Privacy Policy

1. Overview

This policy describes what VendorPack ("we", "us") collects and how it is used. The short version: we collect what is needed to run the service, we do not sell your data, and we do not run ads or third-party trackers.

2. What we collect

Account data. Your email address and a hashed version of your password. Passwords are stored using scrypt hashing and are never stored in plain text.

Product data. The content you put into VendorPack:

• Vendor records you create, including vendor business names and contact details.
• Documents uploaded by you or by your vendors through intake links. These files are stored on our server so you can review and download them.
• Expiration dates and reminder settings you configure.

Logs. Standard server logs, including IP address, request path, and timestamp, kept for security and debugging.

3. Cookies

VendorPack sets a single signed session cookie so you stay logged in. There are no advertising cookies, analytics trackers, or fingerprinting.

4. Payments

Paid plans are billed by Stripe. Your card details go directly to Stripe and never touch our servers. We receive only your subscription status and a Stripe customer reference.

5. Service providers

We use a small number of providers to run VendorPack: Stripe for payments, Cloudflare for networking and DDoS protection, and a transactional email provider for emails the product sends. Data is stored on servers in the United States. We share data with these providers only as needed to operate the service.

6. How we use data

To provide the service, secure it, fix problems, and communicate with you about your account. We do not sell personal data and we do not use your product data to train AI models.

7. Retention and deletion

Your data is kept while your account is active. To delete your account and its data, email [email protected] and we will remove it within 30 days, except minimal records we must keep for legal or billing reasons.

8. Security

All traffic is encrypted over HTTPS, passwords are hashed with scrypt, and access to production systems is restricted. No system is perfectly secure, so use a strong, unique password.

9. Children

VendorPack is a business tool and is not directed at children under 16. We do not knowingly collect their data.

10. Changes

If this policy changes materially, we will note it here and update the effective date.

11. Contact

Privacy questions or requests: [email protected].