Privacy Policy — Vendrshare

This Privacy Policy explains how Vendrshare Ltd (“we”) handles personal data when you use the Service. We’re the data controller for the personal data described below.

1. What we collect

Photographers

Email address, hashed password.
Studio / business name, public handle, optional logo.
Stripe Connect account identifier (we never see card details or full bank details — Stripe holds those).
The images, packs, and gallery metadata you upload.

Vendors (buyers)

Business name, business type, email address.
Optional contact name, website.
A signed cookie identifying which buyer record this browser is associated with on a per-gallery basis (see Cookies).
Records of which packs you bought and which images you redeemed.

Everyone

IP address and user agent (received automatically).
Basic analytics events, e.g. page views and conversion milestones (none combined with identifying data beyond the buyer email already provided).

2. Why we use it

Contract performance: to run the Service — uploads, watermarking, gate identification, payments, licence delivery, receipts.
Legitimate interests: to improve the Service, prevent abuse, and produce aggregate stats.
Legal obligation: tax records, fraud reporting, lawful requests.

3. Who we share data with

We use the following processors. Each is bound by a data processing agreement compliant with UK GDPR.

Supabase — database, authentication, file storage. Hosted in the EU (Ireland).
Stripe — payments processing, KYC/identity verification for photographers, payouts.
Resend — transactional email delivery (receipts, invitations).
Vercel — application hosting and edge delivery.

We never sell your personal data. We never share it with advertisers.

4. International transfers

Most processing happens within the UK / EEA. Where data is transferred outside the UK (e.g. Stripe US, Resend US) we rely on the UK International Data Transfer Addendum or Standard Contractual Clauses.

5. Retention

Account & transactional data: kept for the life of your account plus 7 years to satisfy UK tax / accounting law.
Images: kept until you delete them or close your account.
Buyer rows: kept indefinitely to honour past licences and re-download requests, unless deletion is requested.

6. Your rights (UK GDPR)

You can ask us to:

Confirm what data we hold about you.
Correct anything inaccurate.
Delete it (subject to lawful retention obligations — e.g. we must keep records of completed transactions).
Export it in a portable format.
Object to processing based on legitimate interest, or withdraw analytics consent.

Email hey@vendrshare.com and we’ll respond within 30 days. If you’re not happy with our response you can complain to the UK Information Commissioner’s Office (ico.org.uk).

7. Children

The Service is for B2B use. We do not knowingly process the personal data of anyone under 16.

8. Changes

We’ll update this page if our practices change and email account holders before any material change takes effect.

9. Contact

Vendrshare Ltd · hey@vendrshare.com