Vanta Privacy Policy

1. Introduction & Scope

This Privacy Policy describes how Vanta ("Vanta," "the Extension," "we," "us," or "our") collects, uses, and protects information when you use our Google Chrome browser extension, available on the Chrome Web Store. Vanta is developed and operated by Halonex.

Vanta is a real-time phishing protection extension that works by cryptographically hashing the domain of every webpage you visit and comparing it against a server-side database of known phishing sites. If a match is found, the page is blocked before it can load — protecting you from credential theft, malware, and social engineering attacks.

By installing and using Vanta, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please uninstall the Extension immediately.

2. How Vanta Works

Understanding Vanta's technical operation is essential to understanding its privacy implications. Here is precisely what happens when you browse with Vanta enabled:

• Step 1 — Domain Extraction: When you navigate to a webpage, Vanta extracts the domain name from the URL. Only the domain is used — the full URL path, query parameters, fragments, and page content are never read or processed.
• Step 2 — On-Device Hashing: The extracted domain is converted into a cryptographic hash directly within your browser. This is a one-way transformation — the original domain cannot be reconstructed from the hash.
• Step 3 — Server Comparison: The hash is transmitted to Halonex's threat intelligence server over an encrypted connection. The server compares the hash against its database of known phishing domain hashes.
• Step 4 — Verdict: The server returns a simple safe/unsafe verdict. If the domain is flagged as a known phishing site, Vanta blocks the page and displays a warning. If safe, browsing continues normally with no interruption.

At no point does Halonex receive, reconstruct, or store the actual domain you visited. The server processes only opaque, irreversible hashes.

3. Information We Process

Vanta adheres to a strict data minimization philosophy. We categorize the information involved in the Extension's operation as follows:

• Domain Hashes (Transmitted): Cryptographic hashes of domain names are sent to our server for comparison against the phishing database. These hashes are processed in real-time and are not stored, logged, or associated with any user identifier on our servers.
• Threat Verdicts (Local): The safe/unsafe result returned by the server may be cached locally in your browser for a short period to avoid redundant lookups for the same domain during a browsing session.
• Extension Settings (Local): Your preferences (e.g., whether Vanta is enabled or disabled, whitelist entries) are stored locally in Chrome's extension storage and are never transmitted to our servers.

4. Information We Do Not Collect

We want to be explicit about the data we do not collect, access, or store:

• Browsing History: We do not record, store, or transmit the URLs you visit. Only an irreversible hash of the domain component is processed, and it is not retained on our servers.
• Page Content: Vanta does not read, scan, or analyze the content of any webpage you visit. We do not access text, images, forms, or any other on-page elements.
• Form Data & Credentials: We never intercept, read, or transmit any data you enter into web forms, including usernames, passwords, payment information, or personal details.
• Cookies & Session Data: Vanta does not access, read, or modify your browser cookies, session tokens, or authentication data for any website.
• Personal Identity Data: We do not collect your name, email address, physical address, phone number, or any other personally identifiable information.
• User Accounts: Vanta does not require registration, login, or any form of account creation.
• Tracking or Advertising Data: We do not use tracking pixels, fingerprinting, advertising identifiers, or any cross-site tracking technologies.
• Usage Analytics: We do not employ third-party analytics services or collect behavioral usage metrics.

5. How Your Information Is Used

All information processed by Vanta serves a single purpose: determining whether a domain you are navigating to is a known phishing threat. Specifically:

• Phishing Detection: Domain hashes are compared against our threat database in real-time. This is the sole function of the data transmission.
• Page Blocking: If a hash matches a known phishing domain, the Extension prevents the page from loading and displays a warning interstitial.
• Local Caching: Verdict results may be temporarily cached in your browser to optimize performance and reduce redundant server queries.

We do not use any processed information for marketing, profiling, advertising, selling to third parties, or any purpose beyond the real-time phishing protection described above.

6. Server Infrastructure & Data Handling

Transparency about our server-side operations is critical to earning your trust:

• Stateless Processing: Our threat intelligence server operates in a stateless manner. When a domain hash is received, it is compared against the database and a verdict is returned. The hash is then immediately discarded — it is never written to disk, logged, or stored in any form.
• No User Association: Domain hash requests are not associated with any user identifier, IP address, browser fingerprint, or session token. Our server has no concept of individual users.
• Encryption in Transit: All communications between the Vanta extension and our server are encrypted via TLS 1.3.
• Threat Database: Our phishing domain database consists exclusively of hashes of known malicious domains, sourced from reputable threat intelligence feeds and internal research. It does not contain any user data.

7. Third-Party Services

Vanta's interactions with external services are minimal and transparent:

• Halonex Threat Intelligence Server: The sole external service Vanta communicates with is our own threat intelligence server, operated by Halonex. Domain hashes are sent exclusively to this server. No third-party services receive any data from the Extension.
• Chrome Web Store: Distribution and updates of Vanta are handled through the Chrome Web Store, governed by Google's Privacy Policy.
• Chrome Extension APIs: Vanta uses Chrome's standard extension APIs (webNavigation, tabs, storage) to function. These APIs are sandboxed by Chrome and governed by Chrome's extension security model.

We do not integrate any third-party advertising networks, analytics platforms, social media SDKs, or data brokers.

8. Your Rights & Controls

You have full control over Vanta at all times. The following actions are available to you:

Because Vanta does not maintain any server-side user data, removing the Extension constitutes a complete and irreversible erasure of all information associated with your use of the service.

Under applicable data protection regulations including the GDPR and the CCPA, you have the right to access, correct, delete, and port your personal data. Given that Vanta does not collect or store personal data — either locally in identifiable form or on our servers — these rights are inherently satisfied.

9. Chrome Extension Permissions

Vanta requests only the Chrome permissions strictly necessary for its phishing protection functionality:

• webNavigation: Required to detect when you navigate to a new webpage so the domain can be extracted and hashed for phishing verification. Vanta does not use this permission to monitor or record your browsing history.
• tabs: Required to access the URL of the active tab for domain extraction and to display the blocking page when a phishing site is detected.
• storage: Required to persist your local settings (enable/disable state, whitelisted domains) and to cache threat verdicts for performance optimization.
• Host Permissions (all URLs): Required so Vanta can check domains across all websites you visit, not just a limited subset. This permission is used exclusively for domain hash extraction — Vanta does not read, modify, or inject content into any webpage.

Vanta does not request permissions for your bookmarks, downloads, history, cookies, geolocation, clipboard, or any other sensitive browser capabilities beyond what is listed above.

10. Children's Privacy

Vanta is not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. Since Vanta does not collect personal data, create user accounts, or require registration, there is no mechanism through which a child's data would be stored or processed.

If you believe a child has provided personal information through the Extension, please contact us and we will take immediate steps to investigate and address the concern.

11. Data Retention

Vanta's data retention posture is straightforward because we retain virtually no data:

• Server-Side: Domain hashes are processed in real-time and immediately discarded. No request data is written to disk, logged, or stored in any database. Retention period: zero.
• Client-Side: Locally cached threat verdicts and extension settings are stored in Chrome's extension storage for the duration of your use. This data is automatically deleted when you uninstall Vanta or clear extension data.

12. Chrome Web Store Compliance

In accordance with the Chrome Web Store Developer Program Policies and Google's User Data Policy, we provide the following declarations:

• Single Purpose: Vanta's sole purpose is real-time phishing protection via domain hash comparison.
• Data Usage: The only data transmitted is cryptographic domain hashes, used exclusively for phishing detection. No data is sold, shared with third parties, or used for purposes unrelated to the Extension's core functionality.
• Minimum Permissions: Vanta requests only the permissions necessary to perform domain-level phishing checks.
• No Remote Code: Vanta does not download or execute remote code. All logic runs locally within the extension package distributed through the Chrome Web Store.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Extension's functionality, legal requirements, or our operational practices. When we make material changes, we will:

• Update the "Effective Date" and "Last Updated" dates at the top of this document.
• Provide notice through the Extension or the Chrome Web Store listing, where appropriate.
• Archive previous versions of this policy for your reference.

Your continued use of Vanta after any changes to this Privacy Policy constitutes your acceptance of the revised terms.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or Vanta's data practices, please contact us:

• Developer: Halonex
• Email: [email protected]

We are committed to resolving any privacy-related inquiries promptly and transparently.