Privacy Policy

Effective October 12, 2026

This Privacy Policy explains how Leatherwood Enterprises (“we,” “us,” or “our”), the operator of Vendor Vault (the “Service”), collects, uses, and protects your information. By using the Service you agree to this Policy and to our Terms & Conditions.

1. Information we collect

Account information. When you sign up, we collect your email address and, if you sign in with Google, basic profile details Google shares (such as your name and email).

Business and inventory content. Information you add to run your booth — business name, branding, inventory items, prices, sources, sales records, and any images you upload.

Payment information. Subscription payments are handled by Stripe. We receive limited billing details (such as your subscription status and customer ID) but do not store your full card number.

Support requests. When you contact support, we collect the name, email, and message you provide so we can respond.

Technical data. Like most web apps, we and our providers automatically collect limited technical information, such as server logs and the essential cookies needed to keep you signed in. Only if you allow it on our cookie banner, we also collect usage analytics (such as the pages you visit and the buttons you use) and error reports (what went wrong, on which page, and your browser type), which we use to fix problems and improve the Service.

2. How we use your information

We use your information to provide and operate the Service, create and secure your account, process subscriptions and billing, respond to support requests, send you service and marketing communications (see Section 5), prevent fraud and abuse, and improve the Service.

AI features. Some features use artificial intelligence to help with tasks like analyzing item photos, reading receipts, and organizing categories, and some uploads are automatically screened for safety. These features are powered by third-party AI providers (see Section 4) that process the relevant content on our behalf. AI-generated content may contain errors or inaccuracies. Use judgment before relying on it for business, financial, or legal decisions.

3. Cookies and similar technologies

Strictly necessary (always on). These keep you signed in, keep the Service secure, and remember your cookie choice. Cloudflare Turnstile protects our sign-up and sign-in forms from bots. When you make a payment, our payment processors (Stripe, Square, and Cash App) run their secure checkout, which may set their own fraud-prevention cookies. The Service can’t work without these, so they don’t require your consent.

Analytics (only with your consent). With your permission, PostHog measures how the Service is used, for example page visits and which buttons are clicked. It stores an identifier in your browser to tell visits apart. Text you type and item details are not collected.

Error reporting (only with your consent). With your permission, Sentry sends us a report when something breaks in your browser, so we can fix it.

Your choice. Analytics and error reporting stay off until you click Accept All, or turn them on under Manage, on our cookie banner. If you decline or ignore the banner, they never run. You can change your mind any time: signed-in users under Settings → Cookies & Privacy, and anyone with the Cookie Settings link at the bottom of our home page and store shop pages. Turning analytics off also deletes its identifier from your browser. Your choice is remembered for 12 months. If you’re signed in, we also save it to your account, so events our servers send about your account follow the same choice.

We do not use advertising cookies or tracking pixels, and we do not sell or share your personal information for cross-context behavioral advertising.

4. How we share information

We do not sell your personal information. We share it only with service providers that help us run Vendor Vault, under agreements that limit their use of it: hosting and database (Supabase), application hosting (Vercel), payment processing (Stripe; and Square, when a store connects its Square account), email delivery (Resend), Google sign-in (when you choose it), bot protection on our sign-up and sign-in forms (Cloudflare Turnstile), product analytics (PostHog, only with your consent), error monitoring (Sentry, only with your consent for reports from your browser), and AI processing (Anthropic for AI-assisted features, and OpenAI for automated content-safety screening). If a store chooses to connect an optional integration, we share the data needed to run it with that provider — for example accounting sync (Intuit QuickBooks Online) or electronic signatures (DocuSign). We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a business transfer such as a merger or acquisition.

5. Email communications and your choices

We send service and transactional emails (account, security, billing, and password messages) that are necessary to use the Service. With your consent at signup, we also send marketing emails about features, tips, and offers. You can opt out of marketing emails at any time using the unsubscribe link in any marketing message or by contacting us through our support page; we honor opt-out requests promptly. Opting out does not stop necessary service emails.

6. Data retention

We keep your information for as long as your account is active and as needed to provide the Service. You can permanently delete your account at any time from your account settings in the app; doing so cancels your subscription and deletes your data — including your uploaded files — from our systems. If you close your account, we delete or de-identify your personal information within a reasonable period, except where we must keep it to meet legal, tax, or security obligations.

7. Security

We protect your data with measures including row-level access controls that keep each account’s data separate, private storage for uploaded images and documents, and encryption in transit. One exception: images placed in store newsletters are served from public, unguessable links so that email recipients can view them. No method of transmission or storage is perfectly secure, but we work to protect your information and to limit access to it.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain uses. You can exercise the two biggest ones yourself, any time, from your account settings in the app: download a copy of your data, or permanently delete your account. For anything else, contact us through our support page and we will respond as required by applicable law. You can also turn analytics and error reporting on or off at any time under Settings → Cookies & Privacy, or with the Cookie Settings link at the bottom of our home page and store shop pages. You will not be discriminated against for exercising your rights.

9. Children

Vendor Vault is intended for adults running a booth business and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

10. Where we operate

We operate the Service from the United States. If you access it from elsewhere, you understand your information is processed in the United States.

11. Changes to this Policy

We may update this Policy from time to time. We will update the effective date above and, for material changes, provide notice where appropriate. Your continued use of the Service after changes take effect means you accept the updated Policy.

12. Contact

Questions about your privacy? Reach us through our support page.

See also our Terms & Conditions. Need help? Contact support.

main · eac4227