Privacy Policy

1. Who we are and scope

Vector Stack LLC is a Florida limited liability company operating under the VectorStack brand ("VectorStack," "we," "us," or "our"). This Privacy Policy applies to vectorstack.us and to products, applications, support channels, and other services that display or link to it (collectively, the "Services").

This policy does not apply where a separate privacy notice is presented, including a product- or integration-specific notice. It also does not govern independent third parties, customer-operated storefronts, or services that do not link to this policy.

2. Our privacy roles

For information about visitors, business contacts, customers, account administrators, and authorized users, VectorStack generally determines why and how the information is processed and acts as a controller or business under applicable privacy law.

When a business customer submits or connects information about its own customers, employees, or other individuals to the Services ("Customer Data"), VectorStack generally processes that information on the customer's instructions as a processor or service provider. The customer remains responsible for its notices, permissions, lawful basis, and responses to individual requests. Requests concerning Customer Data should normally be directed to the relevant customer.

3. Information we collect

The information we collect depends on how you interact with the Services and may include:

• Identity and contact information: name, business name, title, mailing address, email address, telephone number, and account identifiers.
• Account and authentication information: username, hashed or otherwise protected credentials, permissions, organization membership, login records, and security verification data.
• Commercial and transaction information: service plan, order and subscription details, billing status, invoices, transaction history, and limited payment-related information received from payment providers.
• Customer Data and service content: data, files, catalog records, marketplace information, communications, and other content submitted to or synchronized with the Services by a customer or authorized integration.
• Device, network, and usage information: IP address, browser and device type, operating system, referring URL, pages or features used, timestamps, session activity, diagnostic events, and approximate location inferred from IP address.
• Communications: support requests, feedback, survey responses, emails, meeting details, and other correspondence with us.
• Integration information: account identifiers, authorization scopes, tokens, settings, and operational data received from services you choose to connect.
• Professional information: employer, role, business contact details, and information relevant to a commercial relationship or job inquiry.

We ask that you not send sensitive personal information unless it is necessary for an authorized use of the Services and appropriate safeguards are in place.

4. Sources of information

We collect information directly from you; from your employer, organization, account administrator, or other authorized user; automatically from your browser, device, and use of the Services; from marketplaces, platforms, and other integrations you authorize; from vendors that support our operations; and from publicly available or commercially available business sources where permitted by law.

5. How we use information

We use personal information to:

• provide, operate, configure, maintain, and improve the Services;
• create and administer accounts, authenticate users, and manage permissions;
• process transactions, subscriptions, invoices, and related records;
• connect authorized integrations and perform customer-requested workflows;
• respond to inquiries, provide support, and communicate service and policy updates;
• monitor performance, troubleshoot problems, develop features, and understand service usage;
• secure the Services, prevent fraud and abuse, investigate incidents, and enforce agreements;
• comply with law, valid legal process, and regulatory or contractual obligations;
• establish, exercise, or defend legal claims and protect rights, safety, and property; and
• send marketing communications where permitted, subject to your right to opt out.

We may aggregate or de-identify information and use it for lawful business purposes. We will not attempt to re-identify information that applicable law requires us to maintain as de-identified.

6. Legal bases for processing

Where a legal basis is required, we process personal information as necessary to perform a contract or take requested pre-contract steps; to comply with legal obligations; for legitimate interests such as providing, securing, improving, and supporting the Services; with consent; and, when necessary, to protect vital interests or establish and defend legal claims. You may withdraw consent at any time, without affecting processing already completed.

7. How we disclose information

We may disclose information:

• To your organization: account administrators and other authorized users may access information associated with an organizational account.
• To service providers: hosting, infrastructure, communications, payment, support, analytics, security, professional advisory, and other vendors may process information under contractual restrictions.
• At your direction: we disclose information to marketplaces, carriers, financial systems, or other services when you enable an integration or direct a workflow.
• For legal and safety reasons: we may respond to valid legal process, enforce terms, investigate fraud or security issues, and protect the rights, property, and safety of VectorStack, our customers, and others.
• In a business transaction: information may be disclosed in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate safeguards.
• With consent: we may disclose information for another purpose that we explain when obtaining your consent.

8. Sale, sharing, and targeted advertising

VectorStack does not sell personal information for money. We do not use personal information from the corporate website for cross-context behavioral advertising. If our practices change in a way that creates an opt-out right under applicable law, we will provide the required notice and method to exercise that right before engaging in the new practice.

We do not use or disclose sensitive personal information to infer characteristics about individuals or for purposes that require a right to limit under applicable law.

9. Cookies and similar technologies

Our websites and applications may use cookies, local storage, pixels, and similar technologies to keep services secure, remember settings, understand performance, and support requested functionality. The corporate site at vectorstack.us does not use advertising cookies or analytics scripts as of this policy's effective date. Product applications may use strictly necessary authentication and security technologies.

For details about categories, duration, and available controls, see our Cookie Policy.

10. Data retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy, including to provide the Services, maintain business and transaction records, comply with legal and contractual obligations, resolve disputes, prevent abuse, and enforce agreements. Retention periods vary based on the type and sensitivity of information, customer instructions, operational need, legal requirements, and whether information is needed for an active claim or investigation.

When retention is no longer required, we delete, de-identify, or securely dispose of information. Residual copies may remain in protected backups until they are overwritten under ordinary retention cycles.

11. Information security

We maintain administrative, technical, and organizational safeguards designed to protect information against unauthorized access, use, alteration, disclosure, and destruction. Safeguards are selected based on risk and include access controls, encryption, monitoring, secure development practices, endpoint and network protections, backups, incident response, and personnel responsibilities.

No method of transmission or storage is completely secure. Please protect your credentials, use multi-factor authentication where offered, and notify us promptly of suspected unauthorized access. Additional details are available in our Information Security Policy.

12. International data transfers

VectorStack is based in the United States. Information may be processed in the United States and other countries where we, our customers, or our service providers operate. These locations may have privacy laws different from those in your jurisdiction. Where required, we use recognized transfer mechanisms and contractual, technical, or organizational safeguards for international transfers.

13. Your privacy rights and choices

Depending on where you live and subject to legal exceptions, you may have the right to request access to, correction of, deletion of, or a copy of your personal information; obtain data portability; restrict or object to processing; withdraw consent; opt out of certain sale, sharing, targeted advertising, or profiling; and appeal a denied request. You may also opt out of marketing email by using the unsubscribe link or contacting us.

Submit a request to it@vectorstack.us. Please describe your request and the Service involved. We may need to verify your identity and authority before responding. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity. We will not unlawfully discriminate against you for exercising a privacy right.

If VectorStack processes the relevant information solely for a customer, we may direct your request to that customer or assist the customer in responding. You may also have the right to complain to your local privacy or data protection authority.

14. Additional U.S. state disclosures

For residents of states that require category-level disclosures, the categories of personal information described in Section 3 may correspond to identifiers; customer records; commercial information; internet or electronic network activity; approximate geolocation; professional information; and inferences drawn from service activity. We collect these categories from the sources in Section 4, use them for the purposes in Section 5, and disclose them to the recipients in Section 7.

We do not sell these categories for money. During the preceding twelve months, we have not knowingly sold or shared for cross-context behavioral advertising the personal information of consumers under sixteen years of age. We retain each category according to the criteria in Section 10.

15. Children's privacy and third-party services

The Services are designed for businesses and are not directed to children under thirteen or the higher minimum age required by local law. We do not knowingly collect personal information directly from children for their own use of the Services. If you believe a child has provided personal information to us, contact us so we can review and take appropriate action.

The Services may link to or integrate with third-party services. Their privacy practices are governed by their own notices, and we encourage you to review them before providing information.

16. Changes and contact

We may update this policy to reflect changes in our practices, Services, or legal obligations. We will post the revised policy at this URL and update the effective date. Where required, we will provide additional notice or obtain consent before a material change takes effect.