Privacy Policy

1. Information we collect

Information you give us directly.

• Account info: name, business name, email, password (stored securely, hashed — we never see it in plain text)
• Profile info: bio, phone number, address/location, social links, category and accommodation needs (Vendors), venue and event details (Markets)
• Photos: a profile logo/photo, and for Markets, gallery photos of their event space
• Documents Vendors choose to upload: things like insurance certificates, permits, or food-safety credentials, used to apply to Markets
• Reviews and messages: star ratings and written reviews, and the subject/body of any market marketing campaign

Information from payments.

Payments are processed entirely by Stripe. We receive confirmation that a payment succeeded and basic transaction details (amount, date, which application or subscription it was for) — we never receive or store your full card number. Stripe's own privacy policy governs the payment information you give them directly.

Information collected automatically.

We use a session cookie to keep you signed in, and store your shopping cart (which Markets you're about to apply to) locally in your browser. We may also collect basic technical information (like general usage and error logs) to keep the Service running and fix problems.

2. How we use information

• To operate the marketplace — matching Vendor applications to Markets, processing fees and payouts, and running your dashboard
• To send transactional emails — application confirmations, approval/denial decisions, payment receipts
• To send marketing emails on a Market's behalf, only to Vendors who haven't opted out
• To maintain the security of accounts and the Service, and prevent fraud
• To improve the Service and understand how it's used

We don't sell your personal information.

3. How information is shared

With other users.

Your public profile (business name, bio, photos, location, and — for Markets — reviews) is visible to anyone browsing the Service. When a Vendor applies to a Market, that Market can see the Vendor's full profile and the documents relevant to that application. A Market's discount codes and campaign send history are visible only to that Market.

With service providers.

We use a small number of providers to run the Service, each only for the purpose of providing it: Stripe (payments and payouts), Supabase (our database, authentication, and file storage), Resend (sending emails), and Vercel (hosting). These providers process data on our behalf under their own security and privacy commitments — they don't get to use your data for their own purposes.

For legal reasons.

We may disclose information if required by law, or if we believe it's necessary to protect the rights, property, or safety of Vendor Highway, our users, or the public.

4. Storage and security

Your data is stored with Supabase (Postgres database and file storage), hosted in the United States. Uploaded documents live in a private storage bucket, accessible only to you and a Market you've actually applied to — not to other Vendors or the general public. Profile and gallery photos are stored in a separate, public bucket, since they're meant to be seen by anyone browsing the Service. No method of storage or transmission is 100% secure, but we take reasonable measures to protect your information.

5. Your choices

• Update or correct your profile information anytime from your dashboard
• Replace or remove uploaded documents and photos anytime
• Turn off marketing emails from Markets anytime from your dashboard — this doesn't affect emails about your own applications or payments
• Cancel a Pro membership or marketing subscription anytime, effective at the end of the current billing period
• Request a copy of your data, or request that we delete your account and associated data, by contacting us at support@myvendorhighway.com

6. Data retention

We keep your information for as long as your account is active. If you delete your account, we'll delete or anonymize your personal information, except where we need to keep records for legal, tax, or accounting reasons (for example, transaction records related to payments already made).

7. Children's privacy

The Service is intended for users 18 and older and isn't directed at children. We don't knowingly collect information from anyone under 18.

8. Changes to this policy

We may update this policy as the Service changes. If we make a material change, we'll post the update here with a new "last updated" date, and where practical, notify you by email.

9. Contact

Questions about this policy, or a data request? Reach us at support@myvendorhighway.com.