Privacy Policy

For our customers' data we are a processor. The vendor records, questionnaire answers and documents an organization puts into VendorVett belong to that organization, which decides why they are processed. We process them only on its instructions, under our Data Processing Addendum.

For account and billing data we are a controller. This policy mainly describes that data: who signs in, who pays, and how the service is used.

• Account details: name, work email, password (stored only as a salted hash), role.
• Organization details: name, plan, billing contact. Payment details go to Paddle, our reseller, and never reach our servers.
• Service data you or your vendors enter: vendor profiles and contacts, questionnaire answers, uploaded documents, reviews and decisions. For vendor onboarding, a taxpayer identification number, VAT number or other tax ID typed into the checklist is reduced to its last four characters before it is stored. A signed W-9 or other tax form uploaded as evidence contains the full number; it is stored like any uploaded document, encrypted at rest in private storage and reachable only from your organization's account, through short-lived signed links.
• Technical data: IP address and time of each recorded action (kept in your organization's audit trail), and error reports with personal data stripped.

We do not use advertising cookies. The app keeps your sign-in token and, if you make one, your cookie choice in your browser's local storage. The admin console uses one strictly necessary session cookie for staff.

Analytics cookies load only after you accept the banner, and only for a tool this deployment has switched on. With its setting unset, that tool does not load. Google Analytics, Microsoft Clarity, PostHog and HubSpot, when each is on, do not load at all until you accept, and nothing is sent to them before that. None of them load on the links we email to vendors. If you accept, Google Analytics grants analytics storage only and keeps advertising storage denied. The tools that are on may set cookies (Google Analytics _ga and _ga_<id>; Clarity _clck and _clsk) and receive pages viewed and steps such as sign-up, including the campaign parameters from the page you first landed on. We do not send them your name, email address or vendor data. Clarity may record how a page is used; the content of a signed-in workspace is masked. HubSpot's tracking code sets cookies (__hstc, hubspotutk, __hssc and __hssrc) to recognise return visits and link them to an enquiry you later send us. You can change your choice any time from the cookie settings link in the footer. Declining, or withdrawing an acceptance, stops these tools and deletes their cookies on our domain.

To provide and secure the service, to bill for it, to send the emails you have asked for (and let you turn each kind off), to answer support requests, and to meet legal obligations. We do not sell personal data or share it for cross-context behavioural advertising, and we do not use customer data to train AI models.

A short list of subprocessors host, store, email, bill and monitor the service, and measure website use for visitors who accept analytics cookies. The current list, with what each receives and where, is on the subprocessors page. We tell customers before adding one.

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. When you buy a paid plan, Paddle collects your billing name, email, address and payment details and processes them under its own privacy notice. Paddle tells us what we need to run your account: who bought which plan, the subscription status and the billing contact.

• Service data: for as long as the organization keeps its account.
• When an owner deletes an organization, everything is deleted after a 30-day grace period in which the deletion can be cancelled, including stored documents. Backups roll off within 35 days after that.
• Data export archives: 7 days after they are generated.
• In-app notifications: 30 days once read, 90 days otherwise.
• A single deletion record (who asked, when, and a fingerprint of the destroyed audit trail) is kept so the deletion itself can be proven. It contains none of the organization's content.

Encryption in transit and at rest, server-side tenant isolation on every request, antivirus scanning of uploads, a tamper-evident audit trail, second-factor sign-in for staff and a logged, read-only support mode. The trust page has the detail.

You can see and correct your account details in the app. Owners can export all of an organization's data as a ZIP with a SHA-256 manifest, and delete the organization, from Settings → Data & privacy. Any user can delete their own account there. For anything else, including access, correction, deletion or portability requests under the GDPR, UK GDPR or US state laws such as the CCPA, email info@vendorvett.com. We answer within 30 days and will not discriminate against you for asking. If a request concerns data a customer controls, we pass it to that customer and help them answer it.

We and our subprocessors process data in the United States, except where the subprocessor list names another location. Google and Microsoft, for analytics you have accepted, may also process it in other countries where they operate. Transfers from the EEA, UK and Switzerland rely on the Standard Contractual Clauses incorporated in our DPA. Paddle, as our reseller, may also process billing data in the United Kingdom and the European Union.

VendorVett is a business service and is not directed at anyone under 16.

We will post changes here and, for material ones, email account owners first. Questions: info@vendorvett.com.