Vantage

Data and Privacy

Last updated: July 12, 2026

Introduction

Vantage is a product management platform. We take privacy seriously. This policy describes what data we collect, how we use it, and the measures we take to protect it. We will update this policy as our practices evolve.

Data Collection

We collect the following personal information:

  • Name and work email address
  • Employer or organisation name
  • Profile information provided via authentication

This information is collected exclusively for the purpose of providing the Service. We do not sell personal information to anyone.

Website Usage

When you visit our website, our servers automatically collect standard log information including IP addresses, browser type, operating system, referring URLs, and pages visited. This data is used for site improvement, trend analysis, and security monitoring.

Cookies

We use essential cookies for authentication and session management. We may use analytics cookies to understand how the Service is used. We do not use advertising cookies or sell tracking data to third parties.

Google API Data

When you connect your Google account to Vantage, we request read-only access to specific Google services so you can import your own data as context for AI-generated product documents.

The following Google data may be accessed when you explicitly choose to import it:

  • Google Drive: file names, types, and content of files you select
  • Google Docs, Sheets, Slides, and Forms: content and responses of files you select
  • Google Analytics: metrics and report data from properties you connect
  • Google BigQuery: results of read-only queries you run on your own datasets
  • Google Calendar: event titles, times, and descriptions you choose to surface

We use this data solely to provide the Service. Specifically, to build product intelligence that powers AI-generated PRDs, user journey maps, and product requirements within your workspace. We do not use Google user data for advertising, profiling, or any purpose unrelated to delivering the Service to you.

Google user data is never shared with third parties except as required to provide the Service (e.g. passing content to our AI processing pipeline under a data processing agreement that prohibits any secondary use). We do not allow humans to read your Google user data unless you have given explicit permission or it is necessary for security, legal compliance, or to respond to a support request you have initiated.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This commitment applies equally to raw Google user data and to any aggregated, anonymised, or derived artefacts produced from it, including vector embeddings, extracted entities, and knowledge graph nodes.

Retention and deletion of Google user data. Google user data is retained only for as long as your Google account remains connected to Vantage. When you disconnect your Google account, we immediately and permanently delete your OAuth access and refresh tokens, all content imported from your Google account, and the vector embeddings derived from that content. Deleting your workspace or your Vantage account permanently deletes all remaining data associated with it. You may also request deletion of your data at any time by contacting team@vantageos.tech.

You can disconnect your Google account at any time from Settings → Integrations. Upon disconnection, we cease accessing your Google data. You can also revoke access directly from your Google Account permissions.

AI and Your Data

The Service uses artificial intelligence to process content you provide and generate outputs. Vantage does not train, host, or operate its own AI models. All text generation and embedding is performed by Google Vertex AI (Gemini and gemini-embedding-001) running inside our own Google Cloud project. Under the Google Cloud Platform Terms of Service, Google does not use Vertex AI inputs or outputs to train its foundation models.

AI/ML model training and Google Workspace data

We do not use Google Workspace API user data — whether raw, aggregated, or anonymised — to develop, improve, or train any generalised AI or machine learning model. Workspace data is used only to serve the individual user who authorised access, within their own workspace, to produce the outputs they have requested. Any personalisation derived from this data is confined to that specific user’s personalised context and is never pooled across customers, used to train a shared model, or used to fine-tune any model.

We do not transfer Google Workspace API user data to any third-party AI or machine learning service that would use it to train or improve its models. Content is processed in real time to generate the requested output and is not retained by our AI provider beyond the duration of the request.

Third-Party Sharing

Your data may be shared in the following circumstances:

  • With service providers who facilitate delivery of the Service, bound by data processing agreements
  • With third-party platforms you explicitly connect to the Service
  • When required by law, court order, or governmental request
  • To enforce our agreements, protect our rights and safety, or address emergencies
  • In connection with a merger, acquisition, or asset sale, with notice to affected users

Aggregated, non-identifiable data may be used for analytics and general business purposes. This does not apply to data obtained from Google APIs. Neither raw nor aggregated or anonymised Google user data is used for any purpose other than to provide or improve the user-facing features you have requested, and it is never transferred or sold to data brokers, advertisers, or any other third party for such purposes.

Data Transfers

Your data is stored on cloud servers located in the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. Where required, we implement Standard Contractual Clauses or other legally recognised transfer mechanisms.

Vantage has received zero government requests for information since its founding.

Data Subject Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Right to be informed about how your data is collected and used
  • Right to access a copy of your personal data
  • Right to rectification of inaccurate data
  • Right to erasure of your personal data
  • Right to restrict processing
  • Right to data portability
  • Right to object to processing
  • Rights related to automated decision-making

To exercise any of these rights, contact us at team@vantageos.tech. We will respond within a reasonable timeframe and at no cost.

Data Retention

  • Service data is retained for the duration of the customer relationship, plus an additional period for analysis and record-keeping
  • Prospect data is retained until it no longer has reasonable business value
  • Data is deletable upon verified request from the account holder
  • Billing records are retained as required by applicable tax and financial regulations

Data Protection and Security

Technical Safeguards

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Regular security assessments
  • Secure API endpoints with access controls
  • Network segmentation and firewalls

Organisational Safeguards

  • Access controls restricted to authorised personnel
  • Data minimisation practices
  • Incident response procedures
  • Regular security audits

Children’s Data

We do not knowingly collect or solicit information from anyone under the age of 18. If we discover that personal data from a child has been collected, we will delete it promptly.

Third-Party Sites

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those sites. We encourage you to review their privacy policies independently.

Contact

For questions about this policy or your data, contact us at team@vantageos.tech.