Privacy Policy

01Who we are and how to reach us

VendOrca, Inc. ("VendOrca," "we," "us") runs the VendOrca service. We are the data controller for our own website, account, and marketing data, and we act as a processor for the contingent-workforce data our customers put through the platform. Section 2 explains where each role applies.

For any question about this policy or your personal data, or to exercise any of your rights, contact us at info@vendorca.com.

Under Article 27 of the GDPR, people in the EEA and the UK can direct data-protection enquiries to us at info@vendorca.com, and we handle them directly.

02What personal data we collect

We collect the following categories of personal data:

• Account and profile data. The details of the people who use VendOrca, such as name, work email, job title, role and permissions, organization, and the settings and preferences on the account.
• Contingent-workforce data. The workforce data our customers run through the platform on their own behalf. This includes worker names and contact details, and assignment, timesheet, rate, and invoice data for the contractors and vendors a customer manages. We process this data for the customer and under the customer's instructions.
• Usage and technical data. Data generated as you use the service, such as IP address, device and browser details, log records, and cookies. Section 4 covers cookies in more detail.
• Contact and marketing data. Details from prospects and other people who get in touch or join our mailing list, such as name, email address, company, and the content of your message.

We do not intentionally collect special category data (for example health, race, or political opinions). We only hold such data if a customer supplies it within their workforce program data, in which case we process it for the customer as described above.

03How we use your data and our lawful bases

Under Article 6 of the GDPR we need a lawful basis for each purpose we process personal data for. Our purposes, and the basis for each, are:

• Providing the service to account holders. We process account and profile data to set up and run your account, authenticate you, and deliver onboarding, timesheets, approvals, invoicing, and the AI-powered configuration, reporting, and answers that make up the service. Our lawful basis is performance of our contract with you.
• Operating, securing, and improving the service. We process usage and technical data to keep the platform secure, prevent abuse, keep our systems running, and improve how the service works. Our lawful basis is our legitimate interests in the security, operation, and improvement of the service, balanced against your rights.
• Marketing and our mailing list. We use contact and marketing data to answer enquiries and, where you have joined our mailing list, to send you updates about VendOrca. Where we rely on your consent for marketing, you can withdraw it at any time.

For the contingent-workforce data we handle as a processor, the customer is the controller and sets the lawful basis for that processing. We act on the customer's documented instructions.

If we want to use your data for a new purpose that is not covered here, we update this policy and, where the law requires it, ask for your consent first.

04Cookies, analytics, and session recording

We use essential cookies to sign you in, keep your session secure, and operate the application. These cookies are strictly necessary to provide the service, so they do not require consent.

We use two analytics tools to understand how the service is used, so that we can run and improve it:

• Product analytics (PostHog). We measure which pages are visited and which product features are used. Inside the application, these events are tied to a pseudonymous identifier, your organization, and your role — not to your name or email address.
• Session recording (Microsoft Clarity). With your consent, Microsoft Clarity captures a replay of how our website and application are used in your browser — mouse movement, clicks, scrolling, and page navigation. We configure Clarity to mask the text you see and type, so the content of forms and pages is not readable in recordings, and recordings are tagged with pseudonymous identifiers rather than your name or email address.

Browser-based session recording runs only after you consent through the cookie banner on our website or in the application, and you can decline it there with one click. Declining does not stop you from using the core service. Separately, the service records product events on our own servers (for example, that a timesheet was approved) under our legitimate interest in operating and improving the service; these first-party records use pseudonymous identifiers and are not shared for anyone else's purposes. We do not use advertising or cross-site tracking cookies, and we do not build an advertising profile of you.

05How we share your data

We do not sell your personal data, and we do not share it for anyone else's advertising.

We use service providers that process personal data on our behalf, as processors under our instructions. This includes our database and hosting provider, Supabase, where account, application, and workforce program data is stored; PostHog (PostHog, Inc., US) for product analytics; and Microsoft Clarity (Microsoft Corporation, US) for consent-based session recording, as described in Section 4; along with other providers that support hosting, security, email, and support. These providers may only use the data to provide their service to us, and they are bound by contract to protect it.

We may also disclose personal data if the law requires it, to comply with a legal obligation or a valid request from an authority, or to protect our rights, our users, or the public. If VendOrca is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, and we will tell you before it happens.

06International data transfers

VendOrca is based in the United States, and our service providers may process your data there or in other countries. This means personal data from the European Economic Area or the United Kingdom may be transferred outside those regions.

Where we make such a transfer, we rely on the safeguards set out in Chapter V of the GDPR. Depending on the country, that means an adequacy decision, the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum. You can ask us for more detail about the safeguards that apply to your data by writing to info@vendorca.com.

07How long we keep your data

We keep account and profile data for as long as the account is active. We keep contingent-workforce data for as long as we provide the service to the customer, and we handle it according to the customer's instructions and our agreement with them. We keep contact and marketing data until you unsubscribe or ask us to remove it, or until it is no longer needed for the purpose we collected it.

When an account or customer agreement ends, we delete or return the associated personal data within a reasonable period, unless we have to keep a limited record to meet a legal obligation such as tax or accounting rules. If you ask us to delete your data, or you withdraw your consent where we rely on it, we act on your request promptly, subject to those same legal obligations. Technical logs that include data such as IP addresses are kept only for a short period for security and then deleted or anonymized.

08Your rights

If you are in the EEA or the UK, the GDPR gives you the following rights over your personal data. These are set out in Articles 15 to 22:

• Access. Ask for a copy of the personal data we hold about you.
• Rectification. Ask us to correct data that is wrong or incomplete.
• Erasure. Ask us to delete your data where there is no reason for us to keep it.
• Restriction. Ask us to pause our use of your data in certain cases.
• Portability. Ask for the data you gave us in a portable format, or ask us to send it to another provider.
• Objection. Object to processing we base on legitimate interests.
• Withdraw consent. Where we rely on your consent, withdraw it at any time. Doing so does not affect processing we carried out before you withdrew it.

To exercise any of these rights, email info@vendorca.com. We will respond within the time the law allows, normally one month. We will not charge you for a request or treat you differently for making one.

09Automated decision-making

We do not make decisions about you by automated means alone that produce legal effects or that similarly significantly affect you, within the meaning of Article 22 of the GDPR.

VendOrca is built so that its AI proposes changes and a person decides whether to apply them. The AI suggests configurations, reports, and actions, and a human keeps the final say. If we plan to introduce a solely automated decision that has this kind of effect on you, we will tell you first, explain the logic involved, and give you the safeguards the GDPR requires, including the right to ask for human review.

10Your right to complain

If you think we have handled your personal data wrongly, please contact us first so we can try to put it right. You also have the right to complain to a supervisory authority.

In the EEA, that is the data protection authority in the country where you live or work, or where the problem happened. In the UK, it is the Information Commissioner's Office (ICO). You do not have to raise the matter with us before you go to them, but we would welcome the chance to help.

11Changes to this policy

We update this policy as VendOrca develops and as our processing changes. When we make a change, we update the "Last updated" date above. If a change is significant, and we have your email, we tell you directly.

12Contact us

Questions about your data, or want us to update or delete it? Reach us at info@vendorca.com. VendOrca, Inc.