Privacy policy

What we keep

• Your account: email and password. The password is stored only as a hash; we never know it. If you set a name, avatar or language, we keep those too.
• Your company: its name, currency, VAT settings, plan, members and invite links.
• What you upload and create: price list files, suppliers, products, prices, product matches and orders.
• Visit statistics: which pages of the site were opened, which site you came from (its address only), utm tags in the link, language, the sign-up steps and the first price list upload. To connect a visit with a sign-up, the browser keeps a random number in a cookie. Your IP address is not recorded in the statistics.
• Attempt counters: how many times in the last hour someone from one network address, or for one email, tried to sign in or asked for an email. The address and email in them are stored as hashes.

Why

To run the service: to show your price lists, price changes and orders only to you and your colleagues. Your email is used for sign-in emails: confirming the address and resetting the password. Statistics show us where people come from and where they get stuck. Attempt counters protect accounts from password guessing and inboxes from unwanted emails.

We do not sell data, do not show ads, and do not use your price lists and prices for anything but your company's work in Vendalign.

Who else processes data

The services Vendalign runs on. Each one gets only what its part of the work needs:

• Vercel — the site and the app, USA;
• Supabase — the database, files and sign-in, on Amazon Web Services servers in the USA;
• Resend — sign-in emails;
• Cloudflare — the domain, the "not a robot" check (Turnstile) on the sign-in and sign-up forms, forwarding mail sent to hello@vendalign.com;
• Google — the mailbox that receives mail sent to hello@vendalign.com;
• GitHub — the nightly database backup, encrypted.

So your data is stored and processed outside your country, including in the USA.

Cookies

Our own cookies keep you signed in, remember your language and time zone, and carry a random visitor number for statistics, for half a year. There are no advertising cookies and no third-party analytics. Cloudflare's "not a robot" check runs only on the sign-in and sign-up forms.

How long we keep it

• your account and company data — for as long as the account and the company exist;
• visit statistics — 13 months, then they are deleted automatically;
• attempt counters — up to a day;
• backups — 14 days: whatever is deleted is gone from them within that time.

Changing or deleting your data

Change your name, avatar and password in Settings, where you can also delete your account. A company where you are the only member is deleted with all its price lists and orders. If the company has other members, its data stays with them; an owner first hands the company over to one of them.

To get a copy of your data or ask about it, write to hello@vendalign.com. We reply within 30 days.

Changes

If this policy changes significantly, we will email the account's address before the change takes effect.