Privacy Policy

Order Vanta is a market-data service that detects institutional order-flow activity and delivers it as written and spoken alerts. This policy explains what personal information we collect when you use https://ordervanta.com and the Order Vanta applications, why we collect it, and who else processes it.

The data controller is Ordervanta Inc., a Delaware corporation ("Order Vanta", "we", "us"). For any question about this policy, or to exercise any of the rights described below, contact support@ordervanta.com.

We collect only what the service needs in order to run. Specifically:

• —Account information you give us at sign-up: your name, email address, country, and an optional phone number and promotional code. If you create a password, it is hashed by our authentication provider and is never visible to us.
• —Google account information, if you choose to sign in with Google. We receive only your basic profile — name, email address and profile picture — from the standard sign-in scopes. We do not request access to your Gmail, Drive, Calendar, Contacts or any other Google service, and we cannot read them.
• —Sign-in records: the IP address and timestamp of your most recent sign-in, and the date your email address was verified. These exist for account security and abuse investigation.
• —Subscription and payment records: your plan, the instruments you subscribe to, subscription status and billing period dates, and a record of each payment. Card details are handled entirely by our payment processor — see “Payments” below.
• —Account approval notes: Order Vanta accounts are manually reviewed before activation. The decision, its timestamp and any internal note made by our staff are recorded.
• —Product settings: your watchlist, alert thresholds, voice preference and similar choices, so the product behaves the same way each time you sign in.
• —Telegram chat identifier, only if you choose to connect Telegram for alert delivery.

We also do not use advertising networks, do not embed third-party analytics or tracking SDKs, do not build advertising profiles, and do not sell or rent personal information to anyone. The only cookie the site sets on its own is a small preference that remembers whether the dashboard sidebar is open. Your signed-in session is stored in your browser by our authentication provider so you are not asked to sign in on every page.

• —To create, approve and maintain your account, and to authenticate you when you sign in.
• —To deliver the alerts you subscribe to, in the channels you have enabled.
• —To take payment, manage your subscription and honour cancellations.
• —To provide support when you contact us.
• —To secure the service — detecting abuse, credential sharing and fraudulent payments.
• —To meet our legal, tax and accounting obligations.

When spoken alerts are enabled, the text of an alert — for example “large buy absorption on ES at 5,240” — is sent to a speech synthesis provider so it can be turned into audio. That text describes market activity and contains no personal information about you. Depending on configuration and availability, synthesis is performed by ElevenLabs or OpenAI, or entirely inside your own browser using its built-in speech engine, in which case nothing leaves your device. We do not send your name, email address or any account identifier to a speech provider.

Subscriptions are billed through Stripe. Your card number, expiry and security code are entered directly with Stripe and are never transmitted to or stored on our servers — we receive only the result: whether a payment succeeded, the plan it applies to, and the billing period it covers. Stripe processes this information as an independent controller under its own privacy policy.

We share personal information only with the service providers that make the product work, and only to the extent each one needs:

• —Supabase — database, authentication and account storage.
• —Vercel — application hosting and delivery.
• —Stripe — subscription billing and payment processing.
• —ElevenLabs and OpenAI — speech synthesis for spoken alerts, limited to alert text as described above.
• —Google — only if you choose Google sign-in, and only for authentication.
• —Telegram — only if you connect it, and only to deliver your alerts.

We will also disclose information where we are legally required to, or where it is necessary to establish or defend a legal claim. If the business is ever sold or merged, your information may transfer to the acquirer, who would remain bound by this policy until you are notified otherwise.

We keep your account information for as long as your account exists. Alert history is retained for the window included in your plan. Payment and tax records are kept for as long as accounting and tax law requires, typically seven years, even after an account closes. Sign-in and administrative logs are kept for a limited period for security purposes. When you ask us to delete your account we remove your personal information except where we are legally required to retain it.

You can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, or delete it. You can withdraw consent for optional processing — such as Telegram delivery or spoken alerts — at any time in your settings, and you can cancel your subscription at any time without contacting us.

Depending on where you live you may have additional rights, including the right to object to processing, to request portability, or to complain to your local data protection authority. California residents have the right to know what is collected and to request deletion; we do not sell personal information, so there is nothing to opt out of. To exercise any right, email support@ordervanta.com. We respond within 30 days.

Data is encrypted in transit. Access to production data is restricted to the staff who need it, and administrative actions on accounts are logged. Passwords are stored only as salted hashes. No system is perfectly secure, and we cannot guarantee absolute security — if a breach ever affects your personal information, we will notify you and the relevant authority as required by law.

Order Vanta is operated from the United States and your information is processed there. If you use the service from outside the United States, you understand that your information will be transferred to and processed in a country whose data protection laws may differ from your own.

The service is not directed to anyone under 18 and we do not knowingly collect information from children. If you believe a child has given us personal information, contact support@ordervanta.com and we will delete it.

If we change how we handle personal information we will update this page and move the effective date at the top. Where the change is material we will also notify you by email before it takes effect.

See also our Terms of Service and Risk Disclosures.