Privacy Policy

1. Scope and Our Role

This Privacy Policy explains how VendorStax, operated by Scenic Route Ventures LLC ("VendorStax," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you use our websites, applications, reservation tools, event-management tools, Show Spotlight, and related services.

VendorStax may process personal information in different roles:

• As a business or controller for information used to operate VendorStax accounts, billing, security, product analytics, marketing, and our direct relationship with users.
• As a service provider or processor for Organizers when we process Vendor, attendee, applicant, ticket-holder, check-in, communication, or event data on an Organizer's behalf. In those cases, the Organizer may determine why and how that information is used.

Organizers are responsible for their own privacy notices and for having a lawful basis to collect and use personal information they submit to VendorStax.

2. Information We Collect

Information you provide directly

• name, email address, phone number, business name, mailing or business address, and social profile information;
• account credentials and authentication information;
• Organizer profile information, event details, venue information, floor plans, vendor rules, sponsorship information, and team-member details;
• Vendor applications, reservation information, assigned spaces, waitlist status, badges, agreements, check-in records, and related event history;
• attendee ticket and registration information where an Organizer uses VendorStax ticketing features;
• Show Spotlight listings, messages, images, offers, wanted items, and other user-generated content;
• support requests, feedback, survey responses, and communications with us.

Payment and financial information

When payments or payouts are enabled, payment providers such as Stripe may collect payment-card details, bank-account information, identity-verification information, tax information, and transaction data. VendorStax may receive transaction status, payment identifiers, payout information, dispute information, and other information needed to operate the payment workflow. We do not need to store full payment-card numbers in order to provide the Services.

Information collected automatically

• IP address, browser type, device type, operating system, language, and approximate location derived from network information;
• pages viewed, referring pages, clicks, session activity, feature usage, and diagnostic logs;
• cookie identifiers, advertising identifiers, and similar technologies where enabled;
• security and fraud signals.

Information from third parties

We may receive information from payment providers, authentication providers, analytics providers, Organizers, Vendors, connected applications, and other services you choose to connect to VendorStax.

3. How We Use Information

We use personal information to:

• create and manage accounts and authenticate users;
• create, publish, and operate events and reservation workflows;
• process applications, reservations, payments, refunds, payouts, check-ins, tickets, badges, waitlists, and event communications;
• provide vendor-management, reporting, sponsorship, membership, Show Spotlight, and show-day features;
• provide customer support and respond to requests;
• secure the Services, prevent fraud, investigate abuse, and enforce our Terms;
• measure and improve performance, reliability, usability, and product features;
• send transactional messages and, where permitted, marketing communications;
• comply with legal, tax, accounting, regulatory, and contractual obligations;
• establish, exercise, or defend legal claims.

4. How We Disclose Information

We may disclose personal information to the following categories of recipients:

• Organizers, Vendors, attendees, and team members as needed to provide the event workflow requested by the user.
• Payment providers, including Stripe, for payment processing, connected-account onboarding, payouts, identity verification, fraud prevention, and disputes.
• Infrastructure and security providers that host, transmit, secure, or monitor the Services.
• Communication providers that send transactional or marketing email and other communications.
• Analytics and advertising providers used on our marketing sites or products, subject to applicable consent and opt-out requirements.
• Professional advisers, such as lawyers, accountants, insurers, auditors, and consultants.
• Government authorities or other parties where required by law, legal process, or to protect rights, safety, and security.
• Business transaction counterparties in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

We do not sell personal information for money. Some privacy laws may define certain analytics or advertising disclosures as a "sale," "sharing," or targeted advertising even when no money is exchanged. Where applicable, we provide rights to opt out of those practices.

5. Service Providers and Payment Partners

VendorStax uses third-party providers to operate the Services. Depending on the feature, these may include payment providers such as Stripe, hosting and database providers, security and network providers, email-delivery providers, authentication providers, and analytics services.

Stripe may collect and use personal information under its own agreements and privacy policy, including information required for payment processing, fraud prevention, Know Your Customer obligations, connected accounts, payouts, and financial compliance.

6. Cookies and Similar Technologies

We use cookies and similar technologies for security, authentication, preferences, performance, analytics, and, where enabled, advertising or campaign measurement. Our marketing website may use services such as Google Analytics and Meta technologies. Security providers may also use necessary cookies or similar technologies.

For more information, including how to manage non-essential technologies, review our Cookie Policy.

7. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain account and event history, comply with financial and legal obligations, resolve disputes, enforce agreements, prevent fraud, and maintain security.

Retention periods vary based on the type of information, the user's relationship with us, Organizer instructions, contractual obligations, and applicable law. Payment, tax, dispute, fraud, and audit records may need to be retained after an account or event is closed.

8. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These may include access controls, encryption in transit, monitoring, authentication controls, vendor security practices, and restricted administrative access.

No system can be guaranteed to be completely secure. Users are responsible for protecting their credentials and promptly reporting suspected unauthorized access.

9. Your Choices and Privacy Rights

Depending on where you live and which laws apply, you may have rights to request access to, correction of, deletion of, or a copy of your personal information, and to object to or restrict certain processing.

Residents of certain U.S. states may also have rights to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling, and may have a right to appeal a decision regarding a privacy request.

Where applicable, California residents may have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service when exercising privacy rights.

Where applicable, users in the European Economic Area, United Kingdom, or similar jurisdictions may have rights to access, correct, erase, restrict, object, receive data portability, and withdraw consent. They may also have the right to complain to a data-protection authority.

You may submit a privacy request through the VendorStax Contact page. We may need to verify your identity and authority before completing a request. If your request concerns information controlled by an Organizer, we may direct the request to that Organizer.

10. Advertising Choices and Global Privacy Control

Where required by applicable law, users may opt out of targeted advertising or disclosures treated as sale or sharing through available cookie or privacy-preference controls. Where legally required and technically supported, we will process recognized browser-based opt-out signals such as Global Privacy Control.

You can also configure browser settings to block or delete cookies, although doing so may affect functionality.

11. Children's Privacy

VendorStax business accounts and commercial reservation features are not directed to children under 13. We do not knowingly collect personal information directly from children under 13 for their own VendorStax accounts.

If an Organizer uses VendorStax for an event that involves minors, the Organizer is responsible for obtaining any consent required by law and for configuring its collection practices appropriately.

12. International Data Transfers

VendorStax and its service providers may process information in the United States and other countries. Where required, we use lawful mechanisms and safeguards for international transfers of personal information.

13. Organizer-Controlled Data

Organizers may upload or collect personal information about Vendors, applicants, attendees, sponsors, or staff. When VendorStax processes this information on behalf of an Organizer, the Organizer is responsible for the collection, use, and instructions it gives us, including required notices, consents, and responses to individual rights requests.

Users with questions about an Organizer's event-specific use of their information should contact that Organizer directly. VendorStax may assist the Organizer as required by contract or law.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in law, technology, products, or business practices. We will update the Effective Date and provide additional notice where required by law.

15. Contact and Privacy Requests

Questions or requests about this Privacy Policy may be submitted through the VendorStax Contact page. Please identify the nature of your request and the email address associated with your account or transaction so we can respond appropriately.

If applicable law gives you a right to appeal our decision on a privacy request, you may submit an appeal through the same contact method and identify the request as a privacy appeal.