This Privacy Policy explains how Vesta Global Holding Ltd, a company incorporated in the British Virgin Islands with company number 2180055, which operates VestaScan ("VestaScan", "we", "us" or "our"), collects, uses, shares and protects personal data. It covers personal data processed when you use vestascan.com, the VestaScan web application, the VestaScan Scanner, our AI Assistant and related services (the "Platform"), or when we contact you.
We are the controller of the personal data described in this Policy, unless we say otherwise. Capitalised terms not defined here have the meaning given in our Terms of Service.
Contact: contact@vestascan.com
1. Summary
- We collect the information you give us, such as your account details, identity verification documents, enquiries, comments and support requests. We also collect information generated when you use the Platform, such as your Wallet addresses, device and usage data and cookies.
- We use it to run the Platform, verify identities, meet legal obligations, keep the Platform secure, communicate with you and improve and promote our services.
- We do not sell your personal data for money. We share it with service providers who help us run the Platform, with Issuers when you choose to interact with them, and where the law requires.
- Blockchain data is public and permanent. Anything recorded on a public blockchain, including Wallet addresses, balances and transactions, cannot be deleted by us or anyone else.
- You have rights over your data, including access, correction and deletion. Contact us at contact@vestascan.com to use them.
2. Personal data we collect
2.1 Information you provide
| Category | Examples |
|---|---|
| Account and sign-in | Email address, sign-in method (email, Google, passkey or external Wallet), display name, communication email address, notification preferences |
| Profile | Bio, website, social media handles, entity type (individual or organisation) |
| Identity verification (KYC) | Full name, date and place of birth, gender, nationality, residential address, phone number, identity document type, number, issuing country, expiry date and images (front and back), proof-of-address documents, and, where requested, a photograph of yourself |
| Financial and compliance information | Tax identification number and tax residence, source of funds and source of wealth, estimated net worth, income, investment experience, supporting evidence, politically exposed person (PEP) status and details, your declarations and consents |
| Business verification (KYB) | Company name, trading name, registration and tax numbers, incorporation date and country, registered address, industry, business description, company email and website, incorporation and ownership documents. Also the names, roles and details of directors, beneficial owners, shareholders (including ownership percentages) and authorised signatories |
| Token and Issuer information | Token details, offering terms, documents uploaded to Data Rooms and for verification, and related correspondence |
| Enquiries | Your name, email address, phone number and message when you enquire about a Token |
| Community content | Comments, replies, reports you submit and backings |
| Support | Support tickets, messages and attachments |
| AI Assistant | The messages you send to the AI Assistant and its responses |
| Billing | Plan, billing details and transaction history. Card details are collected and stored by our payment processor, Stripe, not by us |
| Referral programme | Referral codes, referrals, earnings, and the payout details you provide |
| Direct Purchase (where available) | Orders, quantities, prices, payment and delivery Wallet addresses, signed subscription and purchase documents, signature records, investor classification, and screening results |
If you give us personal data about another person, for example a director, beneficial owner or signatory, you must make sure that you are entitled to do so and that they are aware of this Policy.
2.2 Information collected automatically
| Category | Examples |
|---|---|
| Wallet and blockchain data | Wallet and smart account addresses linked to your Account, token balances, whitelist status, transactions and on-chain activity on supported networks |
| Device and usage data | Browser and operating system, device type, pages visited, actions taken, timestamps, and approximate country derived from your IP address |
| Attribution data | How you arrived at the Platform, such as the referring website, landing page, campaign (UTM) parameters, advertising click identifiers and referral codes |
| IP address | Used for security and to determine approximate country. For visitor analytics, we store only a one-way, regularly rotated cryptographic hash of your IP address, not the address itself |
| Session and security data | Authentication tokens and session identifiers, and security logs |
| Cookies and similar technologies | See Section 9 |
2.3 Information from other sources
- Authentication and wallet providers, such as your verified email address and Wallet addresses when you sign in.
- Public blockchains, such as balances and transactions associated with Wallet addresses.
- Issuers, for example when an Issuer whitelists your Wallet or grants you access to a Data Room.
- Payment and screening providers, such as payment status and, where applicable, sanctions or risk screening results.
- Prospective investor contacts. We may obtain the contact details of prospective investors, such as name, email address, phone number, investment interests and indicative investment size. We obtain these from lead generation and marketing partners, events, referrals and publicly available sources, where the person has given consent or as otherwise permitted by law. We use them to tell these people about the Platform and the opportunities listed on it, and to facilitate introductions to Issuers. You can object to this at any time (see Section 10).
- Advertising platforms, such as aggregated campaign performance data.
3. How and why we use personal data
| Purpose | Data used | Legal basis (where required, e.g. under GDPR) |
|---|---|---|
| Creating and managing your Account, providing Platform features (token deployment, Data Rooms, enquiries, cap tables, comments, AI Assistant) | Account, profile, Wallet, usage, content | Performance of our contract with you |
| Identity and business verification, anti-money laundering and counter-terrorist financing checks, sanctions compliance, fraud prevention | KYC/KYB, financial and compliance information, Wallet data, screening results | Compliance with legal obligations; our legitimate interests in preventing financial crime and protecting the Platform; for PEP information, substantial public interest in preventing unlawful acts, where applicable |
| Recording your acceptance of our legal documents | Account, consent records (document, version, fingerprint, time) | Contract; legitimate interests in evidencing agreements; legal obligations |
| Processing payments, subscriptions, trials and refunds, and paying referral rewards | Billing, referral and Account data | Contract; legal obligations (tax and accounting) |
| Facilitating Direct Purchases (where available) | Direct Purchase, KYC, Wallet and screening data | Contract; legal obligations |
| Sending service, security, verification, billing and transactional messages | Contact details | Contract; legitimate interests |
| Sending marketing and promotional messages | Contact details, preferences, usage | Your consent, which you can withdraw at any time; or legitimate interests where the law permits |
| Community moderation and enforcing our Terms | Content, reports, Account data | Legitimate interests in a safe and lawful community |
| Customer support | Support tickets, Account data | Contract; legitimate interests |
| Security, abuse prevention and service integrity | Device, IP, session and usage data, audit logs | Legitimate interests; legal obligations |
| Analytics, attribution and improving the Platform | Usage, attribution and device data | Legitimate interests; consent where required for non-essential cookies |
| Advertising and measuring our marketing campaigns | Cookie and pixel data, attribution data | Your consent where required by law |
| Complying with law, responding to lawful requests, and establishing or defending legal claims | Any relevant data | Legal obligations; legitimate interests |
Automated decisions. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
- Verification decisions. Identity and business verification decisions are made by our staff.
- Comment flagging. We use automated signals to flag comments that may breach our guidelines, but a person reviews any removal.
- Direct Purchase screening. Where Direct Purchase is available, automated eligibility and sanctions checks may stop an order from proceeding. Any hold is reviewed by our staff, and you may contact us to ask for a review.
4. AI Assistant
When you use the AI Assistant, your messages and relevant information about your Account are sent to a third-party AI model provider to generate a response. That information may include your plan, verification status, entity type and your Tokens. We currently use OpenAI and/or Anthropic. They process this data on our behalf under their business terms. Those terms restrict them from using it to train their models.
AI Assistant conversations are kept for 30 days and then deleted. Please do not share sensitive personal data, private keys or seed phrases with the AI Assistant.
5. How we share personal data
We do not sell your personal data for money. We share personal data only as described below.
5.1 Service providers (processors). We share personal data with providers that process it on our behalf and under our instructions, including:
| Provider type | Purpose |
|---|---|
| Google Cloud | Hosting, computing, file storage, logging and messaging |
| Managed database and caching providers | Storing and serving Platform data, replicated across multiple regions for reliability |
| Vercel | Hosting the website and web application |
| Privy | Sign-in, authentication and embedded wallets |
| Alchemy and other blockchain node and infrastructure providers | Smart contract accounts, gas sponsorship and blockchain access |
| Stripe | Subscription payments, invoicing and refunds |
| OpenAI and Anthropic | AI Assistant |
| Email delivery providers | Sending emails from noreply@vestascan.com |
| Workflow automation tools | Internal operations and marketing workflows |
| Google Tag Manager, Meta and Reddit | Website analytics and advertising measurement (see Section 9) |
| Payment, electronic signature (such as DocuSign) and sanctions screening providers | Direct Purchase, where available |
5.2 Issuers.
- Enquiries. When you send an enquiry about a Token, we share your enquiry details, including your name, email address, phone number, message and Wallet address, with that Token's Issuer. The amount of detail the Issuer can see may depend on the Issuer's plan.
- Holdings and Data Rooms. Issuers can see the Wallet addresses and balances of their token holders, as well as whitelisting status and Data Room access records.
- Direct Purchase. Where you make a Direct Purchase, the Issuer receives the information needed to complete the sale with you.
Issuers act as independent controllers of the personal data they receive and are responsible for handling it lawfully under their own privacy notices.
5.3 Other users and the public.
- Comments. Your display name and Wallet address are shown publicly with your comments.
- Backings and Token pages. Backings are counted publicly. Token pages and the Scanner display Token information and on-chain data.
- Blockchain records. Anything recorded on a public blockchain, such as Wallet addresses, balances, whitelist status, transactions and the link we record between your Account and your Wallet, is publicly visible.
5.4 Concierge partners. If you request concierge or partner services, we share the information needed for the partner to provide them. This happens with your knowledge, and the partner processes it under its own terms.
5.5 Legal and safety. We may disclose personal data to:
- regulators, law enforcement, courts and other authorities, where we believe this is required by law or necessary to prevent fraud, financial crime or harm;
- protect our rights, users or the public;
- enforce our Terms.
5.6 Corporate transactions. We may share personal data with our affiliates, and with a buyer or successor in connection with a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality protections.
6. International transfers
We operate globally. Our infrastructure is hosted in multiple regions, including the United States, the European Union (Belgium) and Singapore. Our databases are replicated across regions around the world for high availability. Our service providers may process data in other countries.
This means your personal data may be transferred to and processed in countries other than your own, which may not offer the same level of data protection. Where the law requires, we protect such transfers with appropriate safeguards. These include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. Contact us for more information.
7. How long we keep personal data
We keep personal data only for as long as needed for the purposes described in this Policy, including to meet legal, regulatory, tax and accounting requirements. We then delete it or anonymise it. Specifically:
| Data | Retention period |
|---|---|
| Account and profile data | While your Account is open, then deleted or anonymised, except as listed below |
| Identity and business verification (KYC/KYB) data and records of compliance checks | 5 years after our relationship with you ends, or longer if required by law or an ongoing investigation |
| Records of your acceptance of legal documents | For as long as your Account is open and for the KYC retention period above |
| Billing, payment and tax records | 7 years from the transaction |
| AI Assistant conversations | 30 days |
| Visitor analytics for people who do not create an Account | 90 days |
| Attribution data for Account holders | While your Account is open |
| Comments | While published. Removed comments may be retained in hidden form for moderation and legal purposes |
| Support tickets and enquiries | For as long as reasonably needed to deal with the matter and any follow-up, and to defend legal claims |
| Direct Purchase orders and signatures (where available) | For the period required by applicable securities and record-keeping laws |
Blockchain data cannot be deleted. Information recorded on public blockchains is permanent and outside our control.
8. How we protect personal data
We use technical and organisational measures appropriate to the risk. These include:
- encryption in transit;
- private storage for identity documents, with access through short-lived links;
- role-based access controls, so that staff only see data needed for their role;
- multi-factor authentication for staff;
- audit logging of administrative actions;
- secret management.
No system is completely secure. Please protect your sign-in methods and Wallets, and tell us immediately if you suspect unauthorised access. We will never ask for your private keys or seed phrase.
9. Cookies and similar technologies
We use cookies, local storage and similar technologies ("cookies") on our website and Platform.
| Type | Examples | Purpose | Duration |
|---|---|---|---|
| Strictly necessary | auth-token (secure, HTTP-only) | Keeps you signed in securely | 12 hours |
siwe-nonce | Protects wallet sign-in | 15 minutes | |
| Authentication and wallet provider storage (Privy, Alchemy) | Sign-in and wallet sessions | Session or as set by the provider | |
| Session and pagination state | Remembers your place in the Platform | Session | |
| Preferences | Display preferences, such as theme | Remembers your settings | Up to 1 year |
| Analytics and attribution | vsid (first-party) | Measures visits and how people find us, and attributes sign-ups and referrals | Up to 400 days |
| Advertising | Google Tag Manager, Meta Pixel, Reddit Pixel | Measures the effectiveness of our advertising and builds advertising audiences | As set by each provider |
Your choices.
- Our consent tool. Where required by law, we ask for your consent before setting analytics, attribution and advertising cookies, and you can change your choice at any time through our cookie settings.
- Your browser. You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may stop the Platform from working.
Meta and Reddit may combine information collected through their pixels with other information they hold, under their own privacy policies.
10. Your rights
Depending on where you live, you may have some or all of the following rights:
- Access. Request a copy of the personal data we hold about you.
- Correction. Ask us to correct inaccurate or incomplete data.
- Deletion. Ask us to delete your personal data, subject to the retention obligations in Section 7 and the permanence of blockchain data.
- Restriction. Ask us to limit how we use your data.
- Portability. Receive data you provided to us in a structured, machine-readable format.
- Objection. Object to processing based on our legitimate interests, including profiling, and to direct marketing at any time.
- Withdraw consent. Where we rely on consent, withdraw it at any time. Withdrawal does not affect processing that has already taken place.
- Complain. Complain to a data protection supervisory authority, such as the authority in the country where you live or work.
How to exercise your rights. Email contact@vestascan.com from the email address associated with your Account. This includes requests to close your Account and delete your data. We may need to verify your identity before acting on a request. We will respond within one month, which may be extended where the law allows. We will not discriminate against you for exercising your rights.
Marketing. Promotional messages are off by default and sent only if you opt in. You can opt out at any time using the link in our emails, in your notification settings, or by contacting us. Service, security, verification and billing messages cannot be switched off while you have an Account.
11. Regional information
British Virgin Islands
We process personal data in accordance with the Data Protection Act, 2021 of the British Virgin Islands.
European Economic Area and United Kingdom
Where the EU General Data Protection Regulation or the UK GDPR applies, the legal bases for our processing are set out in Section 3. You have the rights in Section 10. You may lodge a complaint with the supervisory authority of your EU Member State, or with the UK Information Commissioner's Office.
California and other U.S. states
The Platform is not offered to persons in the United States, and we do not knowingly collect personal data from U.S. residents for the purpose of providing the Platform. To the extent the California Consumer Privacy Act, as amended by the CPRA, or a similar state law applies to our website:
- Categories and uses. The categories of personal information we collect, their sources, our purposes and the categories of recipients are described in Sections 2, 3 and 5.
- No sale for money. We do not sell personal information for money.
- Advertising pixels. Our use of advertising pixels (Section 9) may be considered "sharing" for cross-context behavioural advertising. You may opt out through our cookie settings, by enabling the Global Privacy Control signal in your browser, or by contacting us.
- Your rights. You may request to know, access, correct or delete your personal information.
- No sensitive-data uses. We do not use sensitive personal information for purposes that would require offering a right to limit.
12. Children
The Platform is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe we have done so, contact us and we will delete it.
13. Third-party sites and services
The Platform links to, and integrates with, third-party websites, wallets, blockchains and services, including Issuer websites and documents. Their privacy practices are governed by their own policies, and we are not responsible for them.
14. Changes to this Policy
We may update this Policy from time to time. Each version is numbered and dated. If we make material changes, we will notify you by email or through the Platform before they take effect.
15. Contact us
Vesta Global Holding Ltd (British Virgin Islands, company number 2180055), operating VestaScan.
For questions about this Policy or to exercise your rights, contact contact@vestascan.com.