This policy explains how Peko Prospects LLC (“we,” “us”), the company behind VANE it, handles personal information. It covers our website vaneit.com, the app, and the vanes and surveys our customers put on their own websites.
1. Who is responsible for what
There are two kinds of people, and our role is different for each.
- Customers create an account and build vanes and surveys. For customer accounts, the waitlist, messages you send us and billing, we are the controller: we decide how that information is used.
- Visitors answer vanes and surveys on a customer’s website or at a vaneit.com link. For those answers, the customer who runs the vane is the controller and we process the answers on the customer’s behalf under our Data Processing Addendum. The customer’s own privacy notice explains how they use your answers. The one exception is the small amount of security and abuse-prevention processing described in section 3, which we do for ourselves.
2. What we collect from customers
| What | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Email address | Passwordless sign-in, service messages, support | Contract |
| What you create: questions, options, images, logos, brand settings | To run your vanes and surveys | Contract |
| Plan, plan requests and usage | To give you what your plan includes | Contract |
| Messages you send us (contact form, email) | To reply | Legitimate interests (answering you) |
| Billing details, when billing launches | Payment is handled by Stripe; we never see or store card numbers | Contract; legal obligation for tax records |
| Technical and security logs (see section 3) | To keep the service secure | Legitimate interests (security) |
We also keep a record of which version of our Terms you accepted and when.
3. What is collected when you answer a vane or survey
When you answer, we record your answer (a choice, a number, a slider position, a tap position, a ranking, or text you type), which vane or survey it belongs to, and the time. We do not ask for your name or email, and we do not require an account.
Please do not type personal details into a free-text answer. Free-text answers can identify you if you include identifying details, and on some formats they are shown publicly on the page.
We also process, for security and to prevent abuse (our own legitimate interests):
- A one-way pseudonym of your IP address. Your IP address is turned into a keyed hash using a secret that changes every day, used only to stop repeated or automated answers, and deleted within 24 hours. We never store the IP address itself in our database.
- Standard connection data (such as IP address and browser type) that our hosting provider Cloudflare processes to deliver and protect the website.
- The address of the website where a vane first appears, so the customer can see where their vane is installed.
- Which platform you choose if you use a share button.
Your browser keeps a small note that you answered a particular vane, so the vane shows you the results instead of asking again. Details are on our cookie and storage page.
4. The waitlist
If you join our waitlist we store your email address, that you ticked the consent box and when, and the page you signed up from. We use it to tell you when VANE it opens and, occasionally, share notable news. Our basis is your consent, which you can withdraw at any time by using the unsubscribe link in any email or emailing contact@vaneit.com. We do not sell or share waitlist addresses.
5. What we do not do
- We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months.
- We do not put advertising trackers or third-party cookies in vanes.
- We do not intentionally collect sensitive personal information, and our Acceptable Use Policy forbids customers from asking for it.
- We do not make decisions about people by automated means that have legal or similarly significant effects. Our word filter only hides answers that contain listed words.
6. Who we share it with
Only service providers that help us run VANE it, under contracts that protect your information. The current list, with what each does and where, is on our Subprocessors page. In short: Supabase (database, sign-in, file storage), Cloudflare (hosting, delivery, security, privacy-friendly web analytics) and, when billing launches, Stripe (payments). We may also disclose information if the law requires it, to protect people’s safety, or as part of a sale or merger of our business (in which case this policy continues to apply).
7. International transfers
We are based in the United States. Our database, which holds accounts, vanes, answers and survey responses, is stored in Canada (Montreal). Our other providers may process data in the US and other countries. For personal data from the EU, UK or Switzerland we rely on the EU-US Data Privacy Framework (and its UK Extension and Swiss framework) where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses with the UK Addendum. Contact us for a copy of the relevant safeguards.
8. How long we keep it
| Information | Kept for |
|---|---|
| Customer account and content | While the account is open. After you close it, 30 days to export, then deleted |
| Deleted vanes and surveys, with their answers | 30 days under Recently deleted (so you can restore them), then deleted |
| Answers to vanes and surveys | Until the customer deletes the vane or survey, or their account closes (then as above) |
| IP pseudonyms for abuse prevention | Under 24 hours |
| Messages to us and plan requests | 24 months |
| Waitlist | Until 12 months after we launch, or until you unsubscribe, whichever is first |
| Billing records (when billing launches) | 7 years, as tax law requires |
| Backups | Encrypted backups are kept for a limited period and expire on a rolling basis |
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict some processing, and to withdraw consent. You will not be treated differently for using these rights.
- Customers: you can export everything from your account (Account → Data & support → Download all my data), edit or delete your content yourself, or email contact@vaneit.com from your account’s address.
- Visitors: your answers belong to the customer who runs the vane, so please contact them first. If you contact us, we will pass your request to that customer within 5 business days and help them answer it. Because answers are not linked to your name, we may need details such as the page, the vane and roughly when you answered to find them.
- We answer within one month (GDPR and UK GDPR) or 45 days (US state laws), and we will tell you if we need more time. We verify requests by replying to the email address on the account, or by asking for details only the person who answered would know. You can use an authorized agent with your signed permission.
- Complaints: if you are in the EU or UK you can complain to your local data protection authority (in the UK, the Information Commissioner’s Office). We would appreciate the chance to help first.
10. California and other US states
This section gives the information required by the California Consumer Privacy Act (as amended) and similar state laws. In the past 12 months we have collected: identifiers (email address, IP address pseudonym); commercial information (plan and requests); internet activity (answers, share choices, pages where vanes load); and user-generated content (text and images you add). Sources: you, your browser, and our customers. We use them for the purposes in sections 2 to 4 and disclose them only to the service providers on our Subprocessors page, for business purposes. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the information of anyone under 16. We do not use sensitive personal information to infer characteristics about anyone.
Global Privacy Control and Do Not Track. We treat a Global Privacy Control signal as a request to opt out of sale and sharing (which we do not do anyway). We do not track people across other websites, so there is nothing further for a Do Not Track signal to switch off.
Residents of other US states with privacy laws (such as Virginia, Colorado, Connecticut, Oregon and Texas) have similar rights; use the same contact details.
11. Security
We protect information with encryption in transit, database access rules that keep each customer’s data separate, limited staff access, and regular encrypted backups. More detail is on our Security page. If a breach affects your information, we will notify you and the relevant authorities as the law requires.
12. Children
VANE it is not for children. Accounts are for adults (18+). Customers may not use vanes on sites or pages directed to children under 13 (under 16 in the EU and UK) or where they know respondents are children. We do not knowingly collect personal information from children. If you believe a child has sent us information, email contact@vaneit.com and we will delete it.
13. Changes
We will post changes here and update the date above. For material changes we will tell customers by email or in the app before they apply.
14. Contact
Peko Prospects LLC · contact@vaneit.com (privacy, data requests and complaints)