This policy explains what information Vendu collects, why, who can see it and what you can ask us to do with it. It works together with our terms of use, which describe in more detail what funds see at each stage of a sale.
1. What we collect
- Account: your email address, a password (stored only in scrambled form by our login provider) and when you accepted the terms.
- Company: name, website, who is listing it, industry, description, sale timing, deal types, reason for sale, year founded, headquarters and your anonymous teaser.
- Financials: documents you upload, the figures typed in or read from them with the period each covers, add-backs you accept, and verified figures you add during diligence.
- Sale processes: the funds you invite, deadlines, offers you receive, messages, questions and answers, document requests, data-room files, closing steps and the final price.
- Fund information (fund users only): your fund’s profile, focus, limits and pricing rule, your team members, your invitations and the offers you submit.
- Activity: a record of actions such as uploads, confirmations, price checks, payments, invitations, offers and data-room downloads, with times.
- Payments: a reference to each Stripe payment, the amount and the currency. Card details go to Stripe, not to us.
- Emails you forward to your Garde address: the sender’s name and email address, the subject and text, and how Vendu sorted it (type of firm and what they asked for). Attachments are not kept. These emails are written by other people; you choose to forward them.
- If you use Garde’s Gmail check: the script runs in your own Google account. It sends us only the domains of first-time senders (for example “summitridge.com”), which we check against each company’s public website; we don’t record which domains you asked about, only that a check ran. Only if you turn it on, it also sends the subject line and sender name (never the email itself) for first-time senders without a company website. Emails it judges to be buyer outreach are forwarded to your Garde address; nothing else is sent.
- If you connect Gmail or Outlook to Garde: with your permission on Google’s or Microsoft’s screen, Vendu checks email in your inbox and your Spam or Junk folder from people you have never written to: the last 90 days when you first connect, then new email. For each such email it looks only at the sender, the subject line and whether it is mailing-list mail (and, for email in Spam or Junk, the sender-authentication result Google or Microsoft recorded), and checks the sender’s domain against that company’s public website. Email in Spam or Junk is considered only when the sender passed that authentication check, and is never moved out of that folder. It reads and stores the full text only of emails it judges to come from investment firms, M&A advisers or buyers. The connection is view-only by default: Vendu cannot send, change or delete anything. Only if you turn on organizing (a separate permission you grant on Google’s or Microsoft’s screen) does it add a “Garde” label (Gmail) or category (Outlook) to buyer emails and, if you ask, move them out of your inbox; it never sends or deletes email. It never reads email from people you have written to, and never sends, replies to or deletes email. We store an encrypted access token, your email address and a marker of which email has already been checked; we don’t record which senders were checked, only how many. Disconnecting on the Garde page deletes the token (and, for Gmail, revokes our access at Google); you can also remove Vendu in your Google or Microsoft account settings.
- Google user data: Vendu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide Garde to you; we don’t use it for advertising, don’t sell it, don’t use it to train AI models, and no person at Vendu reads it except with your permission, for security, or where the law requires.
- Firms that answer a reply sent through Garde: the name, firm, email, website and criteria a firm types into the form it reaches from Vendu’s reply.
- Public website content: when you enter your company’s website, we read its public pages to suggest an industry and description.
- Technical: login cookies needed to keep you signed in, and the standard request logs our hosting provider keeps.
2. How we use it
To run the service: reading your documents, comparing your company with funds’ criteria, calculating indications, unlocking paid results, running sale processes and building each fund’s reputation score. Also to keep the service secure (for example, limiting how often costly actions can be repeated), to keep a reliable record of what happened, and to send service emails and notifications such as account confirmation, new invitations, offers and deadlines. We do not sell your information and we do not show advertising.
3. Who can see it
- Funds whose focus fits your company see an anonymous profile: industry, revenue and EBITDA ranges, sale timing and a short fit reason. Not your name, website, description or documents.
- Funds you invite see your anonymous teaser and confirmed figures before accepting; after accepting, your company’s name, website, description, figures and data room (sensitive files only under clean-team rules); and your email once you shortlist them. The terms (section 5) set this out in full.
- Company owners see, for funds they invite, the fund’s profile, its reputation score, its offers, its messages and questions, which files it downloaded, and its contact email once shortlisted.
- Other company owners never see your company’s information.
- Garde buyer emails: the emails you forward, the firms they come from and any criteria those firms share are visible only to you. Funds never see them. A firm you reply to through Vendu sees the reply text and, on the page it links to, only your first name and company name as written in the reply.
- Our staff: a small number of administrators can see accounts, companies, funds and sale processes to operate and support the service, investigate problems and prevent misuse. Each such access is limited to those purposes.
- Service providers process information on our behalf: Supabase (database, file storage and login), Vercel (website hosting), Anthropic (AI models that read documents, sort forwarded emails and write explanations; your documents, figures, website text, buyer emails and, for Garde, the subject lines and sender names of emails from senders whose company can’t be checked are sent to it for that purpose), Stripe (payments), Resend (sending email), Postmark (receiving the emails forwarded to Garde addresses), and Google and Microsoft (the Gmail or Outlook connection, if you choose one).
- Authorities, if the law requires it.
DraftConfirm each provider’s data-processing terms, where data is stored, and Anthropic’s retention and no-training commitments for API data, then state them here. Decide whether staff access to company documents is itself logged and say so.
4. How it is protected
Data is encrypted in transit and stored with our providers, who encrypt it at rest. Access is enforced in the database itself, so each user can read only what the rules above allow, and uploaded files are kept in private storage. Data-room files are handed out only through short-lived links, and every download is logged. Only the server, never a user’s browser, can read funds’ criteria and pricing rules or run the matching.
5. How long we keep it
We keep your information while your account is open. When you delete your account:
- Company owners: any open sale process is withdrawn first and invited funds are told. We then delete your company, figures, files, price checks and sale processes, including what funds could see about them on Vendu. Files a fund already downloaded cannot be recalled and remain under its confidentiality obligations.
- Fund team members: your login and membership are deleted. Offers, messages and download records you made on behalf of your fund stay with the fund and the company owner, with your name removed.
- Garde buyer emails: the text of forwarded or Gmail-read buyer emails is kept for 90 days, then deleted; the list of firms and replies stays until you delete it. You can delete your address and everything forwarded to it at any time from the Garde page, and it is all deleted with your account.
- Stripe keeps its own records of payments, as payment and tax law require.
DraftSet retention periods (for example, payment records kept for the period tax law requires, and how long server logs are kept), and decide whether records needed for disputes are kept for a period after deletion.
6. Your choices and rights
While signed in, you can see and edit your company and figures, delete any file you uploaded, withdraw a sale process, and delete your whole account from the Account page. You can also ask us for a copy of your information by writing to the contact address below. Depending on where you live, you may have further rights under laws such as the California Consumer Privacy Act or the GDPR.
DraftLawyer to confirm which privacy laws apply given where users are located, and whether a data-processing agreement is needed with funds.
7. Cookies
We use only the cookies needed to keep you signed in. We do not use analytics or advertising cookies.
8. Changes and contact
If we change this policy in a way that matters, we will tell you before the change applies. Questions and requests can be sent to the contact address below.
DraftPublish a contact email for privacy requests.