Privacy policy
Effective date: [to be set at launch]
Data controller
The data controller for personal data processed through VendorVault is THIME Holding OÜ, VAT ID EE102715730, Kotkapoja tn 2a-10, 10615 Tallinn, Estonia. For privacy requests, write to us through our contact form and identify your organization and the request.
1. What we process
- Account data: your organization name, your name and work email address, and a password stored in scrambled (hashed) form. We never store or display your password.
- Vendor contact details: the company name, contact email address, trade and notes that your team enters for each vendor. Reminder emails are sent to the vendor's contact email.
- Insurance and compliance documents: uploaded certificates and licenses (PDF, PNG or JPEG), with the requirement, coverage amount and expiry date recorded against them.
- Activity records: a log of uploads, vendor edits, role changes and exports, with who made them and when. Passwords and access tokens are never written to it.
- Billing: subscription status. Card details are entered with and held by Stripe; VendorVault does not store card numbers.
2. How we use it
We use this information to provide compliance tracking, send reminder emails to vendors and digest emails to your administrators, let vendors upload documents through their private link, keep an audit trail, secure the service, and bill your subscription. We do not sell personal data.
3. Vendors who use a portal link
Vendors do not create an account. A vendor who opens their portal link can see their own requirement statuses and upload documents. The link is a private key to that vendor's page, so anyone holding it can use it. You are responsible for sharing links only with the vendor's company, and a link can be replaced at any time.
4. Retention
[Retention periods for active accounts, vendor records, uploaded documents, activity logs and backups to be confirmed before launch.]
5. Export and deletion
You can export your vendors, documents and reports as CSV and zip files from within the app at any time, including on a read-only account. You can delete individual vendors in the app, and you can request deletion of your whole account and its data from your account settings or through the contact form. [Deletion timeline and backup purge schedule to be confirmed.]
6. Sub-processors
- Stripe: payment processing.
- [Cloud hosting provider: to be named.]
- [Transactional email provider: to be named.]
- [Database and object storage providers, if different from hosting: to be named.]
7. Security
Each organization's records and files are kept separate. Sign-ins last 60 minutes by default, password reset links are valid for 60 minutes and work once, and uploaded files are checked on arrival. Changing your password signs out every other session.
8. Your rights and regions
[Rights of access, correction and objection, and jurisdiction-specific terms (for example GDPR or CCPA), to be drafted by counsel.]
9. Changes and contact
We will update this page when our practices change. Questions about your data can be sent through our contact form.