Data Processing Addendum

Vantloop · operated by Victor Antai Studio · Template version 2026-11-09

Template — applies when referenced in an engagement contract. Every engagement contract generated on Vantloop references this addendum, and on that reference it forms part of that contract. It describes the platform as it actually operates; where practice changes, this page changes first.

1. Roles

For its own account, identity-verification and payment records, Vantloop is the controller of the personal data it holds. For the personal data a client and a talent bring into an engagement — the scope, the messages, the delivered work — the parties to the engagement are the source and the owners of that data, and Vantloop processes it to run the engagement and keep its record.

2. What is processed, and why

• Accounts: name, email address, role (client or talent), and the record of terms acceptance — to run the account.
• Identity verification: a government ID photo and a selfie — to check the person is who their profile says, and nothing else.
• Engagements: job records, timeline events, delivery links, messages between the parties, reviews and contracts — the engagement record itself.
• Money: payment amounts, currency and status, and withdrawal requests. Vantloop never takes or stores card numbers. A talent's payout bank name and account number are held so withdrawals can be paid, and are never emailed — anywhere in the platform they display as the bank name plus the last four digits only.
• Applications and briefs: what an applicant or a client writes in them — to assess and to match.

3. Sub-processors

• Cloudflare — hosting, the platform database, and domain email routing.
• Resend — delivery of account and engagement email. The connection is being completed; until it is live, Vantloop's email waits in the platform's own database outbox and no third party carries it.

This list is kept current on this page. Because this addendum is a template, always read the live version here before relying on the list.

4. Identity documents

ID photos and selfies are stored in the platform database and are readable only by the platform owner, through the admin review queue, over a response marked no-store so browsers do not cache them. When a verification is rejected, the documents are deleted — the decision record and its note remain. When a verification is approved, the documents stay attached to the verification record for audit and are never shown on any public surface.

5. Retention

Account and engagement records are kept while the account is open and afterwards as the engagement record — they are the evidence both parties rely on. Identity documents follow section 4. Queued email is held in the outbox until it is delivered.

6. Security

The measures in force are described on the security summary, which forms part of this addendum by reference: hashed credentials, hash-only tokens and codes, the session model, document access control, and the payment holding model.

7. Breach notification

If we become aware of a breach affecting personal data processed under an engagement, we will notify the affected parties without undue delay — and in any case within 72 hours of becoming aware of it — saying what happened, what data was involved, and what is being done about it. Notification goes to the account email addresses on record.

8. Requests from the people the data is about

Write to hello@victorantai.com for access, correction or deletion of the data Vantloop controls; we act on it and confirm in writing. Where the data belongs to an engagement and the other party is its controller, we pass the request to them and say that we have.

9. Transfers

Cloudflare operates a global network, so data processed on Vantloop may be processed outside the country of either party. That is stated plainly here rather than implied.