Privacy Policy

The data controller is Vanta Peru S.A.C., operator of Vanta Pass, based in Arequipa, Peru. Privacy requests may be sent to privacidad@vantaperu.com.

Depending on how you use the service, we may collect:

• Account and contact data: name, email, phone, city, encrypted password, birth date when needed for benefits or verification, and communication preferences.
• Affiliated business data: business name, category, address, Google Maps links, benefits, logos, colors, authorized users, and operational settings.
• VantaCard and Wallet data: member identifier, card serial, pass status, available benefits, redemption history, scan events, and permitted transactional or promotional messages.
• Technical data: IP address, device or installation identifiers, push tokens, security logs, access timestamps, pages used, and error logs.
• Location data: approximate or precise location only when enabled by the user, and business location data used for nearby benefits, maps, or geofencing.

We collect data when a person creates an account, requests or saves a VantaCard, completes forms, logs in, scans or redeems benefits, allows notifications or location access, uses the portal, or contacts Vanta. We also receive business data when affiliated businesses configure locations, benefits, campaigns, or authorized users.

We use personal data to:

• Create, authenticate, and manage member, business, staff, and administrator accounts.
• Issue, recover, and update VantaCards in Apple Wallet or Google Wallet.
• Show benefits, nearby locations, maps, member QR codes, and redemption status.
• Validate scans, record redemptions, prevent fraud, and protect the service.
• Send transactional messages about access, verification, redemptions, card updates, or security.
• Send service-related campaigns or promotional notifications when permitted and relevant to Vanta or an affiliated business.
• Provide support, improve operations, maintain security, and comply with legal obligations.

Push notifications and Wallet pass updates may be used for card updates, benefits, redemptions, security, and permitted campaigns. Users can control notifications from iOS, Apple Wallet, or the relevant operating system settings.

Location, when enabled, is used to show nearby benefits and improve redemption experiences. Vanta Pass does not use precise location for third-party advertising or to track users across third-party apps or websites.

We do not sell personal data. We share data only as needed to operate the service, comply with law, or protect users and affiliated businesses.

• Affiliated businesses: receive information needed to operate benefits, validate redemptions, administer campaigns, and support members.
• Technical providers: hosting, database, email, operational analytics, push notifications, maps, security, and support providers may process data for Vanta.
• Wallet and platform providers: Apple, Google, or related platforms may process data needed to issue, update, or display passes according to their own policies.
• Authorities or authorized third parties: when required by law, valid order, audit, legal defense, or fraud prevention.

Providers processing data for us must apply protections compatible with this policy and applicable requirements.

Vanta Pass does not sell personal data and does not use app data to track users across third-party apps or websites for advertising. If we later add technology that Apple considers tracking, we will request consent through App Tracking Transparency and update this policy and App Store privacy disclosures.

While an account is active, we retain the data needed to operate the card, benefits, redemptions, security, and support. When account deletion starts, access is disabled immediately. Wallet cleanup normally completes after the 24-hour Apple pass-invalidation period and may take longer while Apple or Google Wallet is unavailable.

Identity data held only for that cleanup is then erased. A non-identifying deletion-job record is kept for up to 30 days for retry and audit purposes. Complaint Book records and other records required by Peruvian law are independent statutory records and may be retained for the applicable legal period.

We use reasonable technical and organizational measures, including access controls, password hashing, role separation, activity records, secret protection, and operational monitoring. No system is completely risk-free, but we work to reduce unauthorized access, loss, alteration, and disclosure.

Members can permanently delete their account from the VantaCard member area. You may also request access, correction, cancellation, opposition, information about processing, or account deletion by writing to privacidad@vantaperu.com. We may request reasonable information to verify identity before completing a request.

Deletion disables the account and revokes app sessions immediately. Google Wallet is marked inactive. An Apple Wallet pass is invalidated and its server data is later removed, but the inactive visual card may remain on the device until the user removes it from Apple Wallet.

Vanta Pass is not directed to children under 13 and does not knowingly collect data from children under 13. If we learn that such data was collected without valid authorization, we will take reasonable steps to delete it.

Some technology providers may process or host data outside Peru. In those cases, we use providers with contractual, technical, and organizational safeguards intended to protect information according to this policy.

We may update this policy to reflect legal, technical, or operational changes. The current version will remain available on this page with its update date. Material changes may be communicated through reasonable service channels.