-link tokens and session cookies. There are no passwords in Vanti at all, so there is no password for us to lose.
• Admin actions. If an administrator acts on your account, that action is logged with who did it and when.

What a director can write about you

A director can attach private notes, tags, and their own rating to a player in their organisation. You cannot see these, and they are not shown to other directors. They belong to that director's organisation.

We are telling you this because it is your personal data even though it is hidden, and if you ask us for a copy of everything we hold, these are included. We think a policy that quietly omits the notes written about you is not an honest one.

What we deliberately do NOT collect

• No payment data. Nothing. Vanti processes no money at all (section 8).
• No health or medical data, no injuries, no dietary or accessibility notes. The product has nowhere to put them and directors should not enter them.
• No advertising or cross-site tracking identifiers.
• No session recording or screen replay. We can see that an error happened. We cannot watch you use the site.
• No IP addresses in our error reports. This is a setting we chose and turned off deliberately.

4. What is public

Published event pages are public to anyone with the link, with no sign-in. On them, these appear:

• The event, its divisions, the schedule and the rules.
• Standings, brackets, results and podium placings, with players' display names.

Your email address, your phone number, your date of birth, your gender, your ratings and a director's private notes are never on a public page.

Profile photos and organisation logos are served from public web addresses. Anyone holding the exact link can open the image without signing in. The links are not published or guessable, but treat an uploaded photo as public.

Publishing results is the entire purpose of a tournament record, and we rely on legitimate interest to do it: a competition record that can be edited out of existence is not a record. We have weighed that against your privacy and think publishing a display name beside a result, and nothing more, is the narrowest version of it. If you disagree in your own case, you can object (section 10), and section 9 explains what happens to your name if you do.

5. Why we use it, and our legal basis

For readers under the GDPR or the UK GDPR, this is the Article 6 table.

We never rely on "legitimate interest" for marketing, because we do not do marketing.

6. Who else touches your data

These are our subprocessors. Each one does a single job, and each one is listed with what it actually receives.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those phrases are defined in US state privacy laws. We have never done so.

We will also disclose data if the law genuinely requires it, and to protect someone's safety. If we are ever compelled to hand over your data, we will tell you unless we are legally barred from doing so.

7. Where your data is stored, and international transfers

All of it is in the United States. The database is in Northern Virginia, the application servers are in the US East region, and Sentry and Resend both store in the US.

If you are in the EU, the EEA or the UK, this means your data is transferred to the United States. We rely on the Standard Contractual Clauses in each vendor's data-processing agreement, and the vendors above are all certified under the EU-US Data Privacy Framework or its UK extension. You can ask us for the details.

We do not have EU or UK operations, and Vanti is not directed at people outside the United States. We give you the rights in section 10 anyway, because we would rather give everyone the same answer than sort our users by passport.

8. Payments

Vanti does not process payments. There is no card form, no payment processor, and no money moves through this product.

Entry fees are between you and the tournament director, settled however they choose to settle them, outside Vanti entirely. All Vanti records is a director's note that a fee was handled. Waivers work the same way: directors collect them on paper or in person, not here.

9. How long we keep things

What "erased" means depends on why.

• If you asked to be forgotten, your name goes too. Past results read "Deleted player".
• If we removed the account for our own housekeeping (a duplicate, a test row, spam), nobody asked to be forgotten, so the name stays on the results and the competition record stays intact.

Either way, your contact details, date of birth, photo and ratings are destroyed. The difference is only whether the record still says who played.

The 180 days is a hold, not a countdown to an automatic deletion. Until it passes, the account can still be restored. After it passes, a person has to choose to run the erasure. Nothing erases itself.

10. Your rights

These apply to everyone, whatever your country. Write to support@vantiapp.com and we will answer within 30 days.

• See it. Get a copy of everything we hold about you, including a director's private notes.
• Fix it. Correct anything wrong.
• Delete it. Close your account and have it erased. Section 9 explains what survives and why.
• Take it with you. Get your data in a machine-readable file.
• Object. Tell us to stop relying on legitimate interest, including publishing your name in results.
• Withdraw consent. Turn push notifications off at any time, in your account settings or from your device.
• Say no to automated decisions. There are none in Vanti. No profiling, no automated scoring of you as a person. Seeding uses ratings a human entered.
• Be treated the same either way. Exercising any of these rights will never get you worse service, a worse seed, or removed from an event.

We will not charge you for any of this, and we will not ask you for more identification than we need to be sure it is you.

If you are unhappy with our answer, you can complain to a regulator: the New York State Attorney General in the US, your national data protection authority in the EU or EEA, or the Information Commissioner's Office in the UK. We would rather you told us first, but you do not have to.

11. Children

Vanti is for adults. You must be 18 or older to hold a Vanti account.

We do not knowingly collect the personal data of anyone under 18, and the pilot event this product launched with has no under-18 participants.

Directors must not enter a minor's details into Vanti without the consent of that child's parent or guardian, and must tell us if they intend to run a junior division so that we can handle it properly rather than by accident. If you believe a child's data is in Vanti, write to support@vantiapp.com and we will remove it.

12. How we protect it

• Every table has row-level security. Access is enforced by the database itself, not only by the screen you are looking at, so a bug in a page cannot hand out rows the database will not release.
• There are no passwords. Sign-in is a one-time emailed link, so there is no password database to steal and nothing to reuse from another site's breach.
• Traffic is encrypted in transit, and the database is encrypted at rest.
• Administrative access is logged, including the rare case where an administrator views the product as another user to diagnose a problem.
• Errors are monitored so that failures are noticed rather than reported.

As a business holding the private information of New York residents, we keep administrative, technical and physical safeguards appropriate to our size under the New York SHIELD Act.

If there is ever a breach affecting you, we will tell you. New York requires notice within 30 days of discovery, and the GDPR requires notice to a regulator within 72 hours. We will meet the tighter of the two.

No system is perfectly safe, and Vanti is a young product. We would rather say that than imply otherwise.

13. Cookies and similar technology

There is no cookie banner on Vanti because there is nothing on it to consent to.

• Signed out, on a public page, Vanti sets no cookies at all. No cookies, no local storage, no session storage. We checked this on the live site rather than assuming it.
• Signed in, there is one set of cookies: the ones that keep you signed in. They are strictly necessary, and turning them off means you cannot use the product.
• Speed Insights uses no cookies. It measures how fast a page loaded and cannot follow you from one page to the next.
• Our database provider sets a short-lived security cookie on its own domain when your browser talks to it, to block automated abuse. It does not track you and we cannot read it.

We do not use analytics that profile you, and there is no advertising technology in this product.

14. Changes to this policy

If we change something that matters, we will change the date at the top and, for a material change, email you before it takes effect. We will not make a material change quietly.

15. Contact

support@vantiapp.com

Nikolay Venev · 24-51 38th Street, Astoria, NY 11103 · New York, United States

If you write to us about your data, say what you want and we will do it. You do not have to cite an article number.