Privacy policy
TL;DR
1. What we collect
Account information
When you sign up, we collect your name, work email, company name, role (developer or supplier), and an authentication credential (a password hash). For paid accounts we also collect billing contact, payment method tokens (we don't store full card numbers — Stripe does), and tax IDs.
Marketplace activity
We collect everything required to operate sealed-bid procurement:
- RFQs you post: specifications, criteria, weights, deadlines, audience, attached documents
- Bids you submit: pricing, lead times, freight terms, certifications, cover messages
- State transitions: edits, withdrawals, awards, rejections, with timestamps and actor
- Messages and document exchanges between buyers and suppliers
Product analytics
Pages you visit, features you use, errors encountered, and basic device/browser info. Self-hosted Plausible — no third-party tracker. We do not use behavioral ad-tech.
2. Why we collect it
| Purpose | Legal basis (GDPR-style) | Data used |
|---|---|---|
| Operate the marketplace | Contract | Account, RFQ, bid, documents |
| Bill paid accounts | Contract | Billing, tax, payment tokens |
| Prevent fraud & abuse | Legitimate interest | Activity logs, IP, device |
| Improve the product | Legitimate interest | Aggregated analytics |
| Send transactional emails | Contract | Email, RFQ/bid context |
| Send marketing emails | Consent (opt-in) | Email, segment |
| Comply with legal obligations | Legal obligation | As required by subpoena/court order |
3. Who we share with
We share data with: (a) the counterparty in any RFQ — buyers see suppliers who bid on their RFQs after close; suppliers see buyers whose RFQs they're bidding on; (b) sub-processors required to operate the platform (currently AWS, Stripe, Resend, and Sentry); (c) law enforcement when legally compelled, with notice to you where lawful. We do not sell, lease, or share data for advertising. Aggregated, de-identified market statistics may be published in research reports.
4. Retention
- Active account data: retained while your account is active.
- Awarded RFQ records (audit trail): 7 years from award date by default — required for procurement audit.
- Sealed bids that never closed: deleted 90 days after RFQ cancellation/expiry.
- Backups: 30 days rolling.
- Account deletion: on request, account is anonymized within 30 days; awarded-RFQ audit-trail records are retained but anonymized as required by law.
5. Your rights
You can access, export, correct, or delete your data at any time. Export is JSON + supporting PDFs, generated within 24 hours of request. Deletion is processed within 30 days; some records may be retained as required by law (anti-fraud, tax, audit). Email privacy@vulmont.com or use the in-app self-serve in Account → Data.
If you're in California, you have specific rights under CCPA. If you're in the EU/EEA or UK, GDPR-equivalent rights apply. We do not require you to be in those jurisdictions to exercise these rights.
6. Cookies & trackers
The marketing site uses two cookies: a session cookie and a CSRF token. Both are first-party, no analytics SDKs, no third-party trackers, no advertising pixels. The product app uses a session cookie. We display a one-time consent banner for EU/UK visitors per ePrivacy.
7. International transfers
Production data is stored in AWS us-east-1 (Northern Virginia) with replicas in us-west-2 (Oregon). For users outside the US, data is transferred to the US under Standard Contractual Clauses; our DPA includes the relevant SCC module.
8. Children
The product is for business use. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it.
9. Changes
We may update this policy. Material changes are announced 30 days in advance via email and an in-app banner. Past versions are archived at vulmont.com/legal/archive.
10. Contact us
Privacy questions: privacy@vulmont.com. Data Protection Officer: dpo@vulmont.com. Mail: Vulmont, Inc., 99 Hudson St 4F, New York NY 10013, USA. EU/UK Representative: contact us for current details.