VENDALIZE LLC — PRIVACY POLICY

Effective Date: August 10, 2026 Last Updated: August 10, 2026

This Privacy Policy explains what personal information Vendalize LLC ("Vendalize," "we," "us," or "our") collects, how we use and share it, and the choices you have. It applies to the vendalize.space website, our mobile and web applications, and related services (the "Platform"). Capitalized terms not defined here have the meanings given in the Terms of Service.

Scope. The Platform is offered to users in the United States. It is not directed to, and we do not knowingly provide it to, individuals in the European Economic Area, the United Kingdom, or other regions outside the United States.

1. Who we are

Vendalize LLC is the entity responsible for the personal information described in this Policy.

Vendalize LLC 3300 N. Triumph Boulevard, Suite 100 – #1014, Lehi, UT 84043 Privacy contact: privacy@vendalize.space

Vendalize operates a marketplace that connects commercial Property Owners with Mobile Vendors. We are a technology platform — not a party to the bookings between users — and this Policy covers the information we handle in operating that platform.

2. Information we collect

Information you provide

• Account information — your name, email address, password (stored in hashed form), account role (Property Owner, Mobile Vendor, or both), and phone number if you provide one.
• Profile and listing information — business details, listing addresses, descriptions, photos, and the boundaries of the space you list.
• Bookings and messages — booking details and the messages you send to other users through the Platform.
• Documents you upload — insurance certificates (COIs), property authority documents (such as leases, property-management agreements, or owner consent letters), permit documents, and other files you submit.
• Support and other communications — information you provide when you contact us.

Payment and identity details for payouts are provided directly to our payment processor, Stripe, and are not collected or stored by Vendalize. See Section 5.

Information we collect automatically

• Device and usage information — IP address, browser and device type, pages viewed, actions taken, and timestamps.
• Session information — the IP address and user agent associated with your login sessions.
• Approximate location — a coarse location (such as city) derived from your IP address, used to localize maps and content on public pages.
• Cookies and similar technologies — see Section 6 and our Cookie Policy.

Information from third parties

• Sign-in providers — if you choose to sign in with Google or Apple, we receive basic identity information (such as your name and email) from that provider.
• Payment processor — Stripe provides us limited information such as payout eligibility and payment status.

3. How we use your information

We use personal information to:

• Provide and operate the Platform — create and manage accounts, listings, bookings, and messaging;
• Process payments and payouts through Stripe;
• Verify insurance certificates and review property authority documents;
• Generate booking-related documents, such as license agreements and permit packets;
• Provide maps, address autocomplete, and location-based features;
• Send you transactional communications (such as sign-in verification, booking updates, and alerts), by email and through in-app notifications;
• Understand how the Platform is used and improve it (product analytics);
• Market our own services within the United States, including measuring how visitors find us;
• Protect the Platform and our users — safety, fraud prevention, and enforcement of our terms; and
• Comply with legal obligations.

4. How we share your information

We share personal information with service providers that process it on our behalf, with other users as needed to make a booking work, and in the limited other circumstances described below. We do not sell your personal information for money.

Service providers and sub-processors

We rely on the following providers to operate the Platform. Each processes personal information only as needed to provide its service to us.

We maintain an internal register of the providers we use and update it as our services change.

Other sharing

• Between users — to make a booking work, Property Owners and Mobile Vendors see the information necessary to transact, such as names, listing details, insurance-verification status, and the executed license agreement for their booking. After a booking, feedback and ratings submitted by a Mobile Vendor are shared with the applicable Property Owner.
• Legal, safety, and enforcement — to comply with applicable law or legal process, enforce our terms, prevent fraud, and protect the rights, property, or safety of Vendalize, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

5. Payments

Payments are processed by Stripe, Inc. When you enter card details, or (as a Property Owner) complete identity and bank verification, that information is submitted directly to Stripe through Stripe-hosted forms — it does not pass through or get stored on Vendalize's servers. Stripe handles that information as a separate controller under its own privacy policy, and as our processor for transaction data. We receive only limited information such as payout eligibility and payment status. Stripe maintains PCI-DSS compliance for card data.

6. Cookies and tracking technologies

We use cookies and similar technologies for essential functions, for functionality (such as remembering your active portal), and for analytics and attribution. Because we operate only in the United States, we do not use a cookie consent banner; instead, we disclose the cookies we use and give you controls over the non-essential ones.

You can opt out of analytics and attribution cookies through your Cookie Preferences or your browser settings, and we honor Global Privacy Control (GPC) signals. Our full list of cookies and instructions are in our Cookie Policy.

7. Analytics

We use PostHog (hosted in the United States) to understand how the Platform is used and to improve it. We have turned off automatic event capture and session recording, and we filter out sensitive fields — such as names, addresses, emails, phone numbers, and payment data — before events reach PostHog. Analytics data is associated with an analytics identifier and, for signed-in users, your account ID. You can opt out of analytics as described in Section 6 and our Cookie Policy.

8. Your privacy choices and rights

Choices available to everyone

• Cookie controls — opt out of analytics and attribution cookies through Cookie Preferences or your browser; we honor GPC.
• Email — unsubscribe from non-essential emails using the link in the email.
• Your account — review and update your account information in your dashboard.

US state privacy rights

Depending on your state of residence — including California, Utah, Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws — you may have the right to:

• Know and access the personal information we hold about you;
• Delete your personal information;
• Correct inaccurate personal information;
• Opt out of any "sale" or "sharing" of personal information, or of targeted advertising; and
• Not be discriminated against for exercising these rights.

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising. Some state laws define "sale" or "sharing" broadly enough that our analytics and attribution practices could be treated as such; out of an abundance of caution, we provide the opt-out described in Section 6 and honor GPC.

To exercise a right, email privacy@vendalize.space. We will verify your request (typically through the email associated with your account) and respond within the time required by applicable law. Where permitted, you may use an authorized agent to submit a request on your behalf.

9. Data retention

We retain personal information for as long as needed to provide the Platform, comply with our legal obligations (such as tax, financial, and dispute-related recordkeeping), resolve disputes, and enforce our agreements. Retention periods vary by the type of information and the purpose for which it is held.

10. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and reliance on established infrastructure and payment providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

The Platform is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it.

12. Third-party links and services

The Platform contains links to third-party websites and services — for example, our waitlist form and map or directions links. Those third parties handle your information under their own privacy policies, and we are not responsible for their practices.

13. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Platform or by email. The "Last Updated" date above reflects the most recent revision. Your continued use of the Platform after the effective date of an updated Policy constitutes acceptance of it.

14. Contact us

Vendalize LLC 3300 N. Triumph Boulevard, Suite 100 – #1014, Lehi, UT 84043 Privacy: privacy@vendalize.space General: support@vendalize.space