DRAFT. This document is a draft under legal review and may change before VendorClerk accepts orders.

VendorClerk Privacy Notice

DRAFT. NOT LEGAL ADVICE. HAVE A LAWYER REVIEW BEFORE PUBLISHING. Placeholders: [LEGAL ENTITY NAME], [EFFECTIVE DATE], subprocessor list.

Effective date: [EFFECTIVE DATE]

This notice explains what [LEGAL ENTITY NAME] ("VendorClerk", "we") collects, why, and what you can ask us to do with it. We sell to businesses, so most of what we handle is business documents, not personal data.

What we collect

• Order details: your name, work email, company name, and order history.
• Payment: handled by Stripe. We see the amount, status, and the last four digits of your card. We never see or store your full card number.
• Your Materials: the questionnaire and documents you upload (for example policies, audit reports, trust pages, past answers), and the Drafts and answer library we create from them.
• Emails you send us.
• Basic website data: standard server logs (IP address, browser, pages visited). [Confirm: we do / do not use analytics or cookies beyond what's strictly necessary.]

How we use it

Only to: complete your order, keep your private answer library for future orders, send you order and support emails, process payment and refunds, keep required business and tax records, and protect the service from abuse. We do not sell your data, share it with other customers, use it for advertising, or use Your Materials to train AI models.

Who we share it with

Service providers that help us run the business, under confidentiality and data-processing terms: - Stripe (payments) - [AI model provider, under terms that prohibit training on customer data] - [File storage / hosting provider] - [Email provider]

We'll update this list before adding a new provider that handles Your Materials. We may also disclose information if the law requires it.

How long we keep it

• Your Materials, Drafts, and answer library: while you're a customer, or until you ask us to delete them. We delete them within 30 days of a request and confirm in writing. If you place no order for 24 months, we delete them automatically. [Confirm period.]
• Order and payment records: as long as tax and accounting law requires.

Security

We protect your files with access limited to the systems that process your order, encryption in transit, and encryption at rest provided by our storage provider. We're a small company and we do not currently hold a SOC 2 report or ISO 27001 certification. We'll tell you without undue delay if we learn of a breach affecting your data.

Your choices and rights

Email [email protected] to access, correct, export, or delete your data. Depending on where you live (for example California or the EU/UK), you may have additional rights under local law, and we'll honor them. [Lawyer: confirm GDPR/UK GDPR roles (controller vs. processor for Your Materials), international transfer mechanism, and CCPA/CPRA applicability.]

Changes

If we change this notice in a meaningful way, we'll update the date above and email active customers.

Contact

[LEGAL ENTITY NAME], [ADDRESS], [email protected]