VendorCU is a product of SNE Interactive LLC. This notice explains what we collect when you visit vendorcu.com or use the VendorCU application at app.vendorcu.com, why we collect it, and who else sees it.
It covers two different relationships. If you are a visitor to our website, we hold very little about you. If your institution subscribes to VendorCU, we hold the data your workspace puts into the product, and your institution — not us — decides what goes in it.
If you only read the site, we collect the usage measurements described in section 6 and nothing else. We do not ask you to create an account to read it.
If you request a demo or a call, we collect the name, work email, phone number, institution and any comment you type, together with the times you say suit you and the time zone your browser reports. We use it to arrange and hold that call, and to follow up about VendorCU. We do not add you to a newsletter and we do not sell or rent it.
Account information: name, work email, the institution you belong to, your role, and whether you have enabled two-factor authentication. Passwords are handled by Google Identity Platform and are never visible to us.
Workspace content: the vendor records, contracts, invoices, documents, assessments and notes your institution enters or uploads. We call this Customer Data, your institution owns it, and we process it to run the service.
Operational records: sign-in times, actions taken in the product, AI usage counts and cost, and error logs. These exist so the service can be run, billed and secured.
When someone in your workspace uploads a document for extraction, or asks for portfolio analysis, the content of that document and the relevant vendor records are sent to Anthropic's API so a model can read them and return structured data.
Anthropic processes this on our behalf as a service provider. We do not use your Customer Data to train any model, and we do not permit it to be used to train a model.
Do not upload material you are not permitted to disclose to a third-party processor, and do not submit payment card numbers, Social Security numbers, member account numbers or other sensitive personal information. The product does not ask for any of those.
We keep this list short on purpose, and we update it when it changes:
We use Google Analytics to count visits and see which pages and screens are used. Google Signals and advertising personalisation are switched off, so this is not used for advertising and we do not build advertising profiles.
We do not send your identity to Google Analytics. No tenant identifier, workspace name, email address, user id or vendor name is included in what we send — only screen names and counts.
The application stores small amounts of data in your browser so it can keep you signed in and remember preferences such as your theme. reCAPTCHA sets what it needs to tell a person from a script.
You can block analytics with a browser setting or extension and the product will work normally. It is written so that a blocked analytics script can never cause an error.
Customer Data is kept for as long as your institution has an account. After termination you may export it, and we will make it available for 30 days on written request, after which we delete it, subject to backup cycles and any retention the law requires.
Demo and contact requests are kept for up to 24 months so we can follow up, unless you ask us to delete them sooner.
Operational logs are kept for a limited period for security and troubleshooting.
Data is encrypted in transit and at rest. Access is controlled by role, each workspace is isolated from every other at the database level, and administrative access is limited to the people who need it.
We support two-factor authentication through an authenticator app and we recommend every administrator enable it.
No system is impenetrable. If we confirm a breach affecting your data we will tell you without undue delay, and in any event within the period the law requires.
You can access and correct most of what we hold about you from within the product. You may ask us to delete a demo request or a contact record at any time.
If your institution is our customer, requests about Customer Data should come through your workspace administrator, because your institution decides what is held and for how long.
Depending on where you live you may have further rights over personal information, including access, correction, deletion and portability. Write to support@vendorcu.com and we will respond.
We do not sell personal information and we do not share it for cross-context behavioural advertising.
VendorCU is a business product and is not directed at anyone under 18. We do not knowingly collect information from children.
We will update this notice as the product changes, and the version date below will change with it. If a change is material we will tell customers by email or in the product.
Questions, requests, or anything that looks wrong: support@vendorcu.com, or write to SNE Interactive LLC.