Legal

Privacy Policy

Last updated: June 2026

1. Who we are

VendorLair is operated by Emre Polat, an individual based in Berlin, Germany (Claudiusstraße, 10557 Berlin). For the purposes of the General Data Protection Regulation (GDPR), Emre Polat is the data controller for personal data collected through this service.

If you have any questions about this policy or how your data is handled, please contact us through our contact form.

2. What data we collect

We collect the minimum data necessary to provide the VendorLair service:

Account data: your email address and password (stored securely via Supabase Auth)
Company name: optionally provided during signup
Vendor data: the vendor records you create, including company names, websites, categories, contact details, ratings, notes, and contract dates
Payment data: handled entirely by Stripe. We never see or store your card details.
Technical data: IP address and browser information collected automatically when you use the service

3. How we use your data

Your personal data (email address, account information) is used solely to:

Create and manage your VendorLair account
Send transactional emails such as password resets and account confirmations
Process your subscription payment via Stripe
Respond to support requests you send us

We will never sell, rent, or share your personal data with third parties for marketing purposes.

Regarding vendor data: The vendor records you create (company names, categories, ratings, and similar information) may be used by VendorLair in anonymized and aggregated form — for example, to understand which vendor categories are most common, or to provide industry benchmarking insights. This aggregated data is never linked to your account or personal identity. We do not access, read, or use the contact details or notes you store for your individual vendors.

4. Third-party services

VendorLair uses the following third-party services to operate:

Supabase (supabase.com) — database and authentication. Data is stored in EU (Ireland) servers.
Stripe (stripe.com) — payment processing. Stripe is PCI-DSS compliant and handles all payment data.
Vercel (vercel.com) — website hosting and deployment.
Resend (resend.com) — transactional email delivery (password resets, confirmations).
Google Fonts — font delivery. Loading fonts from Google's servers may transmit your IP address to Google.

Each of these providers has their own privacy policy and data processing agreements in place.

5. Legal basis for processing (GDPR)

We process your personal data on the following legal bases:

Contract performance: processing your account data and vendor data is necessary to provide the service you signed up for
Legitimate interest: using anonymized, aggregated vendor data to improve the service and provide market insights
Legal obligation: retaining payment records as required by German tax law

6. Data retention

We retain your personal data for as long as your account is active. If you delete your account, your personal data and vendor records will be deleted within 30 days. Payment records may be retained for up to 10 years as required by German commercial law (HGB).

7. Your rights under GDPR

As a user based in the EU, you have the following rights regarding your personal data:

Right of access: request a copy of the data we hold about you
Right to rectification: correct any inaccurate data
Right to erasure: request deletion of your data
Right to portability: receive your data in a machine-readable format (use the CSV export feature in your dashboard)
Right to object: object to processing based on legitimate interest
Right to lodge a complaint: with the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)

To exercise any of these rights, contact us through our contact form.

8. Cookies

VendorLair does not use tracking or advertising cookies. We use a single session token stored in your browser's local storage to keep you logged in. Google Fonts may set cookies when loading typefaces — we are working to replace this with self-hosted fonts to eliminate this entirely.

9. Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the date at the top of this page. Continued use of VendorLair after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or to exercise your rights, contact us through our contact form.