Vantaj
Cargo that takes its story with it
Vantaj is operated by Blockworm Ltd, a company registered in England and Wales. We are registered with the UK Information Commissioner's Office (ICO) as a data controller.
This policy explains what personal data we collect, how we use it, and your rights under UK GDPR and the Data Protection Act 2018.
Data controller: Blockworm Ltd
Contact: guy@vantaj.uk
Website: vantaj.uk
When you create an account, we collect your email address. We use a magic link system – no password is stored. We store a session token in a cookie on your device to keep you logged in.
When you or your volunteers log items using Vantaj, we collect:
This data is associated with your batch and account. Volunteers who scan QR codes without an account do not have a Vantaj account, but their scan activity (including IP-derived location) is logged against the relevant batch record.
Our web server logs standard access information including IP addresses, request timestamps, and URLs accessed. These logs are retained for 14 days and are not shared with third parties.
| Purpose | Legal basis |
|---|---|
| Providing the Vantaj service – storing and displaying your batch records | Contract (performance of service) |
| Sending magic link login emails | Contract (necessary to provide access) |
| IP-based geolocation on scans | Legitimate interests (shipment tracking) |
| Monitoring service health and diagnosing errors | Legitimate interests (maintaining the service) |
| Communicating with you about your account or the service | Contract / Legitimate interests |
Your data is stored on servers located in the United Kingdom (DigitalOcean London region). Backups are stored with Cloudflare R2. All data is transmitted over HTTPS.
We take reasonable technical and organisational measures to protect your data, including access controls, encrypted connections, and regular backups. However, no system is completely secure, and we cannot guarantee absolute security.
| Processor | Purpose | Location |
|---|---|---|
| DigitalOcean | Hosting and primary data storage | UK (London) |
| Cloudflare R2 | Encrypted backups | EU |
| Resend | Transactional email (magic links) | US – UK SCCs in place |
We do not sell your data to third parties or use it for advertising purposes.
We retain your account data and batch records for the duration of your account plus 12 months. If you request deletion of your account, we will delete your personal data within 30 days, subject to any legal obligations to retain records.
Anonymised or aggregated data (such as usage statistics with no personally identifying information) may be retained indefinitely.
Under UK GDPR, you have the right to:
To exercise any of these rights, email guy@vantaj.uk. We will respond within 30 days.
You also have the right to lodge a complaint with the ICO: ico.org.uk
Vantaj uses a single HttpOnly cookie (pb_auth) to maintain your login session. We also use browser local storage to remember recent records and preferences on your device. We do not use advertising or tracking cookies.
Vantaj is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children.
We may update this policy from time to time. We will notify registered users of significant changes by email. The “last updated” date at the top of this page will always reflect the most recent version.
For any privacy-related questions or requests: guy@vantaj.uk