How we collect, use, and protect your information.

This Privacy Policy ("Policy") describes how VendorBoard AI ("we," "us," or "our") collects, uses, stores, and protects information about users of the VendorBoard AI platform ("Platform"). This Policy applies to all users including Buyers and Vendors.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree, please discontinue use of the Platform.

2.3 Automatically Collected Information

When you use the Platform, we automatically collect certain technical information including browser type and version, operating system, referring URLs, pages visited and time spent, and general geographic location derived from IP address. This information is used solely to maintain Platform security, improve performance, and generate anonymized usage analytics.

2.4 Google Calendar Information

If you choose to connect the optional Google Calendar integration, we also access a limited set of calendar event information from your Google Account. Exactly what is accessed, how it is used, how it is stored, and how you can revoke access are described in Section 7 — Google Calendar Integration.

We use information collected through the Platform exclusively for the following purposes:

• To create and manage your account and authenticate your access
• To facilitate vendor evaluation processes you initiate or are invited to participate in
• To operate the AI-powered evaluation features including scoring, recommendation generation, and reporting
• To send transactional communications such as evaluation invitations, scoring summaries, and account notifications
• To provide customer support and respond to your inquiries
• To maintain and improve Platform features and reliability, using aggregated, anonymized data derived from Platform activity
• To detect and prevent fraud, abuse, or security threats
• To comply with legal obligations

As a condition of using the VendorBoard AI Platform, both Buyers and Vendors acknowledge and agree that VendorBoard AI may use your company name, logo, and general description of your Platform usage for marketing and promotional purposes. This applies to all users of the Platform regardless of role.

Specific uses may include but are not limited to:

• Publishing case studies or success stories referencing your company's evaluation experience
• Including your company name or logo in customer or partner lists on our website and marketing materials
• Referencing your company in press releases, blog content, social media posts, or conference presentations
• Including named mentions in investor materials, pitch decks, or sales collateral
• Featuring quotes or testimonials attributed to your company

VendorBoard AI will not disclose confidential evaluation data, scores, vendor rankings, pricing submissions, or any proprietary business information as part of any publicity activity without your separate written consent. Publicity use is limited to the fact of your participation on the Platform and general outcomes, not the underlying evaluation details.

5.1 Buyer Data — Who Sees It

Buyer contact information and evaluation data is shared only with:

• The Vendors that the Buyer explicitly selects and invites to participate in a specific evaluation
• VendorBoard AI staff with a legitimate operational need to support the evaluation

Buyer data is never shared with:

• Vendors who were not invited to the relevant evaluation
• Other Buyers on the Platform
• Third-party vendors, data brokers, or advertisers
• Competing platforms, market research firms, or analytics providers

5.2 Vendor Data — Who Sees It

Vendor submissions and product information are shared only with:

• The specific Buyer who initiated the evaluation in which the Vendor is participating
• VendorBoard AI staff with a legitimate operational need to support the evaluation

Vendor data is never shared with:

• Other Vendors participating in the same evaluation, except that Vendor names, scores, and VendorBoard AI-generated analysis may be visible to participating Vendors on eligible leaderboard plans. Raw submissions and recordings are never shared.
• Other Buyers on the Platform
• Third-party data brokers, market intelligence firms, or technology aggregators
• Any entity outside the Platform without explicit written consent from the Vendor

5.3 No Sale of Personal Data

VendorBoard AI does not and will never sell personal data or evaluation data to any third party. This applies to Buyer contact information, Buyer evaluation requirements, Vendor product submissions, and all other user-provided information on the Platform.

5.4 Third-Party Service Providers

We use a limited number of third-party service providers strictly to operate the Platform, including cloud infrastructure providers, payment processors, and email delivery services. These providers operate under strict data processing agreements and are permitted to use your information only to deliver services to us on your behalf. They are expressly prohibited from using your data for their own commercial purposes.

5.5 Legal Disclosures

We may disclose information if required to do so by law, court order, or a valid legal process. In such cases, we will notify affected users to the maximum extent permitted by applicable law and will disclose only the minimum information required to comply with the legal obligation.

6.1 Isolation Between Evaluations

Each evaluation on VendorBoard AI operates as an isolated data environment. Buyer requirements, criteria, and scoring data from one evaluation are not accessible to users in other evaluations. Vendor submissions in one evaluation are not visible to that Vendor's own team in different evaluations without re-authorization.

6.2 Vendor Visibility and Leaderboard Feature

When multiple Vendors participate in the same Buyer evaluation, their raw responses, demo recordings, original submissions, and proprietary content are never visible to other Vendors.

However, VendorBoard AI offers a comparative leaderboard feature on eligible paid plans. When this feature is enabled for an evaluation, participating Vendors may see:

• The names of other Vendors in the same evaluation
• Each Vendor's evaluation scores
• VendorBoard AI-generated analysis summarizing each Vendor's evaluated performance

This leaderboard feature does not expose raw Vendor submissions, recordings, pricing details, or any original Vendor-authored content. The AI-generated analysis is solely VendorBoard AI's work product based on the evaluation. By participating in evaluations on the Platform, Vendors consent to this visibility where applicable.

6.3 Score Visibility and Buyer Report Confidentiality

The Buyer's internal evaluator notes and final recommendation report are Buyer-only materials and are never shared with Vendors. Vendor scores and AI-generated analysis may be visible to participating Vendors through the leaderboard feature on eligible plans, as described in Section 6.2. Scores displayed through the leaderboard represent VendorBoard AI's platform output and do not include the Buyer's raw internal notes, deliberations, or procurement decision rationale.

6.4 Cross-Evaluation Data Restrictions

Buyer evaluation requirements from one evaluation project are not used to inform, benchmark, or share insights with other Buyers or Vendors on the Platform, even in aggregate or anonymized form that could be traced to an identifiable Buyer or Vendor.

VendorBoard provides an optional Google Calendar integration that helps Buyers automatically identify upcoming vendor meetings and prepare for scheduled vendor interactions. The integration is entirely optional and the Platform can be used in full without connecting a calendar.

When you connect your Google Calendar account, VendorBoard requests permission to access your calendar event information using Google's OAuth authorization system. You review and approve that permission on Google's own consent screen before any access is granted.

7.1 Permission We Request

We only request the following Google Calendar permission:

This read-only permission allows VendorBoard to read the calendar event information necessary to identify meetings involving registered vendor domains. VendorBoard does not request any broader Google permission.

7.2 Information Accessed From Google Calendar

When you authorize the Google Calendar integration, VendorBoard may access:

7.3 How Google Calendar Data Is Used

In practice, that means VendorBoard:

• Reads events on your primary calendar to find upcoming meetings
• Compares attendee email domains against the vendor domains you have configured, to identify which of those meetings are vendor meetings
• Sends you a reminder shortly before a detected vendor meeting begins

Reminders are sent only to you, the account holder who connected the calendar. Where a reminder includes preparation material, that material is drawn entirely from your own VendorBoard evaluation data — your requirements, your interview questions, and your prior call records — not from your calendar.

Google Calendar data is never used for:

• Advertising or marketing of any kind
• Selling, renting, or licensing user information
• Analytics, benchmarking, or research
• Training, fine-tuning, or improving any artificial intelligence or machine learning model
• Profiling users, or any purpose outside the meeting detection and alerting described above

7.4 Google Workspace API Data and AI/ML

VendorBoard does not use Google Workspace API data, including raw, aggregated, anonymized, or derived data, to train, fine-tune, evaluate, develop, or improve generalized or non-personalized artificial intelligence or machine learning models.

Google Calendar data is used only to provide user-facing VendorBoard functionality, including identifying relevant vendor meetings, matching attendee email domains with vendor domains configured by the user, and sending meeting-related notifications, as described in Section 7.3.

Google Workspace API data is not transferred to OpenAI, Recall.ai, Retell AI, or any other third-party artificial intelligence or machine learning provider.

VendorBoard does not sell Google Workspace user data, use it for advertising, or use it for unrelated profiling or secondary purposes.

This Section controls. Where any other provision of this Policy could be read to permit a use or transfer of data received from Google APIs beyond the meeting detection and alerting described in Section 7.3, that reading does not apply and no such use or transfer takes place.

7.5 Storage and Security

Google OAuth credentials and refresh tokens are stored securely using encryption and protected infrastructure. Calendar event information is stored only as required to provide VendorBoard functionality. Access to stored information is restricted to authorized VendorBoard systems.

7.6 Sharing of Google Data

VendorBoard does not sell Google Calendar data or transfer it for advertising, profiling, analytics, AI or machine learning training, or any unrelated secondary purpose.

Google Calendar data may be processed only by infrastructure or communication service providers strictly necessary to provide the requested Calendar functionality — such as securely storing detected meeting information or delivering your meeting reminder. Such providers act solely on VendorBoard's behalf and are prohibited from using the data for their own independent purposes.

Google Workspace API data is never transferred to OpenAI, Recall.ai, Retell AI, or any other third-party artificial intelligence or machine learning provider.

VendorBoard may also disclose information where required by applicable law.

7.7 Revoking Google Calendar Access

You can disconnect the Google Calendar integration at any time from your VendorBoard account settings. You may also revoke VendorBoard's Google access from your Google Account permissions page.

7.8 Data Deletion

When the Google Calendar integration is disconnected, VendorBoard stops accessing Google Calendar data associated with that connection and the authorization is revoked with Google.

Detected meeting information already stored at that point is retained only in accordance with Section 8 and may be removed through the deletion routes described in this Policy. Deleting an evaluation removes the detected meeting records associated with that evaluation. Deleting your VendorBoard account removes your calendar connection together with all detected meeting records held for you.

You may request deletion of your VendorBoard account data at any time by contacting contact@vendorboard.ai.

We retain your information for as long as your account is active or as needed to provide you with Platform services. Specifically:

• Active account data: Retained while your account remains active
• Completed evaluation data: Retained for 24 months after evaluation completion unless you request earlier deletion
• Inactive accounts: Data is deleted or anonymized 12 months after the last account activity
• Legal hold: Data subject to a legal hold or compliance obligation will be retained for the duration required by applicable law

You may request deletion of your data at any time by contacting us at contact@vendorboard.ai. Deletion requests will be processed within 30 days, subject to any applicable legal retention obligations.

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest
• Role-based access controls limiting internal access to data on a need-to-know basis
• Regular security assessments and vulnerability testing
• Monitoring and logging of access to sensitive evaluation data

While we take significant measures to protect your data, no electronic transmission or storage is 100% secure. We encourage you to use strong, unique passwords for your account and to contact us immediately if you suspect unauthorized access.

Depending on your location, you may have certain rights with respect to your personal data, including:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your personal data, subject to applicable legal requirements
• Portability: Request a machine-readable copy of your data
• Objection: Object to certain types of processing, including any future direct marketing, which we do not currently engage in
• Restriction: Request that we restrict processing of your data in certain circumstances

To exercise any of these rights, please contact us at contact@vendorboard.ai. We will respond to all requests within 30 days.

VendorBoard AI uses cookies and similar technologies strictly for the following functional purposes:

• Session management and authentication
• Remembering user preferences and settings
• Platform security and fraud prevention
• Internal analytics to improve Platform performance, anonymized

We do not use third-party advertising cookies, cross-site tracking technologies, or any tracking tools that share your data with advertising networks or external data brokers.

The VendorBoard AI Platform is intended for business use by adults and is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected data from a minor, we will promptly delete it.

We may update this Privacy Policy from time to time to reflect changes in our data practices or applicable law. We will notify registered users of material changes by email or through a prominent notice on the Platform. The "Effective Date" at the top of this Policy indicates when the most recent version took effect.

Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: