1. Scope and operator
This policy applies to Vanta's Discord bot, dashboard, public website, partnership workflow, and review workflow. Vanta is independently operated. Discord separately controls information processed through its platform.
2. Information collected
Account and server information
- Discord user ID, display name, and avatar URL when you authenticate.
- Servers and permission data needed to determine administrative access.
- Channels, roles, server name, icon, and member count needed for configuration.
Operational information
- Moderation, Anti-Raid, community, ticket, role, language, and progression settings.
- Warnings, filters, incidents, ticket records, audit entries, XP, activity, and analytics.
- Partnership applications and review submissions, including Discord identity and submitted text.
- Limited technical logs and in-memory request data needed for security and rate limiting.
Do not submit secrets, sensitive personal data, private messages, or information you lack permission to share.
3. How information is used
- Provide, authenticate, secure, troubleshoot, and improve Vanta.
- Verify permissions, protect sessions, prevent abuse, and audit important changes.
- Review partnership applications and moderate reviews before publication.
- Comply with legal obligations and enforce Vanta's Terms.
Vanta does not sell personal information or use Service data for third-party behavioral advertising.
4. Discord OAuth and sessions
The dashboard requests Discord's identify and guilds scopes. OAuth access tokens are used during login and discarded. The browser receives an opaque random session token; the database stores only a keyed digest. Production cookies are HttpOnly, Secure, and SameSite, with a limited lifetime.
5. Sharing and providers
Information may be processed by Discord, cloud hosting, secure networking, and media providers only as needed to operate requested features. It may also be disclosed when required by law or reasonably necessary to protect users, rights, safety, or infrastructure. Vanta does not rent or sell data.
6. Retention and deletion
Information is kept as long as needed for the feature, security, auditability, disputes, and legal obligations. Removing Vanta does not guarantee immediate deletion of historical records. An authorized owner may request deletion or export through Vanta's official support channel.
7. Security
Controls include permission filtering, server-side sessions, keyed token digests, CSRF protection, secure cookies, host validation, strict headers, bounded inputs, rate limits, restricted secrets, and audit logging. No internet service can guarantee absolute security.
8. Your choices and rights
Depending on location, you may have rights to access, correct, export, restrict, object to, or delete personal information. You can sign out, revoke OAuth through Discord, avoid submissions, or make a verified request through Vanta support.
9. Children
Vanta is not directed to anyone below Discord's minimum age in their country. Do not use Vanta if you are not permitted to use Discord.
10. Changes and contact
This policy may change as Vanta evolves. The effective date will be updated for material revisions. Contact Vanta through its official Discord support channel for privacy questions or verified requests.