Privacy Policy · Vendor Runway

1. Information you give us

Your account: your name and email address. Your password is kept by our sign-in provider and we never see it. If you sign in with Google, we receive your name, email address and profile picture from Google.
Your business: its legal name, any other name it uses, address, phone, email, website, certifications, letterhead and logo, and the settings you choose.
Your team: the names, email addresses and mobile numbers of the people you add.
Your work: the requests, files, quotes, vendor prices, purchase orders, invoices, orders and notes you put into the service, and the emails that you, your buyers or your vendors send to your address in the service.
The member list, if you use it: your listing, the needs you post, and the messages you send other customers and receive from them through it.
Messages you send us through the Contact page.

Your work often holds the names and contact details of other people, such as a buyer at an agency or a salesperson at a vendor. You are responsible for having the right to put that information into the service. We handle it only to provide the service to you.

When you dictate a request, the recording is turned into text and the recording is not kept.

Payment for a plan is taken by our payment processor. We receive the status of your payment and your plan. We do not receive or keep your full card number.

2. Information collected automatically

Technical records: the internet address of your device, the type of browser, the pages and actions requested, and the date and time. We and our hosting provider use them to run the service, keep it secure, limit abuse and find faults.
Storage in your browser: the service keeps your sign-in and a few of your choices in your browser's own storage, so that you stay signed in and your screens stay as you left them.
Email delivery: whether an email the service sent was delivered, delayed or returned.

We use Google Analytics through Firebase to count visits to our public home, pricing, terms, privacy and contact pages, when analytics is enabled. It uses browser identifiers and cookies, and Google receives technical information such as your browser and device information and internet address. We use these counts to understand and improve those pages. Advertising features are disabled.

We do not collect analytics on signed-in work screens, supplier pages or sign-in pages. The page details we send contain only a fixed public page name and address. We leave out query strings, fragments, referring addresses, account identifiers, contact details, form entries and your business content. Automatic enhanced measurement is disabled before analytics is enabled.

The pages load their typefaces from Google Fonts, so your browser asks Google's servers for the font files, and Google receives the internet address of your device as any web server does.

3. Information from other sources

Public records: the service shows information published by USAspending.gov and SAM.gov about government purchases, requests and the companies that receive awards. From SAM.gov's notices we keep the public facts of each notice and not the contact details of the person named in it.
Research you ask for: when you ask the service to find vendors or to research a buyer, it searches the public web and saves what it finds in your workspace. That can include business contact details that those organizations publish.

4. How we use information

To provide the service: to read your documents, prepare your drafts, send the messages you ask us to send, and remind you of due dates.
To keep the service secure and to prevent abuse.
To answer you when you write to us.
To bill you for a plan.
To fix faults and improve the service.
To meet legal obligations.

We do not sell your personal information. We do not use your content to advertise to you. We do not use your content to train artificial intelligence models of our own.

5. Artificial intelligence

To read documents and to do research, the service sends the relevant content to artificial intelligence providers, which process it for us and return the result. A reading can be wrong, which is why the service asks you to check it.

6. Who receives information

We share information only as follows.

With the companies that provide parts of the service for us. As of the date above they are Google (sign-in, database, file storage and public marketing page analytics, through Firebase and Google Analytics), Vercel (hosting), Resend (email), Anthropic (reading documents and research), OpenAI (turning dictation into text), Twilio (text messages) and Stripe (payment). Each receives only what it needs for its part.
With the people in your workspace, who can see what is in it.
With the people you send messages to. A quote or a request to a vendor carries your business's details.
With the public, for what you choose to put on your public page.
With other signed-in customers, for what you choose to put in the member list, and with a customer you write to through it, who receives your name, your business's name and your email address.
When the law requires it, or to protect the rights and safety of our customers, the public or the service.
With a buyer of the service, if the service is sold or reorganized. This policy would continue to apply to your information.

We do not show one customer's content to another customer, except what a customer chooses to put in the member list or to send another customer through it.

7. How long we keep information

We keep your information while your account is open. You can ask us through the Contact page to delete your account and its content. We do so within a reasonable time, except for what the law requires us to keep and for backup copies, which expire on their own.

8. Security

Connections to the service are encrypted. What is in a workspace can be reached only by the people added to it. The companies that store information for us run their own security programs. No online service can promise perfect security, so please use a strong password that you use nowhere else.

The service is not built to hold classified information or controlled unclassified information. The Terms of Service ask you not to put either into it.

9. Your choices

You can see and correct most of your information in the service itself.
You can ask us for a copy of your information, to correct it, or to delete it. Write to us through the Contact page from the email address of your account.
You can stop text messages by replying STOP, and you can choose in your settings which notices each person on your team receives and whether the Monday email is sent.
We do not start marketing page analytics when your browser sends Global Privacy Control or Do Not Track. You can also use your browser's cookie controls to limit cookies.

You have these choices wherever you live, and we do not treat you differently for using them. Laws such as the California Consumer Privacy Act may give you further rights.

If your information is in another customer's workspace, for example because you are a buyer or a vendor they deal with, please ask that customer. We act on their instructions for what is in their workspace. If one of our customers emailed you through the service, the link at the end of that email stops their emails to you at once, and we keep your address marked so that they stay stopped.

10. Children

The service is for businesses. It is not directed to children, and people under 18 may not use it.

11. Where information is kept

The service is run from the United States. Information is processed and stored there, and wherever the companies listed in section 6 run their own systems.

12. Changes to this policy

We may change this policy. When we do, we post the new policy here and change the date at the top. If a change is important, we also tell you by email or inside the service.

How to reach us

Write to us through the Contact page. See also the Terms of Service.