Privacy Policy

This Privacy Policy explains what information VendorGuard (“VendorGuard,” “we,” “us”) collects through vendorguard-v1.vercel.app and any successor domain (the “Service”), how we use it, and the choices you have. It applies to visitors, registered account holders, and the individuals whose license and credential records account holders submit for verification.

VendorGuard is an early-stage product. This policy describes our actual, current data practices in plain language. If you have questions about anything below, contact us — see Contact.

1. Information we collect

Account information. When you sign up, we collect your name and email address, and, if you use email/password sign-in, a securely hashed password (we never see or store it in plain text). If you sign in with Google, we receive your name, email address, and profile picture from Google, and nothing else.

Credential and vendor data you submit. To use the core product, you or your organization submit license, credential, and vendor information — for example license numbers, license types, issuing boards, expiration dates, and supporting documents you upload for Primary Source Verification. This data belongs to you or your organization; we process it to provide the verification and reporting features you've requested.

Verification and audit trail data. Every time a credential check or status update happens, we log a timestamp and, where available, an approximate geographic location (city, region, country, and coarse coordinates) and IP address, derived from network routing information provided by our hosting infrastructure. This exists specifically to produce the audit-ready verification trail that is the point of the product — it is not used for advertising or behavioral tracking.

Billing information. Subscription payments are processed by Stripe. We do not receive or store your card number or full payment details — Stripe handles that directly. We do store your subscription tier, status, and Stripe customer/subscription identifiers so your account reflects the correct plan.

Usage analytics. We use Plausible Analytics, a privacy-focused analytics service that does not use cookies and does not collect personally identifiable information. It reports aggregate metrics like page views and which features are used — we cannot use it to identify an individual visitor.

2. How we use information

• To create and secure your account, and authenticate sign-ins.
• To perform the credential and vendor verification workflows you submit data for, and to build the timestamped audit trail those workflows produce.
• To process subscription payments and communicate about your billing status.
• To send onboarding and product emails related to your account (see Section 4) — you can opt out of non-essential emails at any time.
• To understand aggregate feature usage and improve the Service, via privacy-preserving analytics.
• To detect, prevent, and respond to fraud, abuse, or security issues.

3. Who we share data with

We do not sell your data. We share data only with the service providers that operate the Service on our behalf, each acting under their own data-processing terms:

• Supabase — hosts our database, authentication, and file storage (for uploaded verification documents).
• Stripe — processes subscription payments and billing.
• Resend — delivers transactional and onboarding emails.
• Plausible Analytics — provides cookieless, aggregate usage analytics.
• Vercel — hosts the application and provides the network-routing metadata used to build audit-trail location data.

We may also disclose information if required by law, or to protect the rights, property, or safety of VendorGuard, our users, or others.

4. Your choices

You can review and update your account information from within the Service. Onboarding and product emails include an unsubscribe link; clicking it opts you out of non-essential email immediately. Transactional emails required to operate your account (such as billing receipts) are not affected by that choice.

You can request deletion of your account and associated data by contacting us. We will delete or anonymize your data within a reasonable time, except where we're required to retain records (for example, billing records for tax or accounting purposes).

5. Data retention

We retain account and verification data for as long as your account is active, and for a reasonable period afterward in case you reactivate it or as needed for legal, accounting, or audit-trail integrity purposes — since the audit trail's value depends on records not disappearing. We retain billing records as required by applicable tax and accounting law.

6. Security

We use industry-standard measures to protect your data, including encryption in transit, row-level access controls scoped to each account, and private (non-public) storage for uploaded verification documents, accessed only via short-lived signed links. No system is perfectly secure, and we can't guarantee absolute security.

7. Children's privacy

The Service is intended for business use by adults and is not directed at children under 16. We do not knowingly collect information from children.

8. International users

Our infrastructure providers may process and store data in the United States and other countries where they operate. By using the Service, you understand your information may be transferred to and processed in a country other than your own.

9. Changes to this policy

We may update this policy as the Service evolves. We'll update the “Last updated” date above when we do, and for material changes we'll make a reasonable effort to notify active account holders by email.

10. Contact

Questions about this policy or your data? Contact us at syint999@gmail.com.