Privacy policy

Depending on how you use Vendors Eye, the service may process:

• Account and workspace details, including workspace name, organization size or level, and sign-in identity details.
• Your exposure profile, including environment, data types, traffic tier, and company name.
• Monitored sources and provider changes, together with source evidence and change reviews, decisions, notes, and assigned review context.
• Notification email addresses and notification preferences.
• For customer-authorized Slack alerts: Slack identifiers, selected channel details, and encrypted credentials needed to deliver those alerts.
• Enterprise inquiry form details: name, work email, organization, team size, provider interests, target timeline, and requirements.

Vendors Eye does not collect or store full payment-card numbers or card security codes. Paddle is the planned merchant of record and checkout is not currently enabled. If checkout is enabled, Paddle will process payment information under its published GDPR and PCI DSS compliance program. Paddle may share buyer details such as name, email address, country, and transaction or subscription status with Vendors Eye for software fulfilment and customer support. See Paddle’s privacy policy, GDPR information, and Trust Center.

We use these details to provide sign-in and workspace access, maintain exposure profiles, monitor and review provider changes, deliver notifications selected by a workspace, respond to enterprise inquiries, maintain service security, and support the operation of Vendors Eye.

Provider-change analysis may use Replicate or OpenAI to help produce analysis from monitored change material and selected exposure context. Customer-authorized Slack settings are used to deliver requested alerts, and email preferences are used for configured notifications.

Vendors Eye uses the following processors or service providers for the current product:

• Clerk for sign-in.
• Replit for hosting and database services.
• Resend for transactional email, including enterprise inquiry delivery.
• Replicate and OpenAI for provider-change analysis.
• Slack for alerts authorized by a customer.
• Paddle only if and when checkout is enabled; it is not currently configured.

Information shared with a provider is limited to what is needed for the relevant service function. Each provider may process information under its own terms and privacy documentation.

We retain workspace and review information while it is needed to provide the service, support its security, and honor applicable obligations. Retention periods may depend on the type of information and the operational context.

We use access controls and technical safeguards appropriate to the service, including encryption for Slack credentials. No method of storage or transmission can be described as perfectly secure.

Vendors Eye and its sign-in provider may use cookies or similar browser storage needed to authenticate users, maintain sessions, and protect account security. The current product does not use this information for behavioral advertising.

You can update notification preferences and workspace details through available product controls. To ask a question, request access, correction, or deletion, contact us at contact.vendorseye@tuta.io. We may need to verify the request and consider applicable legal or operational requirements.

Your rights can vary based on where you live. This policy does not limit rights that apply under local law.

We may revise this policy as the product and its processing change. The current version will be published on this page with its update date. Material changes may also be communicated through the service where appropriate.

Questions about privacy can be sent to contact.vendorseye@tuta.io.