Privacy Policy
About this policy
This Privacy Policy explains how Custom Made Inventory ("CMI") collects, uses, and protects information when you use the Vantage portal at https://vantage.cmi.com (the “Service”), including the SMS-based two-factor authentication feature. Vantage is a private internal portal for authorized CMI employees, contractors, and approved business partners.
Information we collect
- Account information provisioned by your CMI administrator: name, work email, job title, and work phone number.
- Authentication metadata generated each time you sign in: timestamp, IP address, browser/device user-agent, and success/failure result.
- SMS two-factor authentication data when 2FA is enabled for your account: the phone number on file, the time we send a verification code, the time it is verified, and proof of your opt-in (timestamp, IP address, user-agent, the version of the consent text you accepted, and the phone number you consented for).
- Usage data about which dashboards and reports you open, used to populate your personal report history and CMI's administrative audit logs.
How we use your information
- To authenticate you and protect your account from unauthorized access.
- To deliver one-time SMS verification codes when two-factor authentication is enabled.
- To maintain operational security logs and respond to incidents.
- To provide the Vantage reports and dashboards you are authorized to view.
How we use SMS
When two-factor authentication is enabled for your account, Vantage sends one-time verification codes to your phone via SMS through our SMS provider, Twilio. SMS is used solely to deliver authentication codes. We do not use SMS for marketing, promotional, sales, or advertising messages. Message frequency varies and is tied directly to your sign-in activity. Message and data rates from your wireless carrier may apply.
You may reply STOP to any verification message at any time to opt out of SMS. After opting out, your CMI administrator must disable two-factor authentication on your account before you can sign in again. Reply HELP for assistance.
Sharing of information
We do not sell, rent, lease, or share your personal information — including the phone number you provide for SMS and your SMS opt-in records — with any third party for marketing, promotional, or advertising purposes. SMS opt-in information and consent records are not shared with third parties for any purpose.
We use Twilio, Inc. as our SMS delivery provider. Twilio receives the destination phone number and the body of the verification message strictly to route the SMS to your carrier. Twilio's handling of that information is governed by Twilio's own privacy practices, available at https://www.twilio.com/legal/privacy.
We may disclose information when required by law, valid legal process, or to protect the rights, property, or safety of CMI, our users, or the public.
Data retention
- Authentication metadata, login events, and SMS code records are retained for operational and audit purposes.
- SMS opt-in proof (consent timestamp, IP address, user-agent, consent text version, and phone number consented for) is retained for the lifetime of the account, plus a reasonable archival period after account closure to satisfy carrier compliance obligations.
- You may ask your CMI administrator to clear your SMS opt-in record at any time; doing so will require you to re-consent at the next sign-in if 2FA remains enabled on your account.
Security
Vantage uses bcrypt-hashed passwords, HMAC-signed session cookies, and HTTPS/TLS encrypted transport for every page load. SMS verification codes are hashed before storage and expire within ten minutes; codes also lock out after five incorrect attempts and rate-limit re-sends to once every thirty seconds.
Your choices
- You may opt out of SMS at any time by replying STOP.
- You may request that your CMI administrator clear your SMS opt-in record.
- You may request a copy of, or correction to, the personal information we hold for you by contacting itcmi.com.
Contact
Questions about this Privacy Policy, your account data, or SMS-related privacy rights:
Custom Made Inventory
Email: itcmi.com
Web: https://cmi.com
Changes to this policy
If we materially change how we use SMS or how we treat your opt-in records, we will update this page and bump the consent text version, which will prompt you to re-opt-in the next time you sign in.