For vendors

This document is a draft under attorney review. It is published so you can read what we intend to agree to, and it is not final.

GoodVendor Privacy Policy

[DRAFT for attorney review , not legal advice]

Last updated: August 2026

GoodVendor, Inc. ("GoodVendor," "we," "us," or "our"), a Delaware corporation, respects your privacy. This Privacy Policy ("Policy") explains how we collect, use, disclose, and protect personal information when you visit our website (https://goodvendor.com/) or use our marketplace and related services (collectively, the "Services"). GoodVendor is a marketplace where property owners and property managers ("Buyers") find, compare, question, and hire commercial property vendors ("Vendors"). Please read this Policy carefully.

By using our website or Services, you acknowledge that you have read and understood this Policy. If you do not agree with our practices, please do not access or use the Services.

1. Information We Collect

We collect the following categories of personal information, depending on how you use the Services:

Account and Identity Information. Name, email address, phone number, postal address, username and password, profile photo, company name and role, and any other information you provide when you register, complete a profile, or contact us.

Property Information. If you are a Buyer, we collect information about the properties for which you seek vendor services, including property addresses, property type, size, specifications, condition details, photographs, and related descriptions you provide or that we prefill from available property data sources (which you can review and correct before use).

Questions, Messages, and Communications. Questions you submit to Vendors, Vendor answers, chat messages exchanged in the engagement workspace, review requests and responses, and communications with our support team. Please remember that questions and messages you direct to a Vendor are delivered to that Vendor.

Files and Uploads. Documents, images, plans, scopes of work, and other files you upload to a listing, question, review, or engagement workspace.

Vendor Business Information. If you are a Vendor, we collect business name, business contact information, service categories and areas, descriptions, pricing information, professional license numbers and licensing details, certificates of insurance and related coverage information, and other credentials you submit in connection with your listing, claimed profile, or an application for a "Verified" badge. Some of this information (for example, a sole proprietor's name, license number, or contact details) may be personal information.

Payment and Subscription Information. If you purchase a Vendor subscription, our payment processor, Stripe, collects your payment card or bank information; that information is provided directly to Stripe and is subject to Stripe's privacy policy. We do not store full payment card numbers; we receive limited information such as card type, last four digits, billing contact details, and transaction, trial, and subscription status. Payments between Buyers and Vendors for engagements are currently made off the Platform. We do not process, hold, escrow, or record those payments. Where an engagement workspace shows pricing or payment milestone timelines, we store only the milestone and pricing entries that users themselves type in for their own tracking; those entries are not payment records and do not tell us whether any payment was actually made. If we introduce on-platform payments in the future, we will update this Policy and provide notice before that feature applies to you.

Communications Preferences and Consent Records. Your email and marketing preferences, your mobile phone number if you provide one, your SMS/text opt-in and opt-out status and the date, time, and method of each consent or opt-out, and delivery records for messages we send you. We keep these records to prove consent and honor opt-outs as required by the Telephone Consumer Protection Act and similar laws. We do not sell, rent, or share mobile numbers or SMS opt-in data with third parties or affiliates for their own marketing purposes; our messaging providers process this data only to deliver messages for us.

Usage and Device Information. IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, searches, clicks, time spent, and similar usage and log data collected automatically through cookies and similar technologies.

Inferences. We may derive inferences from the information above (for example, likely service needs or relevant vendor categories) to personalize and improve the Services.

2. Sources of Information

We collect information:

  • Directly from you, when you register, complete a profile, submit questions or reviews, upload files, chat, request Verified status, subscribe, or contact support.
  • Automatically, through cookies, pixels, analytics tools, and similar technologies when you use the Services.
  • From other users, for example when a Buyer submits a question, review, or engagement request concerning a Vendor, or when a Vendor responds to a Buyer.
  • From third parties and public sources, including: reviews and ratings about Vendors imported from Google and other public review platforms; property data providers used to prefill property details; state licensing boards, insurers, and other sources we consult to verify Vendor licenses and insurance; our payment processor (Stripe); and analytics and advertising providers.

3. How We Use Your Information

We use personal information to:

  • Provide, operate, maintain, and improve the Services, including listings, search, comparisons, questions and answers, reviews, and engagement workspaces;
  • Create and display Vendor profiles and deliver Buyer questions and requests to the Vendors you choose;
  • Perform manual license and insurance checks in connection with the "Verified" badge (a best-efforts review, not a guarantee , see our Terms);
  • Process subscriptions and transactions and send related communications;
  • Personalize your experience, including suggested vendors, suggested questions, and property data prefill;
  • Respond to inquiries and provide customer support;
  • Send service announcements, question and engagement notifications, review requests, billing and auto-renewal notices, and , subject to applicable consent and opt-out requirements , marketing communications by email and, where you have separately opted in, by text message;
  • Maintain records of your communications consents and opt-outs, and honor opt-out requests;
  • Perform analytics and measure the effectiveness of the Services;
  • Detect, investigate, and prevent fraud, abuse, fake reviews, and security incidents, and enforce our Terms;
  • Comply with applicable legal and regulatory obligations.

We also use de-identified and aggregated data (which does not identify you and which we maintain and use in de-identified form, without attempting to reidentify it) for any lawful purpose, such as market insights and content.

What we do not do. We do not use personal information collected through the Services to make or facilitate decisions about any individual's eligibility for consumer credit, insurance, employment, or housing, and we are not a consumer reporting agency; the Verified badge and other Platform information are not consumer reports under the Fair Credit Reporting Act (see Section 7(c) of our Terms). We do not use your information for automated decision-making that produces legal or similarly significant effects about you.

4. AI-Assisted Features

Some features of the Services use artificial intelligence, including AI-drafted scopes of work, AI-suggested questions, and AI property data prefill. When you use these features, the content you provide (such as property details, messages, and files in the relevant workspace) may be transmitted to and processed by our AI service providers to generate the output. AI outputs are assistive drafts only; they are not professional, legal, engineering, construction, or other expert advice, are not reviewed by a human before you see them, may contain errors or fabricated details, and must be reviewed and verified before use (see Section 12 of our Terms). Please do not submit privileged, trade secret, health, financial account, or government identification information to AI features.

AI providers. We contractually require our AI service providers to use your information only to provide services to us, to hold it in confidence, and to delete it on a defined schedule. We do not permit our AI service providers to use your personal information or your content to train their own generally available models.

Our own use. We may use content and usage data from the Services to develop, tune, test, and improve GoodVendor's own features and models (such as search, matching, suggested questions, and fraud detection), consistent with Section 9(c) of our Terms. Where we do this we use de-identified or aggregated data wherever reasonably practicable, and we do not use the substance of your private engagement-workspace messages or uploaded files to train models that generate output for other users without your consent.

No automated decisions with legal effect. We do not use AI or automated processing to make decisions that produce legal or similarly significant effects about you. Verified badge decisions are made by human reviewers.

5. How We Share Information

We do not sell your personal information for money. However, like most websites, we use third-party analytics and advertising cookies and pixels (see Section 7). Under the CCPA/CPRA and several other state privacy laws, our use of those advertising technologies may be treated as a "sale" or as "sharing" of personal information for cross-context behavioral advertising, even though no money changes hands. We therefore treat it that way and give you the right to opt out. To opt out, use the "Your Privacy Choices" link in our website footer, adjust your cookie preferences in our cookie banner or preference center, or send a Global Privacy Control signal from your browser; see Sections 7 and 10. If you opt out, we will stop disclosing your personal information to advertising partners for those purposes. We do not sell or share the personal information of individuals we know to be under 16. We do not sell, rent, or share mobile phone numbers or SMS/text-message opt-in data with any third party for that party's own marketing or promotional purposes. We disclose personal information as follows:

  • Between Buyers and Vendors. This is a marketplace: information you direct to another user is shared with that user. When a Buyer submits a question, review, engagement request, message, file, or property details to a Vendor, that content (including associated name, contact details, and property address as applicable) is delivered to that Vendor. Vendor profile information, answers, credentials summaries, and reviews are displayed publicly or to Buyers. GoodVendor does not control what recipients do with information you send them; share only what you are comfortable sharing.
  • Public content. Vendor listings, Verified badge status, side-by-side question-and-answer displays, and reviews (including reviews imported from Google) may be visible to all visitors.
  • Service providers. We share information with vendors that perform services on our behalf, under contracts limiting their use of your information to those services, including: payment processing (Stripe); cloud hosting and storage; AI model and infrastructure providers; email, SMS, and notification delivery; analytics; customer support tooling; and security and fraud prevention.
  • Verification sources. To perform license and insurance checks, we may share relevant Vendor information with, and receive information from, licensing authorities, insurers, and verification data sources.
  • Corporate transactions. In connection with a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred to the successor or counterparty, subject to this Policy.
  • Legal and compliance. If required by law, subpoena, court order, or valid governmental request, or where we believe disclosure is necessary to protect our rights, users, or the public, or to investigate violations of our policies or security threats.
  • Affiliates. With corporate affiliates under common ownership, consistent with this Policy.
  • With your consent or at your direction.

6. Reviews, Including Reviews Imported from Google

Vendor profiles may display reviews imported from Google and other public sources, together with first-party reviews collected through our review request features. Imported reviews may include the reviewer's public display name, rating, review text, and date as published on the source platform, and are labeled with their source.

First-party reviews you submit through GoodVendor are public, are associated with your display name, may be indexed by search engines, and may remain visible after you close your account. Do not include personal information about yourself or others in a review that you would not want published. Because a review is a public statement to and about other users, a deletion request under Section 10 may not remove a published review; we will consider such requests but may retain the review, remove identifying details, or anonymize it instead.

If you wrote a review on a third-party platform and want it changed or removed at the source, contact that platform , we cannot change content on a source platform, and removing it there does not automatically remove a copy we lawfully displayed. You may also contact us at the address in Section 15 about its display on GoodVendor. A Vendor that believes a review about it is false or unlawful should follow the notice-and-review procedure in Section 10(e) of our Terms; GoodVendor does not adjudicate factual disputes between a Vendor and a reviewer.

7. Cookies, Analytics, and Advertising

We use cookies, pixels, and similar technologies to operate the Services, keep you signed in, save preferences, measure performance, analyze how users interact with the Services, and support our marketing. We use:

  • Strictly necessary cookies, required to provide the Services (authentication, security, load balancing). These cannot be turned off.
  • Analytics cookies, to understand how the Services are used and improve them.
  • Advertising and retargeting cookies, including Google analytics and advertising services. Third-party vendors may use these cookies to serve GoodVendor ads to you on other sites based on your past visits to goodvendor.com.

As explained in Section 5, our use of advertising and retargeting cookies may constitute a "sale" or "sharing" of personal information under the CCPA/CPRA and similar state laws. You can opt out by (i) using the "Your Privacy Choices" link in our footer or our cookie preference center, (ii) enabling a Global Privacy Control or other recognized opt-out preference signal in your browser or extension, which we honor as a valid opt-out for that browser and, where you are logged in, for your account, (iii) managing cookies through your browser settings, or (iv) opting out of Google's interest-based advertising at https://www.google.com/settings/u/0/ads. Opting out of advertising cookies does not stop us from showing you non-targeted ads and does not affect the Services' core functionality.

Note that "Sponsored" and "Featured" placements on GoodVendor are paid positioning purchased by Vendors and are always labeled as advertising. They are ranked by subscription tier and relevance, not by tracking your activity across other websites, and opting out of advertising cookies does not change which Vendors appear as Sponsored or Featured.

8. Data Retention

We retain personal information for as long as reasonably necessary to provide the Services, comply with legal, tax, and accounting obligations, resolve disputes, enforce agreements, and maintain security and fraud-prevention records. In general: account information is retained while your account is active and for a reasonable period after closure; engagement workspace content, messages, and files are retained while relevant to the account and any active or recent engagement; Vendor license and insurance verification records are retained as long as the related badge or listing is active plus a reasonable audit period; usage logs are retained for shorter operational periods; and records of your email and SMS consents and opt-outs are retained for at least four years after the consent or opt-out, or longer if a longer limitations period applies, so that we can demonstrate compliance with the Telephone Consumer Protection Act and similar laws. Published reviews, answers, and Listing content may be retained and displayed after an account closes, as described in Sections 6 and 10 and in our Terms. When retention is no longer necessary, we delete or de-identify the information.

9. Security

We implement commercially reasonable technical, administrative, and physical safeguards designed to protect personal information. However, no system is completely secure, and we cannot guarantee the security of information transmitted to or through the Services. Protect your login credentials, use appropriate security software, and contact us immediately at privacy@goodvendor.com if you believe your interaction with us is no longer secure.

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

  • Access / Right to Know: request a copy of, or information about, the personal information we have collected about you, including categories collected, sources, purposes, and categories of recipients.
  • Correction: request that we correct inaccurate or incomplete personal information.
  • Deletion: request deletion of your personal information, subject to legal exceptions (for example, records we must keep for security, legal compliance, or completing a transaction you requested).
  • Portability: request your personal information in a portable, machine-readable format.
  • Opt out of sale/sharing: we do not sell personal information or share it for cross-context behavioral advertising; if that ever changes, we will update this Policy and provide the required opt-out mechanisms first.
  • Limit use of sensitive personal information: we do not use or disclose sensitive personal information for purposes requiring a right to limit under the CCPA/CPRA.
  • Non-discrimination: we will not discriminate against you for exercising your rights.
  • Objection and restriction: where applicable law provides, object to or request restriction of certain processing.

How to exercise your rights. Email privacy@goodvendor.com, use the request mechanisms available in your account settings, or use the "Your Privacy Choices" link in our website footer (for opt-out requests). We will verify your identity before acting on a request (typically by matching information you provide against our records, and, for sensitive requests, by requiring you to be signed in to the account at issue) and respond within the time required by applicable law , generally within 45 days, extendable once by an additional 45 days with notice, and within 15 business days for opt-out requests. You may designate an authorized agent to make a request on your behalf; we may require written proof of the agent's authority (such as a signed permission or power of attorney) and separate verification of your identity. If we deny your request in whole or in part, we will tell you why and how to appeal. You may appeal by replying to our response or emailing privacy@goodvendor.com with "Appeal" in the subject line; we will respond to an appeal within 45 days (or the shorter period your state requires) and, if we deny the appeal, we will provide a method to contact your state attorney general. We do not charge a fee for the first two requests in a 12-month period.

Note that some information cannot be fully deleted where doing so would remove content another user legitimately holds (for example, a message, file, or question you already sent to a Vendor), where the information is part of a published review or answer that other users rely on, or where we must retain records for legal, tax, security, or dispute-resolution purposes. Deleting your account does not automatically delete reviews you wrote or answers you published; see Section 6 and our Terms.

10.1 Categories of personal information (CCPA/CPRA notice at collection)

In the 12 months preceding the "Last updated" date, we have collected the following statutory categories, from the sources in Section 2, for the purposes in Section 3, and disclosed them for a business purpose to the recipient categories in Section 5:

| CCPA category | Examples we collect | Disclosed for a business purpose to | |---|---|---| | Identifiers | Name, email, phone, postal address, IP address, account ID | Service providers; other users you direct content to | | Customer records (Cal. Civ. Code Section 1798.80) | Name, contact details, billing contact, business details | Payment processor; service providers | | Commercial information | Subscription tier and history, services sought or offered, Engagement records, pricing and milestone entries | Payment processor; service providers | | Internet or network activity | Browsing, searches, clicks, pages viewed, device and log data | Analytics and advertising providers; hosting | | Geolocation (approximate) | City/region inferred from IP; property and service-area locations you enter | Service providers; Vendors you contact | | Professional or employment-related information | Company, role, license numbers, insurance and credential details | Verification sources; service providers; public display on Listings | | Audio/visual information | Photos, plans, documents, and files you upload | Other users you share them with; hosting and AI providers | | Inferences | Likely service needs, relevant vendor categories | Service providers | | Sensitive personal information | Account login credentials (username and password) | Not disclosed except to hosting/security providers |

Sensitive personal information. The only category of "sensitive personal information" we routinely collect is your account log-in credentials, which we use solely to authenticate you and secure your account , a use that falls within the CCPA's business-purpose exceptions. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit under the CCPA/CPRA, and we do not collect government identification numbers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, health, genetic, biometric, or sex-life information for these purposes. Do not submit that information to the Services.

Retention. We retain each category for the periods described in Section 8.

10.2 State-specific notes

  • California. Rights to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and non-discrimination, as described above. California residents may also request information under the "Shine the Light" law (Cal. Civ. Code Section 1798.83) about disclosures to third parties for their own direct marketing; we do not make such disclosures. California users may contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or (800) 952-5210.
  • Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws. Rights to confirm/access, correct (where provided), delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not engage in such profiling. Colorado, Connecticut, Texas, Oregon, and Montana residents may exercise opt-outs via a universal opt-out mechanism, including Global Privacy Control. Appeal rights are described above.
  • Texas and Oregon. On request, we will provide a list of the specific third parties (Oregon) or categories of third parties (Texas) to which we have disclosed personal information.
  • Florida. Florida residents have rights under the Florida Digital Bill of Rights (Fla. Stat. Section 501.701 et seq.) to the extent it applies to us; we will honor access, deletion, correction, portability, and opt-out requests from Florida residents on the same terms described above.
  • Nevada. Nevada residents may direct us not to sell certain covered information as defined in Nev. Rev. Stat. Chapter 603A by emailing privacy@goodvendor.com. We do not sell covered information for monetary consideration.
  • Where you are located. The Services are offered only in the United States and are intended for U.S. business users. We do not knowingly offer the Services to individuals in the European Economic Area, the United Kingdom, or Switzerland, and this Policy does not describe rights under the GDPR. Information we collect is processed and stored in the United States.

10.3 Data breach notification

If we become aware of a security incident affecting your personal information, we will notify you and the applicable regulators as and when required by state breach-notification law.

11. Children's Privacy

The Services are intended for business use by adults. Our Terms require users to be at least 18 years old. The Services are not directed to minors, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will take reasonable steps to delete it and close the account; a parent or guardian may contact us at privacy@goodvendor.com to request deletion. We do not knowingly sell or share (as those terms are used in Section 5) the personal information of consumers under 16, and we have no actual knowledge of doing so.

12. Third-Party Sites and Services

The Services link to and integrate with third-party websites and services, including Vendor websites, Google (for imported reviews and sign-in, if offered), and Stripe (payment processing, subject to Stripe's privacy policy). We are not responsible for the privacy practices of third parties, and this Policy does not apply to information you provide directly to them. We encourage you to review their policies.

13. Do Not Track and Preference Signals

Some browsers transmit "Do Not Track" signals; because no common industry standard has been adopted, we do not respond to Do Not Track signals, but where required by law we honor recognized opt-out preference signals such as Global Privacy Control, as described in Section 7.

14. Changes to This Privacy Policy

We may update this Policy from time to time. Changes will be posted on this page with a revised "Last updated" date, and we will provide additional notice of material changes where required by law. Your continued use of the Services after the effective date of a revised Policy indicates your acceptance of it.

15. Contact Us

If you have questions or concerns about this Policy or our data practices, contact us:

  • Email: privacy@goodvendor.com
  • Mail: GoodVendor, Inc., Attn: Privacy, [street address to be confirmed]
  • Privacy choices: use the "Your Privacy Choices" link in the footer of goodvendor.com

Note to counsel: the mailing address previously shown here (5201 Waterford District Dr, Ste 260, Miami, FL 33126) was carried over from the base template and is not GoodVendor's address. A confirmed address must be inserted here and must match the addresses used in the Terms of Service (Sections 16, 21(d), and 24) before publication. Several state privacy laws require a toll-free number or a second designated request method for businesses that operate offline , confirm applicability.

For more information about the rules governing use of the Services, please see our Terms of Service.