Privacy Policy
Vanta Trading and Hyperscaled Unified Privacy Policy
Effective Date: March 27, 2026
This Privacy Policy (“Policy”) describes how Taoshi VT Services, a Cayman Islands exempted company with limited liability (“Vanta,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you access or use the Vanta Trading Challenge, the Hyperscaled Challenge, our websites, interfaces, browser extensions, dashboards, APIs, and related services, including the applicable Scaled Trader Program(s) where relevant (collectively, the “Platform”). This Policy applies to all visitors, users, and participants (“you” or “your”).
By accessing or using the Platform, creating an account, linking or registering a wallet or other supported-venue identifier, installing or using a Vanta browser extension, or paying a Challenge Entry Fee, you acknowledge that you have read and understood this Policy. This Policy is not a contract that requires your agreement. Where we rely on your consent as a legal basis for processing (such as for non-essential cookies or direct marketing communications in certain jurisdictions), we obtain that consent separately, and you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
This Policy should be read together with the applicable Terms of Service and, if you are invited into a Scaled Trader Program, the applicable Independent Contractor Agreement (“ICA”). Capitalized terms not defined in this Policy have the meanings assigned in the applicable Terms of Service or ICA, as the context requires.
2. Data Controller
For the purposes of the EU General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and other applicable data protection laws, the controller of your personal information is:
Taoshi VT Services
Cayman Islands Exempted Company
Email: [email protected]
Address: PO Box 144, 3119 9 Forum Lane, Camana Bay, George Town, Grand Cayman KY1-9006, Cayman Islands
We have not appointed a Data Protection Officer (“DPO”). If a DPO is appointed in the future, their contact details will be published here. We have not appointed an EU or UK representative under Article 27 GDPR / UK GDPR. If such appointment becomes required, we will update this Policy accordingly.
We collect information in several categories depending on your level of engagement with the Platform. Not all categories apply to all users, and certain data is collected only at specific stages of participation.
3.1 Core Account Data (Collected at Signup)
When you create an account, register for a Challenge, or link a wallet or other supported-venue identifier, we may collect:
- Email address
- Full name, display name, username, and, where applicable, your Registered Wallet address or other supported-venue identifier
- Account credentials (passwords are stored in hashed form; we also maintain authentication and security logs)
- IP address, device type, browser information, operating system, and application or extension version information
- Usage data, including login timestamps, platform activity, session duration, dashboard or browser-extension interaction logs, and related diagnostic or security logs
3.2 Trading and Performance Data
We collect data related to your simulated trading activity and, for Hyperscaled or other supported-venue products, qualifying trading activity that is mirrored, copied, translated, or otherwise evaluated for Challenge or Program purposes, including:
- Simulated trading activity, mirrored or translated activity, order history, position data, and related wallet-linked or supported-venue activity records
- Profit and loss (PnL), returns, drawdowns, validated simulated performance, and other risk metrics
- Strategy behavior, execution logs, trading patterns, timestamps, instrument selection, and integrity or anti-abuse signals
- Evaluation results, scoring, eligibility status, Pass/Fail determinations, scaling status, and related review notes
3.3 Payment and Billing Data
When you pay a Challenge Entry Fee or make other transactions through Vanta Trading or Hyperscaled, we may collect:
- Billing name and billing address, where applicable to the payment method used
- Transaction history, invoice records, wallet addresses used for payment or payout, blockchain transaction hashes, chain/network, token type, amount, timestamps, and payment or payout status, as applicable
For Vanta Trading, credit and debit card details are processed directly by our third-party payment processor (currently Stripe or a comparable provider) and are not stored on our servers. We receive only limited payment details such as tokenized references, last four digits, and transaction confirmations.
For Hyperscaled and other on-chain payment flows, we do not receive or store private keys or seed phrases, but we may receive and record blockchain payment details associated with your transaction, and those transactions may also be publicly visible on the relevant blockchain or network.
3.4 Post-Challenge, Payout, and KYC Data (Conditional)
If you pass a Challenge and become eligible for an invitation to a Scaled Trader Program or otherwise become payout-eligible, we may collect additional information as part of Know Your Customer (“KYC”) and Anti-Money Laundering (“AML”) compliance procedures. This data is collected only from payout-eligible individuals or where otherwise required for compliance, fraud prevention, or onboarding. Such data may include:
- Government-issued identification (e.g., passport, driver’s license)
- Date of birth
- Residential address
- Nationality, tax residency, and related tax or beneficial-ownership information, as applicable
- Bank account details or cryptocurrency payout wallet address, depending on the payout rail used
- Results of compliance screening (including identity verification, liveness, sanctions, AML, fraud-prevention, and related compliance checks, as applicable)
Government-issued identification, date of birth, and bank account details are sensitive personal information under certain privacy laws. We use this information only for the purposes described in Section 4 and do not use or disclose it for purposes beyond what is reasonably necessary for compliance, fraud prevention, onboarding, and payout administration.
We may use third-party services, such as Stripe Connect or Sumsub, to conduct identity verification and compliance checks. Depending on the flow, we may collect this information directly or the applicable provider may collect it on our behalf subject to its own terms and privacy notice.
3.5 Communications Data
If you contact us for support or otherwise communicate with us, we may collect:
- Support tickets and email correspondence
- Communications through integrated platforms such as Discord or Slack, to the extent initiated by you
3.6 Automatically Collected Technical Data
We automatically collect certain technical information when you visit or use the Platform, including our websites, dashboards, and browser extensions, where applicable:
- IP address and approximate geolocation
- Browser type and version, device type, operating system, and application or extension version information
- Referring URLs, pages viewed, clickstream data, and interaction data across our websites, dashboards, or extensions
- Cookies, pixel tags, and similar tracking technologies (see Section 8 below)
We use the information we collect for the following purposes:
4.1 Account Administration
To create and manage your account, authenticate your identity or wallet linkage, maintain account security, and communicate with you about your account and the Platform.
4.2 Challenge and Program Operations
To register you for Vanta Trading or Hyperscaled Challenges, monitor and evaluate simulated trading activity, record qualifying supported-venue or wallet-linked activity where applicable, calculate performance metrics, administer Challenge Rules and Program Rules, and determine eligibility or status.
4.3 Scaled Trader Program Administration
To onboard traders who are invited to a Scaled Trader Program, administer ICA-related operations, validate simulated performance, calculate eligibility for service compensation, and manage payout administration.
4.4 Payment Processing
To process Challenge Entry Fees, on-chain fee payments, issue invoices, manage disputes, refunds, or corrective actions where applicable, and maintain billing, accounting, tax, and transaction records.
4.5 KYC/AML Compliance
To verify your identity, confirm eligibility, conduct required compliance checks, and manage sanctions, AML, fraud-prevention, and related controls where required by Applicable Law or reasonably necessary for program integrity.
4.6 Platform Improvement and Analytics
To analyze usage patterns, diagnose technical issues, improve Platform functionality, and develop new features.
4.7 Security and Fraud Prevention
To detect, investigate, and prevent fraudulent activity, unauthorized access, abuse of the Platform, wallet compromise, prohibited conduct, multi-accounting, strategy cloning or correlation, and violations of the applicable Terms of Service, Challenge Rules, ICA, or Program Rules.
4.8 Communications
To send you transactional messages (e.g., account confirmations, Challenge status updates, payment receipts, payout notices, and security alerts) and respond to your inquiries. Where permitted and, where required by Applicable Law, with your consent, we may also send promotional or informational communications. You may opt out of non-transactional marketing communications at any time.
5. EU/UK Legal Bases and Required Disclosures
If you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, we process your personal data only where we have a valid legal basis under the GDPR or UK GDPR.
| Processing Purpose | Categories of Data | Legal Basis |
|---|---|---|
| Account administration; Challenge and Program operations | Core account data; trading and performance data; wallet or supported-venue identifiers | Performance of a contract; legitimate interests (service administration and integrity) |
| Payment processing | Payment and billing data | Performance of a contract; compliance with legal obligations (tax and recordkeeping) |
| KYC/AML compliance | Post-challenge / payout / KYC data | Compliance with legal obligations; legitimate interests (platform integrity and fraud prevention) |
| Security and fraud prevention | Core account data; technical data; trading data; wallet or supported-venue data | Legitimate interests (platform security, fraud prevention, program integrity); compliance with legal obligations where applicable |
| Analytics and product improvement | Technical data; usage data | Legitimate interests (service improvement); consent for non-essential cookies where required |
| Marketing communications | Email address; name | Consent where required by law; otherwise, legitimate interests with opt-out |
| Legal compliance and dispute resolution | All categories as relevant | Compliance with legal obligations; legitimate interests (exercising or defending legal claims) |
Account administration; Challenge and Program operations
Core account data; trading and performance data; wallet or supported-venue identifiers
Performance of a contract; legitimate interests (service administration and integrity)
Payment processing
Payment and billing data
Performance of a contract; compliance with legal obligations (tax and recordkeeping)
KYC/AML compliance
Post-challenge / payout / KYC data
Compliance with legal obligations; legitimate interests (platform integrity and fraud prevention)
Security and fraud prevention
Core account data; technical data; trading data; wallet or supported-venue data
Legitimate interests (platform security, fraud prevention); compliance with legal obligations
Analytics and product improvement
Technical data; usage data
Legitimate interests (service improvement); consent for non-essential cookies
Marketing communications
Email address; name
Consent where required by law; otherwise, legitimate interests with opt-out
Legal compliance and dispute resolution
All categories as relevant
Compliance with legal obligations; legitimate interests (legal claims)
Legitimate Interests Statement. Where we rely on legitimate interests as a legal basis, our interests include ensuring the security and integrity of the Platform and the Challenge; preventing fraud, abuse, manipulation, multi-accounting, and strategy cloning or correlation; analyzing and improving our services; and exercising or defending legal claims. We balance these interests against your rights and freedoms and do not process personal data where our interests are overridden by the impact on you.
We do not sell your personal information. We may share your information in the following circumstances:
6.1 Service Providers
We share information with third-party vendors and service providers who perform services on our behalf, such as payment processing (including Stripe or comparable providers), cloud hosting and infrastructure (currently Google Cloud Platform), analytics, KYC/AML and identity verification services (including Sumsub or comparable providers), customer support tools, and email delivery services. These providers are contractually obligated to use your information only as necessary to provide their services to us and in accordance with this Policy.
6.2 Network Participants and On-Chain Data
Because the Platform may interact with decentralized networks, public blockchains, and supported third-party venues, certain activity data (such as registered wallet addresses, trade or position data, performance metrics, and on-chain payment details) may be recorded on, derived from, or visible through those systems in accordance with their protocols. Data recorded on Subnet 8, public blockchains, or similar decentralized systems may be public and may be difficult or impossible to modify, correct, or delete due to the immutable or distributed nature of those systems. We do not control those systems or how third parties may use publicly available data.
6.3 Legal and Regulatory Requirements
We may disclose your information if required to do so by Applicable Law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.
6.4 Business Transfers
In connection with any merger, acquisition, sale of assets, financing, or transfer of all or a portion of our business, your information may be transferred as part of that transaction. We will notify you by email and/or prominent notice on the Platform of any change in ownership or material changes to the use of your personal information.
6.5 With Your Consent
We may share your information for other purposes with your express consent.
7. International Data Transfers
Vanta is organized under the laws of the Cayman Islands. Your personal information is primarily stored and processed using Google Cloud Platform infrastructure, which may involve processing in the United States and other jurisdictions where Google Cloud operates data centers.
Where your personal information is transferred outside the EEA, the United Kingdom, or Switzerland, we ensure that appropriate safeguards are in place as required by Applicable Law. These safeguards currently include:
- Google Cloud’s Data Processing and Security Terms, which incorporate the Standard Contractual Clauses (“SCCs”) approved by the European Commission and the UK International Data Transfer Addendum (“UK IDTA”), as applicable
- Where we engage other service providers, we rely on SCCs, the UK IDTA, transfers to countries recognized as providing an adequate level of data protection, or other lawful transfer mechanisms as appropriate
- Additional technical and organizational measures as appropriate to supplement contractual safeguards
We may change or supplement our infrastructure and service providers from time to time. Where we do so, we will ensure that equivalent or stronger transfer safeguards remain in place. You may request a copy of the relevant transfer safeguards by contacting us using the details in Section 15.
We retain your personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements. Retention periods vary by data category and the legal basis for processing:
- Account, trading, and wallet-linked data is retained for the duration of your account and for a reasonable period thereafter (generally no longer than three years for audit, compliance, and dispute resolution purposes, unless a longer period is required by Applicable Law).
- Payment and transaction records are retained as required by Applicable Law, payment-network rules, blockchain or payment recordkeeping requirements, and tax obligations (typically five to seven years).
- KYC/AML data is retained for the period required by Applicable Law, which may be five years or more following the end of the business relationship.
- Communications data (support tickets, correspondence) is retained for as long as necessary to resolve the matter and for a reasonable period thereafter for quality assurance and dispute resolution.
- Usage and technical data is generally retained in aggregated or anonymized form and may be retained indefinitely for analytics purposes. Aggregated or anonymized data that can no longer be linked to an identifiable individual is not considered personal data.
When personal information is no longer required, we will securely delete or anonymize it in accordance with our data retention procedures. Public blockchain or decentralized-network data may remain available outside Vanta’s control.
Depending on your jurisdiction, you may have certain rights regarding your personal information. This section describes rights that may be available to you. Not all rights are available in all jurisdictions.
10.1 General Rights
Subject to Applicable Law, you may have the right to:
- Access your personal information and obtain a copy of the data we hold about you
- Correct inaccurate or incomplete personal information
- Delete your personal information, subject to certain exceptions (e.g., legal retention obligations, ongoing disputes)
- Portability — receive your personal information in a structured, commonly used, machine-readable format
- Opt out of non-transactional marketing communications at any time
10.2 Additional Rights for EU/UK Data Subjects
If you are located in the EEA, United Kingdom, or Switzerland, you additionally have the right to:
- Restrict processing of your personal data in certain circumstances (e.g., while we verify the accuracy of your data following a challenge to its accuracy)
- Object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal
- Lodge a complaint with your local data protection supervisory authority (e.g., the ICO in the United Kingdom, the CNIL in France, or your relevant national authority in the EEA)
To exercise any of these rights, please contact us using the information in Section 15. We will respond to your request within the time frames required by Applicable Law (generally within thirty days for GDPR/UK GDPR requests). We may need to verify your identity before processing your request.
Blockchain Data Limitation. Data recorded on public blockchains, supported venues, or decentralized networks (including Subnet 8 and, where applicable, wallet-linked activity used for Hyperscaled) may be technically impossible to modify, correct, or delete. Your rights under this Section apply to off-chain records maintained by Vanta. We will inform you if a request cannot be fully fulfilled due to on-chain or decentralized-network data limitations.
11. Automated Decision-Making and Profiling
Your Challenge trading activity and, for Hyperscaled or other supported-venue products, qualifying activity from your Registered Wallet or supported venue are evaluated against published performance criteria (as set out in the Challenge Rules or Program Rules) using automated scoring and analysis systems. These systems calculate metrics such as profit and loss, drawdowns, risk parameters, and integrity signals, which contribute to eligibility determinations (e.g., Pass or Fail).
While initial scoring is automated, significant decisions regarding your Challenge or Program eligibility, including any determination that may result in disqualification for suspected rule violations, payout ineligibility, or other enforcement action, are subject to review and meaningful human involvement before a final outcome is applied.
If you believe an automated decision has been made in error, or if you wish to contest an eligibility determination, you may contact us at the details in Section 15 to request a review.
This section applies to California residents and supplements the rest of this Policy with information required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).
12.1 Categories of Personal Information Collected
In the preceding twelve months, we have collected the following categories of personal information (as defined by the CCPA/CPRA):
- Identifiers: name, email address, username, IP address, account credentials, Registered Wallet address, and other account or supported-venue identifiers
- Financial information: billing address, transaction history, invoices, on-chain payment details, and payout information. (Payment card data is processed by Stripe or another payment processor and not stored by us.)
- Internet or network activity: browsing history on the Platform, login data, usage data, cookies, clickstream data, and platform or extension interaction data
- Geolocation data: approximate location derived from IP address
- Professional or employment-related information: simulated trading performance data, strategy behavior, evaluation results, and program eligibility or payout status
- Sensitive personal information (conditional): government-issued ID, date of birth, and, where applicable, bank account details, crypto wallet address, or comparable verification information, collected only from payout-eligible individuals or others requiring enhanced verification
12.2 Categories Disclosed for a Business Purpose
We may disclose the following categories to service providers and third parties for business purposes:
- Identifiers (to payment processors, cloud providers, analytics providers, KYC vendors, support providers, and similar service providers)
- Financial information (to payment processors, payout providers, and accounting or tax providers where applicable)
- Internet or network activity (to analytics, security, and infrastructure providers)
- Sensitive personal information (to KYC/AML verification providers and payment or payout onboarding providers, only for payout-eligible individuals)
12.3 Sale and Sharing
We do not sell personal information as defined by the CCPA/CPRA.
12.4 Sensitive Personal Information
We may collect sensitive personal information (government ID, date of birth, bank/crypto details) only from payout-eligible individuals or others who require enhanced verification, and only for the following purposes:
- Identity verification, KYC/AML compliance, sanctions screening, and fraud prevention as required by Applicable Law or reasonably necessary for program integrity
- Payout, tax, and onboarding administration under a separate Independent Contractor Agreement or related program documentation
We do not use or disclose sensitive personal information for purposes beyond what is reasonably necessary to provide the services or as otherwise permitted by the CCPA/CPRA.
12.5 Your California Rights
As a California resident, you have the right to:
- Know what categories and specific pieces of personal information we have collected about you
- Delete your personal information, subject to certain exceptions
- Correct inaccurate personal information
- Opt out of the sale or sharing of your personal information (if applicable)
- Limit the use of sensitive personal information to purposes authorized by the CCPA/CPRA
- Non-discrimination — we will not discriminate against you for exercising your privacy rights
12.6 How to Submit a Request
To submit a verifiable consumer request, contact us using the information in Section 15. You may also designate an authorized agent to submit a request on your behalf. If you use an authorized agent, we may require written proof of authorization and may verify your identity directly. We will respond to verified requests within forty-five days, with an extension of up to an additional forty-five days where reasonably necessary, as permitted by law.
Appeal. If we deny your request in whole or in part, you may appeal by contacting us at the details in Section 15 with the subject line “Privacy Appeal.” We will respond to your appeal within the time frame required by Applicable Law.
We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, regular security assessments, and employee training. Our primary cloud infrastructure provider (currently Google Cloud Platform) maintains industry-standard certifications including SOC 2 and ISO 27001.
However, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials, the security of any Registered Wallet or Payout Wallet you use in connection with the Platform, and any activity that occurs under your account or attributable to your wallet.
14. Children’s Privacy
The Platform is not directed to individuals under the age of 18, and we do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information as promptly as practicable. If you believe we have inadvertently collected information from a child under 18, please contact us immediately using the information in Section 15.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise any of your rights described in this Policy, please contact us:
Taoshi VT Services
Cayman Islands Exempted Company
Email: [email protected]
Address: PO Box 144, 3119 9 Forum Lane, Camana Bay, George Town, Grand Cayman KY1-9006, Cayman Islands
16. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Effective Date” at the top of this Policy and, where required by Applicable Law, provide additional notice (such as email notification or a prominent notice on the Platform). We encourage you to review this Policy periodically. Your continued use of the Platform after a revised Policy takes effect indicates your awareness of the updated practices.
17. Important Clarifications
For the avoidance of doubt, the following clarifications apply to this Policy and the data practices described herein:
No Brokerage or Custodial Accounts
Vanta does not operate brokerage accounts. All trading activity on the Platform during the Vanta Trading Challenge or the Hyperscaled Challenge is simulated. We do not hold custody of client funds, real assets, or securities at any time. In Hyperscaled and similar supported-venue products, you may trade through your own self-custodied account on a supported third-party venue using your own capital, while Vanta monitors qualifying activity on a read-only basis for evaluation or Program purposes.
No Direct Storage of Payment Card Data and Wallet Keys
Full credit or debit card numbers are never stored on our servers. All payment card data is collected and processed directly by our PCI-compliant third-party payment processor. For Hyperscaled and other on-chain flows, we record transaction and wallet details necessary to administer the Service but do not collect or store private keys or seed phrases.
KYC Data Is Conditional
Government-issued identification, date of birth, nationality, tax residency, and bank or crypto payout details are collected only from individuals who become payout-eligible or otherwise require enhanced verification for compliance, fraud prevention, or onboarding. This data is not collected from general participants unless needed for those purposes.
Optional Data and Wallet Identifiers
Certain data fields (such as full name during the Challenge stage) may be optional. Where data collection is optional, it will be clearly indicated at the point of collection. For Hyperscaled, public wallet addresses and related supported-venue identifiers may function as core account or program identifiers.
On-Chain Data
Certain data submitted to or derived from public blockchains, supported venues, or decentralized networks (including Subnet 8) may become public or effectively immutable. Such data may be beyond Vanta’s ability to modify or delete. This limitation is inherent to decentralized systems and public blockchain architecture and is not a result of Vanta’s off-chain data handling practices.