Privacy Policy

Vanta Labs Research is operated by Vanta Innovation LLC ("we" and "us"). This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

Information you provide at checkout and when contacting us (name, email, shipping address, order details), your mobile number if you choose to give it to us for text messages, and limited technical data such as device type, pages viewed, and referring website.

When analytics runs (see below: in the United States unless you opt out, elsewhere only if you accept), we also generate a random visitor and session identifier stored in your browser, and record any campaign parameters present in the link you arrived through (for example utm_source, utm_medium, utm_campaign, or a click identifier appended by an advertising platform). These are used to understand which marketing efforts lead to orders. They are not linked to your name or email except through an order you actually place.

How we use it

To process and fulfill orders, verify payments, provide support, send transactional messages, prevent fraud, measure how the site and our marketing perform, and comply with legal obligations. We do not sell your personal information for money. Some of the advertising technologies described below can count as a "sale" or "sharing" of personal information under certain US state privacy laws, and you can opt out of that at any time on Your Privacy Choices (https://www.vantalabsresearch.com/legal/privacy-choices).

Analytics and advertising technologies

No advertising or analytics platform receives your phone number. None of the platforms described below — TikTok, Snap, Reddit, Meta, Google or Vercel — is sent your mobile phone number in any form, hashed or otherwise, or anything about whether you signed up for text messages. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Where you are decides whether you are asked first. We work this out from the country your connection comes from, as reported by our hosting provider.

In the United States there is no cookie banner. Our analytics and the advertising technologies described below load when you visit, without being asked. You can opt out at any time on Your Privacy Choices (https://www.vantalabsresearch.com/legal/privacy-choices): that turns off our analytics and the TikTok, Snap, Reddit and Meta pixels in your browser, switches Google's tag to restricted data processing with every storage permission denied, and stops us reporting your orders to any advertising platform. If your browser sends a Global Privacy Control signal, we treat it as that same opt-out automatically, wherever you are.

Outside the United States, including Canada, a cookie banner asks first. Analytics is off until you accept it. If you decline, no analytics identifiers are created and no analytics events are sent.

When analytics runs — in the United States unless you opt out, elsewhere once you accept — six things run: our own first-party analytics, which records page views and store events to our own database; Vercel Analytics, a privacy-focused measurement service provided by our hosting provider; Google Analytics, described below; the TikTok Pixel; the Snap Pixel; and the Reddit Pixel. Two more — the Meta Pixel and the Google Ads tag — are present whether or not you accept the banner, and each is described in its own section below so that nothing here overstates what declining does.

The TikTok Pixel. We advertise on TikTok, and the pixel is how we measure whether those adverts work. It loads on our pages — in the United States unless you opt out, elsewhere once you accept cookies — and sends TikTok your page views along with the technical data any web request carries — IP address, browser and device type, referring page — and an identifier TikTok stores in your browser. TikTok uses this to report advert performance to us and, in line with its own privacy policy, for its own purposes including advert targeting.

It also reports shopping actions: which product pages you view, when you add an item to the cart, when you begin checkout, and when an order is paid. For those events it receives the product identifier, quantity, price, the order value and the currency. It does not receive your name, your address, or the contents of any message you send us.

One identifier, on one page. When an order is confirmed as paid, we send TikTok a one-way SHA-256 hash of the email address used for that order. The hash is generated on our server, so your actual address is never handed to code running in your browser and never reaches TikTok. Its purpose is to let TikTok match the purchase to the advert that led to it. A hash cannot be reversed back into an email address, though anyone already holding the same address could confirm a match — so treat it as pseudonymous rather than anonymous. This happens only on a paid order, and only when the TikTok Pixel is permitted to run for you as described above. You can ask us to stop it at any time using the contact details above.

The Snap Pixel. We also advertise on Snapchat, and this pixel does the same job for those adverts. It loads on the same terms as the TikTok Pixel, and it sends Snap the same shape of information: your page views, the technical data any web request carries, an identifier Snap stores in your browser, and the same shopping actions — product viewed, added to cart, checkout begun, order paid — with the product identifier, quantity, price, order value and currency. Snap uses this to report advert performance to us and, in line with its own privacy policy, for its own purposes including advert targeting.

Snap is treated exactly as TikTok is on the point that matters most: your raw email address is never sent, and your phone number is not sent in any form. On a paid order — and only then — Snap receives a one-way SHA-256 hash of the email address used for that order, generated on our server, so the actual address is never handed to code running in your browser and never reaches Snap. Snapchat's own setup instructions offer a field for the plain address; we do not use it, and our code refuses to send anything that is not already a hash. Everything in the paragraph above about what a hash is and is not applies here in the same way.

We do not send Snap your age or your location. The pixel is initialised with our advertising account's public identifier and nothing about you.

The Reddit Pixel. We also advertise on Reddit. This pixel is narrower than the other two: it loads on the same terms as the TikTok Pixel, and it reports your page views together with the technical data any web request carries — IP address, browser and device type, referring page — and an identifier Reddit stores in your browser. Reddit uses this to report advert performance to us and, in line with its own privacy policy, for its own purposes including advert targeting.

It reports shopping actions too: which product pages you view, when you add an item to the cart, and when an order is paid. For those it receives the product identifier, the quantity, the value and the currency. It does not receive your name, your address, or the contents of any message you send us. One difference from the other two: we do not tell Reddit when you begin checkout, only when an order completes.

If you are signed in, Reddit also receives a hash. Reddit calls this Advanced Matching, and it is how it links a visit to an advert you saw. When you are signed in to an account and the Reddit Pixel is permitted to run for you, we send Reddit a one-way SHA-256 hash of your email address and a second hash of your internal account number. Both are generated on our server, so your actual address is never handed to code running in your browser and never reaches Reddit. Reddit's own setup instructions offer a field for the plain address and will hash it in your browser instead; we do not use it, and the hash we send is identical either way. Signed out, or browsing as a guest, nothing identifying you is sent at all.

A hash cannot be reversed back into an email address, though anyone already holding the same address could confirm a match — so treat it as pseudonymous rather than anonymous. This is the same treatment TikTok and Snap already receive, with one difference worth stating plainly: for those two it happens only on a paid order, whereas Reddit receives it on page views while you are signed in. You can stop it at any time by opting out on Your Privacy Choices (https://www.vantalabsresearch.com/legal/privacy-choices), by declining cookies outside the United States, by signing out, or by asking us using the contact details above.

If you opt out, if your browser sends Global Privacy Control, or if you decline cookies outside the United States, none of these three pixels are loaded at all. No request is made to TikTok, Snap or Reddit, no identifier is set, and none of the three receives anything about your visit.

The Meta Pixel is present on every page unless you opt out. We advertise on Facebook and Instagram, which Meta operates. Outside the United States it does not wait for your choice on the cookie banner, and declining the banner does not stop it; we are telling you this plainly rather than describing it as held back, because it is not. Opting out on Your Privacy Choices, or a Global Privacy Control signal, does stop it, wherever you are. On every page it sends Meta your page views together with the technical data any web request carries — IP address, browser and device type, referring page — and it sets an identifier in your browser that Meta uses to recognise the same browser on later visits. It also reports the same shopping actions as TikTok and Snap — product viewed, added to cart, checkout begun, order paid — with the product identifier, quantity, price, order value and currency. Meta uses this to report advert performance to us and, in line with its own privacy policy, for its own purposes including advert targeting.

Meta receives a hash of who you are. While you are signed in, the pixel is initialised with a one-way SHA-256 hash of your email address and a second hash of your internal account number, generated on our server so your actual address is never handed to code running in your browser. When an order is confirmed as paid, our server also reports the purchase to Meta directly and includes one-way SHA-256 hashes of the email address, first and last name, city, state, postal code and country used for that order (never your phone number), together with the browser identifiers Meta's own pixel set. Meta uses these to match the visit or the purchase to an advert you saw, including on another device. Meta's own setup instructions offer a field for the plain email address, to be hashed in your browser; we do not use it, and our code refuses to place anything that is not already a hash in that position. Everything said above about what a hash is and is not applies here in the same way. Our server also repeats the product views, cart additions and checkouts your browser has already reported, under the same event identifier, so Meta counts each once.

How to stop it. Opt out on Your Privacy Choices (https://www.vantalabsresearch.com/legal/privacy-choices), or use a browser that sends Global Privacy Control: the Meta Pixel is then not loaded, and we do not report your orders to Meta. Declining the cookie banner outside the United States does not stop it. You can also block it with a content-blocking browser extension, use Meta's own advertising controls in your Facebook or Instagram settings, or ask us to stop matching your details using the contact details above.

Customer.io, our email and SMS service provider, runs no script on this website. Customer.io sends our email — order confirmations, shipping and delivery updates, refunds, account and password messages, and the marketing email you agree to receive — and will deliver the text messages you opt in to, through Twilio as the carrier. Nothing from Customer.io loads in your browser: it sets no cookie, places no identifier and sees none of your page views. Everything it knows about you is sent by our server, as described next.

What our server sends Customer.io. Our server sends Customer.io your email address and first name; the content of each message it delivers to you, which for an order includes the products, amounts, shipping details and the name and address on that order; how many orders you have placed, the total you have spent and the dates of your first and most recent order; whether you have confirmed that you are 21 or over and buying for research use; your marketing consent status for email and for SMS, with the date, time and place each was given or withdrawn; and your mobile number, only while you hold a live SMS marketing consent. It also receives the events that trigger a message — an order placed, paid, shipped or delivered, a cart left behind, a sign-up — so that the right message goes out at the right time and stops once you unsubscribe. Customer.io processes what it receives on our behalf, in line with its own privacy policy, and does not use it for its own marketing. Resend, our previous email provider, remains configured as a backup and receives nothing while Customer.io is in use.

How to stop Customer.io. Customer.io is not an advertising platform but our service provider, acting on our behalf and under our instructions, so there is no script to block and no cookie to decline. Unsubscribing from our marketing email, or replying STOP to a text message, stops those messages; you can also untick the marketing boxes in your account settings, or ask us to stop sharing your details using the contact details above. Order confirmations, shipping updates and account security messages are not marketing and continue to be sent for every order.

The Google Ads tag works differently, and this is the one place our answer is not "nothing loads". We also advertise on Google, and Google's tag (gtag.js) is present on every page. What your choices control is not whether it loads but what it is permitted to do, using Google's consent mode.

Outside the United States before you accept, and permanently if you decline — and for anyone who opts out or whose browser sends Global Privacy Control — every storage permission is set to denied. For anyone who opts out or sends Global Privacy Control we also switch on Google's restricted data processing, Google's own setting for US state privacy laws. No advertising cookie is written. No identifier is stored in your browser or sent to Google. Nothing is shared for ads personalisation. What Google does receive is a single cookieless signal that a page was viewed, carrying the technical data any web request carries — IP address, browser and device type, referring page — with nothing tying it to you, to your other visits, or to any advert. We are telling you this plainly rather than describing the tag as switched off, because it is not.

In the United States unless you opt out, and elsewhere if you accept, those permissions are granted: Google may then store an identifier in your browser and use your page views and the shopping actions below to report advert performance to us, to build the remarketing audiences our adverts are shown to and, in line with its own privacy policy, for its own purposes. If you later opt out or change your mind, the permissions are set back to denied straight away, in every tab.

The shopping actions we report to Google. When you view a product, add an item to your cart and begin checkout, the tag reports the product identifier, name, category, quantity, price and value — the same shopping actions the other advertising platforms above receive. When an order is paid, the tag reports the amount paid, the currency, and a reference for the order — so that we can tell which adverts lead to sales. The order reference is there so that the same purchase is never counted twice if you reopen or forward your confirmation link — it identifies the order, not you. These reports are sent at any consent setting: where storage permissions are denied, they go as the same cookieless signal described above, with no advertising cookie and no identifier. Nothing identifying you is sent at any consent setting. Google's own setup offers a field for your email address, under the name Enhanced Conversions; we do not use it, so Google receives neither a plain address nor a hash of one.

The same tag also reports to Google Merchant Center, the Google service that lists our products in its shopping results, under the same consent settings described above: it receives the pages you view, cookieless and with no identifier unless storage permissions are granted as described above, so that we can tell how often a visit from one of those listings ends on an order confirmation page. It is not sent the shopping actions or the purchase report above, and it is told nothing beyond which pages were viewed.

Google Analytics. We use Google Analytics to understand how the store is used: which pages are visited, how visitors move between them, and which products they look at. It runs on the same terms as our other analytics — in the United States unless you opt out, elsewhere only once you accept — and through the Google tag described above rather than a second script. It receives your page views together with the technical data any web request carries, an identifier Google stores in your browser, and how far you scroll and which links to other sites you follow. It also receives the shopping actions: product lists and product pages viewed, searches made on the store, items added to the cart, checkout begun and orders paid, with the product identifier, name, size, price and quantity, and for an order its reference, value and currency. It is never sent your name, email address, phone number or postal address. We have switched off Google signals and ads personalisation for it, so what Google Analytics records is not used to build advertising audiences. If you opt out, your browser sends Global Privacy Control, or you decline the banner outside the United States, it is not started and receives nothing.

We do not run any advertising or marketing tracking technology beyond those named above. If we add one, this policy and our Cookie Policy will be updated to name the platform, the data shared and the purpose before it is switched on — as they were for the Google tag, the Meta Pixel and Google Analytics above.

Sharing

Only with service providers that help us operate — payment processing, email and SMS delivery (Customer.io, which delivers text messages through Twilio; Resend is kept configured as a backup email provider), hosting, analytics and shipping — as needed to run the store, or as required by law.

A service provider is not a third party we share you with. The companies named above process data *on our behalf and under our instructions*, to do a job we have asked them to do — take a payment, deliver a message, host a page. They are not permitted to use your information for their own purposes or to market to you themselves. That is a different thing from selling or sharing your information with someone else so that *they* can market to you, which we do not do.

Text messaging opt-in data and consent are never shared with third parties. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties. We do not sell, rent or trade your mobile phone number or your SMS opt-in consent, under any circumstance. The only companies that receive your number are Customer.io, as the service provider that sends the messages you asked us to send on our behalf and under our instructions, and Twilio, the carrier it delivers them through.

Data retention & security

We retain order records as required for accounting and legal purposes and use reasonable safeguards to protect your information.

SMS / text messaging

If you choose to receive text messages from Vanta Labs, you do so by entering your mobile number and actively ticking a consent box that is never pre-ticked. You can do this on our public sign-up page at https://www.vantalabsresearch.com/sms, at the checkout, when you create an account, in your account settings, or in the text-list sign-up shown on our shop, product and cart pages. You must be 21 or older to sign up: the /sms page asks for your date of birth, every other sign-up asks you to confirm that you are 21 or older before your number is recorded, and account holders confirmed it when they created their account. SMS consent is optional and separate from every other agreement on the page. Consent is not a condition of any purchase. It is not a condition of creating an account or of using this website either. Giving us a phone number on its own — at the checkout, for an order, or for delivery — is not SMS consent and never enrols you in marketing messages.

What we send. Recurring automated marketing text messages from Vanta Labs: promotional offers, product updates and subscriber-only promotions. Message frequency varies. Message and data rates may apply.

Who delivers them, and where your number goes. Our text messages are sent through Customer.io, our email and SMS service provider, which delivers them through Twilio as the carrier. Customer.io receives your mobile number and your SMS consent record only once you have opted in, and only in order to deliver the messages you agreed to on our behalf. A number given at checkout or for an order is not SMS consent and is not used for marketing texts. Text messaging originator opt-in data and consent will not be shared with any third parties, and will never be sold.

Opting out. Reply STOP to any message to cancel at any time, or untick the SMS box in your account settings. Reply HELP for help, or contact support@vantalabsresearch.com. We record the date and time you gave and withdrew consent, and pass the withdrawal to Customer.io, so no further marketing texts are sent.

Your choices

You may request access to, correction of, or deletion of your personal information, and can unsubscribe from marketing emails or text messages anytime. Contact support@vantalabsresearch.com. You can opt out of the sale or sharing of your personal information for advertising at any time on Your Privacy Choices (https://www.vantalabsresearch.com/legal/privacy-choices), and we honour Global Privacy Control as the same opt-out.