Security and Service Providers

How we protect your data, who helps us run MyVendbook, and how to report a problem. Effective October 16, 2026.

Draft for legal review. Items highlighted in blue need your details. Have an attorney review these pages before launch, then remove this notice.

Security

How we protect your data and how to report a problem.

Encryption in transit; passwords are salted and hashed.
Per-user access controls, rate limits and activity logging.
Team logins: what each role can see and change is enforced on our servers, not just hidden on screen. Invite links work once, expire after 7 days and are stored only as a one-way hash. Removing a teammate signs them out immediately.
Only the facts you choose to share are ever shown to other members.
Report a vulnerability to [email protected]. We will acknowledge within [3] business days and will not take action against good-faith research.

Who processes data on our behalf.

We use these types of providers. [Replace with your actual vendors before launch.]

Anthropic, for VendyAI answers and web search.
Your browser maker's speech-recognition service (Google, Microsoft or Apple), only if you choose to speak to VendyAI. It is run by the browser maker, not by MyVendbook.
[Hosting and database provider], to run and store the service.
[Email delivery provider], to send email.
[SMS provider], to deliver text messages.
Stripe, to process payments and subscriptions. We do not store full card numbers.
[Error monitoring provider], to find and fix problems.

We require providers to protect your data and use it only to provide their service to us.