Privacy Policy

Last updated: 29 June 2026

Draft — pending legal review. This document is a working draft and must be reviewed by a qualified legal/data-protection adviser before it is relied upon.

This Privacy Policy explains how Vanta, a product of ZEROPOINT MARKETING SOLUTIONS LTD ("ZeroPoint", "we", "us", "our"), collects and uses your personal data when you use the Service. We are the data controller for the personal data described here. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Controller details: ZEROPOINT MARKETING SOLUTIONS LTD, company number 17057565, registered at 167-169 Great Portland Street, London, England, W1W 5PF. Data-protection contact: support@vantamix.com.

1. Data we hold

Data	Purpose	Lawful basis
Email address	To create and identify your account, log you in, and contact you about the Service.	Performance of a contract.
Password (stored only as a bcrypt hash — never in plain text)	To authenticate you securely.	Performance of a contract.
Uploaded audio (your stems) and the outputs we generate (processed stems, mix, master)	To provide the core Service: instrument detection, effect chains, mixing and mastering.	Performance of a contract.
Payment data (handled by Stripe — see sub-processors)	To take payment for paid plans and per-track purchases. We do not store your full card details; Stripe processes these.	Performance of a contract; compliance with legal/accounting obligations.
Authentication session cookie	To keep you logged in securely between requests.	Strictly necessary for a service you have requested.
Usage / quota records (e.g. number of renders this period)	To enforce plan limits and operate billing.	Performance of a contract; legitimate interests (preventing abuse).

2. How we use your data

We use your personal data only to operate and provide the Service: to run your account, process the audio you submit, deliver your mixes and masters, take payment, enforce plan limits, secure the Service, and respond to your support requests. We do not sell your personal data, and we do not use your uploaded audio to train AI models.

3. Retention

Uploaded audio and outputs are stored only as long as needed to provide the Service and are automatically cleaned up from our working storage on a rolling basis after processing. They are not kept indefinitely.
Session cookies expire automatically and are cleared when you log out.
Account data (email, password hash, quota records) is kept for as long as you have an account. If you close your account we delete or anonymise it, subject to any records we must retain for legal, tax or accounting reasons.

4. Sub-processors

We use a small number of trusted third parties to provide the Service. They process data on our behalf under appropriate agreements:

Stripe — payment processing. Stripe acts as a processor (and, for certain payment data, as an independent controller) and handles your card details directly. See Stripe's own privacy notice for details.
Fly.io — application and infrastructure hosting, where the Service runs and audio is processed and temporarily stored.

5. International transfers

Where a sub-processor processes data outside the UK, we rely on appropriate safeguards (such as UK adequacy regulations or the International Data Transfer Agreement / Addendum) to protect your data.

6. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you;
Rectify inaccurate or incomplete data;
Erase your data ("right to be forgotten");
Restrict or object to certain processing;
Data portability — receive your data in a portable format;
Withdraw consent where processing relies on consent.

To exercise any of these rights, contact us at support@vantamix.com or our data-protection contact at support@vantamix.com. We will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

Vanta uses a single strictly necessary session cookie to keep you securely logged in. It is essential to the operation of the Service and does not require consent. We do not use advertising or third-party tracking cookies.

8. Security

We take reasonable technical and organisational measures to protect your data, including hashing passwords with bcrypt, transmitting data over encrypted connections, and limiting access to your audio. No system is perfectly secure, but we work to keep your data safe.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email where appropriate.