Two different roles
This distinction determines most of what follows, so it comes first.
- For our own customers, we are the controller. When you create an account, we decide what account data we need and why.
- For the vendor data you upload, we are a processor. When your organisation records third-party vendors, their contacts and their compliance documents, you are the controller. We act on your instructions. If you are a vendor who received a request through Vendorroll and you want your details corrected or removed, contact the organisation that requested them — they control that record, not us. We will help them action it.
What we collect
Account data
- Name, work email address and organisation name
- The role assigned to you within your organisation
- Sign-in data, handled by Clerk: your email address and, if you sign in with Google, the name and address that account provides. Vendorroll does not use passwords; you sign in with a one-time code sent to your email or with your Google account.
Data you enter about your vendors
- Vendor company details and contact names and email addresses
- Compliance documents and contracts you or your vendors upload
- Questionnaire responses, approval decisions and internal notes
- Details read from uploaded documents by AI analysis (document type, issuer, dates and, for contracts, key terms), stored beside the document as suggestions
Operational data
- Audit records of actions taken in the platform, with actor and timestamp
- Server and application logs, used to operate and debug the service
- Basic product usage events, used to understand which features are used
We do not use third-party advertising or cross-site tracking, and we do not sell personal data.
Why we process it
- To provide the service — performance of our contract with you.
- To send operational email — vendor requests, reminders and alerts, which are the core function of the product.
- To keep the service secure and working — our legitimate interest in security, abuse prevention and debugging.
- To meet legal obligations — tax, accounting and lawful requests.
We do not send marketing email to vendor contacts your organisation uploads. They only receive messages relating to the compliance requests made of them.
Who else processes it
These are the third parties that process data on our behalf, and where they run. We will update this list before adding a new one.
| Subprocessor | Purpose | Data it can access | Where |
|---|---|---|---|
| Clerk | Sign-in, sessions and account security | Members' names and email addresses, and sign-in details such as device and IP address | United States |
| Supabase | The database and file storage that hold your organisation's data and uploaded documents, and the scheduled jobs that send reminders | All application data, including uploaded vendor documents | Sydney, Australia |
| Vercel | Application hosting | Data in transit through the application runtime | Application functions run in Sydney, Australia; Vercel's network delivers pages from locations near each visitor |
| Amazon Web Services (Amazon SES) | Sending transactional email | Recipient addresses, and the vendor and requirement names that appear in emails | Sydney, Australia |
| Amazon Web Services (Amazon Bedrock) | Reading uploaded documents and contracts to suggest their type, issuer, dates and key terms | The text of documents that are analysed | Called in Sydney, Australia; a request may be processed in another Asia-Pacific region (Tokyo, Osaka, Seoul, Singapore or Mumbai) |
Our security page lists the same subprocessors.
Payments
Subscriptions are paid through our payment partner, who acts as the seller of record and processes the payment. We never see or store card numbers. The partner receives what it needs to take payment, issue invoices and handle tax and refunds, such as your name, billing email, billing country and the plan you chose, and keeps it under its own privacy policy. We keep a record of your plan and payment status. See our refunds page for how refunds work.
AI processing of uploaded documents
When a document or contract is uploaded, its extracted text is sent to Amazon Web Services (Amazon Bedrock) to suggest its type, issuer, dates and key terms. That means the text of the document leaves our database and is processed by Amazon Web Services (Amazon Bedrock). Results are stored beside the document as suggestions with a confidence score; people review them, and they are not treated as fact. No other provider is sent document text.
We call Amazon Web Services (Amazon Bedrock) in Sydney, but Amazon may run a request in another Asia-Pacific region (Tokyo, Osaka, Seoul, Singapore or Mumbai) to keep the service available.
For an audit report such as SOC 2, the suggested date is the end of the audit period the auditor examined, and we treat the report as current for twelve months after it.
International transfers
Oopsie Technologies operates from India. Your organisation's data and uploaded documents are held in Sydney, Australia (Supabase), and our application functions run there too. Sign-in is provided by Clerk from the United States, so your email address and sign-in details pass through there. Where required, transfers rely on Standard Contractual Clauses or an equivalent mechanism. If you need data kept in a specific jurisdiction, our self-hosted deployment lets you choose the region yourself.
How long we keep it
- While your account is active — for as long as you use the service.
- After you leave — we delete your organisation's data, including uploaded documents, within 30 days of a deletion request.
- Records we must keep — invoicing records are retained where law requires it.
Your rights
Depending on where you are — including under the GDPR and India's Digital Personal Data Protection Act — you may have the right to access, correct, delete, port or restrict processing of your personal data, and to object to it.
Email privacy@oopsie.tech and we will respond within 30 days. If your data was uploaded by one of our customers, we will forward your request to them, since they control that record.
Cookies
We use cookies that are strictly necessary for the product to function — keeping you signed in and maintaining your session. We do not use advertising or cross-site tracking cookies, so there is no consent banner to click through.
Security
Tenant data is isolated at the database level, vendor portal tokens are stored hashed and expire, and all traffic is served over TLS. Our security page describes this in detail — including, in its own section, the protections we do not have yet.
Changes to this policy
If we make a material change we will update the date at the top of this page and notify account administrators by email before it takes effect. Our terms of service are a separate document.
Contact
Questions about this policy
Email privacy@oopsie.tech, including for security matters. We reply within 2 business days.
Oopsie Technologies