Updated 2 October 2026

Your information at Vantelleo

SanitiQ Mechanics UG (haftungsbeschränkt), Sudermannstraße 8, 60431 Frankfurt am Main, Germany, operates Vantelleo. Contact admin@vantelleo.com about your account or personal information.

Which experience are you using?

The public design preview runs its demo conversation locally in your browser. That demo text is not sent to an AI provider or saved by Vantelleo; refreshing or closing it discards the demo. Cloudflare still processes the connection information needed to deliver and protect the page. The public preview has no accounts, uploads or payments.

The account platform is a separate experience. The following sections describe account access and the features available in your workspace. A feature being described here does not mean it is enabled for your account. Private testing does not open public checkout.

What we use and why

We use your sign-in identity, email and workspace membership to protect your account. Your conversations, supplied business details, photographs, saved versions and generated materials let us prepare and maintain the work you request. Order, subscription, billing-address, tax-status and approval records let us provide the purchased service, issue invoices and handle changes or cancellations. These activities generally support our contract with you or steps you request before a contract (Article 6(1)(b) GDPR). Where you represent a business, our legitimate interest in administering that relationship may apply instead (Article 6(1)(f)).

We process required accounting and tax evidence to meet legal obligations (Article 6(1)(c)). Technical requests, limited security records, rate-limit identifiers and delivery outcomes help us protect accounts, prevent abuse and investigate failures (Article 6(1)(f)). Optional consent-based activities require a separate choice; creating an account does not subscribe you to marketing.

AI and your materials

When AI creation or editing is available, the relevant brief, saved draft and conversation context are sent to our configured AI provider, OpenAI. Do not include passwords, payment-card details, identity documents, confidential records you are not authorised to share, or sensitive personal information that is unnecessary for your website.

The decorative-image workflow sends an authored visual description selected from the project type, sector and colour. It does not send the customer's conversation or original photographs. Generated illustrations are labelled; they are not evidence of your actual premises, products, staff or customers. Review factual statements and image rights before publication.

OpenAI states that API inputs and outputs are not used for model training by default unless data sharing is explicitly enabled. This does not mean that requests have zero retention. See OpenAI's API data controls. Vantelleo's conversation requests set store:false; this does not remove all provider security or abuse-monitoring retention.

Services involved

• Cloudflare hosts the application, private files and database, protects requests, processes images and sends transactional notifications when enabled. The configured primary application database and file buckets use EU jurisdiction; this is not a promise that all network, support or security processing stays in the EU. Cloudflare processing terms.
• Auth0 provides sign-in. Choosing Google sign-in also involves Google for that authentication. Vantelleo receives identity information rather than your Google password; the sign-in connection does not request access to your Gmail or Drive. Auth0 privacy information.
• Stripe handles checkout, payment methods, subscriptions, invoices and applicable tax calculations. Card details are entered on Stripe's pages, not into Vantelleo's conversation. We receive billing references and payment outcomes. Stripe also acts for its own purposes where described in its Privacy Center.
• Google Workspace handles messages sent to our company inbox. Google's processing terms.

Some providers or their subprocessors may process information outside the EEA. Provider processing terms describe their international-transfer arrangements, including standard contractual clauses where applicable. Selecting an EU database location does not cover every provider operation. Contact us for information about the providers and safeguards relevant to your account.

Private drafts and public websites

Your workspace drafts and downloads require account access. Publishing a website makes its approved content available to visitors. Do not publish personal contact details or photographs without an appropriate basis. Material downloaded or copied by visitors cannot necessarily be recalled when a website is taken offline.

If you operate a website using Vantelleo's enquiry, booking or contact-management tools, you determine why your visitors' information is collected. Your own privacy notice and appropriate processing agreement are needed. Enabling a form requires its business identity, privacy notice and retention setting. This notice does not replace your notice to your visitors.

Retention and deletion

We keep account content while it is needed to provide your workspace, maintain purchased services and preserve the saved work you have asked us to keep. Stopping a subscription is different from requesting deletion: it does not immediately erase the account or purchased materials. To request deletion, use “Delete my account” in account support or email admin@vantelleo.com. Deletion requests are reviewed by a person; the current service does not promise instant or automatic whole-account erasure.

During that review we identify the affected account, shared-workspace ownership, active services and any information that must be retained. Unneeded material is removed; restricted records may remain where necessary for accounting obligations, a dispute or establishing, exercising or defending legal claims. We explain applicable exceptions in the response. An unresolved legal obligation is not a reason to keep all project photographs or conversation content indefinitely.

Unused price reviews that have not been linked to a customer or order are eligible for scheduled removal seven days after expiry. Enquiry, booking and contact records use the website operator's configured retention period, within the application's 1–365-day limits; booking retention runs from the appointment end. Expired sessions and temporary verification records are removed by scheduled maintenance. Operational failures can delay a cleanup and require recovery.

Security, support and delivery records are assessed according to the purpose of the record, unresolved incidents and whether a contract or claim still requires evidence. The current platform does not apply a universal automatic expiry to every audit or purchase-confirmation record. A deletion request therefore includes these records in the review rather than assuming they have disappeared.

The primary production database currently has a 30-day recovery window. A deleted record can remain within that recovery history until it expires; a restoration must reapply completed deletion requests. This is not a promise that independent provider logs or accounting records have the same retention period. Provider records are also governed by the relevant provider terms and applicable duties.

Cookies and similar storage

Vantelleo uses secure session and sign-in state cookies to keep account access working. Identity, security and payment providers may use their own necessary technologies on their pages. The current application does not include advertising pixels or audience analytics. Any future optional tracking requires its own notice and appropriate consent before activation.

Your choices and rights

Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. You may withdraw consent for consent-based processing without changing its prior lawfulness. Contact admin@vantelleo.com; we may need proportionate evidence that the request concerns your account. You may complain to a competent data-protection supervisory authority, including the authority in your place of residence or the Hessian authority.

Providing necessary identity and billing details is required to supply an account and purchased service. Optional details can be omitted, although the resulting materials may be less complete. Automated draft generation and security controls are used; Vantelleo does not describe generated suggestions as verified professional advice. Contact us to challenge an account or payment restriction rather than resubmitting sensitive information.