Privacy · Updated 1 October 2026

Your information, explained.

Vendarity is operated by Oceanx Consulting Pty Ltd, ABN 67 615 055 368. This notice describes the current private evaluation. Use fictional supplier records while production storage, recovery and the policies for live customer data are being verified.

Information we handle

Account information includes your name, work email, authentication records, workspace membership and security activity. Workspace information includes company details, supplier contacts, document requests, evidence, review decisions and messages that authorized users provide. Billing information, when payments are enabled, includes your company address, expressly supplied tax identifiers, subscription status and invoice references.

Why we use it

We use this information to authenticate users, control access, operate the supplier-document workflow, provide requested reminders and reports, investigate faults and protect the service. An invited supplier’s contact details may be provided by the buyer requesting evidence. That buyer decides what evidence is needed and who can review it.

Who can see workspace information

Access depends on workspace roles and explicit supplier or auditor permissions. A buyer can retain evidence you submit and include it in authorized exports. Revoking future access cannot recall a copy someone has already downloaded. Service operators may need access to investigate a support or security issue.

Service providers and overseas processing

Hostinger hosts the application and database, and Cloudflare handles web traffic and network protection. Resend sends authentication emails. The selected document storage is private Backblaze B2 in US East; its production connection is still being verified. These arrangements do not provide Australian-only data residency. The application host’s physical location and the complete provider arrangements need confirmation before live supplier data is used.

Stripe will process payment and billing information when checkout is enabled. Card details are entered on Stripe’s hosted checkout, not stored in Vendarity. Customer-document AI extraction and SMS reminders are currently disabled. The planned providers are Google Gemini and Cellcast respectively; enabling them requires updated disclosures and verified processing arrangements.

Cookies and browser storage

The application uses cookies for sign-in and session security, and browser storage for interface preferences. Infrastructure providers may process connection information for security and delivery. The current application does not include advertising trackers.

Retention and deletion

The planned evidence policy defaults to five years after a document is superseded or its supplier is archived, with 1, 3, 5 or 7 years selectable by the buyer. Evidence still supporting an active requirement is retained. Planned account closure allows 30 days for read-only access and export, followed by deletion from the live service and up to 35 additional days in recovery backups.

Automated retention, complete account deletion and backup expiry are still undergoing implementation and verification. Do not rely on these schedules for real records during evaluation. Billing records, lawful holds, necessary security records and provider-held information may have different retention requirements. Deletion from every provider is not necessarily immediate.

Access, correction and privacy concerns

During private evaluation, contact the person who invited you to request access, correction or deletion, or to raise a privacy concern with Oceanx. Include the affected workspace and a description of the issue, without attaching sensitive documents. We may need to verify your identity and authority before releasing or changing records. A monitored public privacy contact will be published before live customer onboarding.

Changes to this notice will carry an updated date. Read the trust and data information and terms of use for the current service limits. Contact information is kept separately so it can be updated as support becomes available.