The Vendor Lineup

Privacy Policy

Version: owner-approved-2026-10-12-v20

Effective date: Upon publication

Last updated: October 12, 2026

Status: OWNER-APPROVED 2026-10-12 (AI-assisted owner approval; no attorney review)

Controller/operator: M2 AI, LLC, a Texas limited liability company

1. Scope

This Privacy Policy explains how M2 AI, LLC collects, uses, discloses, retains, and protects personal information when Customers, Vendors, Vendor representatives, and visitors use The Vendor Lineup. It applies to the website, accounts, marketplace transactions, communications, support, and optional integrations. A Vendor may separately control information it collects outside the Platform.

The initial service is offered in the United States and focused on Greater Houston, Texas. This Policy does not claim that every privacy law applies to every person or record; it describes our operating commitments and the rights we provide where required.

2. Information we collect

Depending on how you use the Platform, we may collect:

  • Account and identity: name, email address, verified-email status, account role, authentication records, and security/audit events.
  • Vendor business information: business identity, representative role, service categories, descriptions, pricing, availability, service areas, business contact details, tax/payout status references, listing media, and, for a Pro Vendor, a stored reference to one Vendor-selected YouTube or Vimeo video — the hosting provider, the video identifier, and clip-length metadata used to enforce the storefront's 60-second playback limit, not the video file itself.
  • Private draft-page information: A staff-prepared, unclaimed storefront draft may contain a business's public name, categories, service area, package names and prices from public sources, a short staff-written description, source URLs, and public website or social links. We keep the invited claim email and, when permission is recorded, its date, method, and scope. Draft records also include first and most recent preview timestamps.
  • Event and Booking information: event date/time, venue address, service selections, quantities, setup/breakdown/buffer timing, requests, quotes, accepted snapshots, changes, cancellations, issues, and review eligibility.
  • Communications and content: messages, action-card responses, issue reports and events, reviews, replies, reports, appeals, moderation records, uploaded images, and support communications.
  • Payment and transaction information: Stripe Customer, PaymentIntent, payment-method reference, connected-account, charge, transfer, application-fee, refund, dispute, payout, tax, invoice, subscription, plan, recurring-consent, cancellation, and ledger identifiers; amounts, statuses, fixed free-month end, payment and consent timestamps, retention/removal dates, and reconciliation evidence. We do not receive or store full card or bank-account numbers.
  • Credentials: private Vendor credential documents, file metadata, rights attestations, expiration dates, manual decisions, and public badge status.
  • Location and route information: addresses needed for event coverage and routing, normalized address components, route distance/time, and HMAC-based cache identifiers. Precise event addresses are restricted to authorized transaction participants and operations.
  • Calendar information: native marketplace Booking dates, availability and blocked dates. External Google Calendar connections and synchronization are not offered in the MVP.
  • Preferences and analytics: notification choices; first-party journey events using identifiers and structured event types; device, browser, IP-derived security information, request logs, and error/performance telemetry.
  • Information from service providers: authentication, payment, email-delivery, mapping, calendar, hosting, monitoring, fraud, and security results necessary to operate the Platform.

Please do not place sensitive personal information, complete payment credentials, government identifiers, health information, or unrelated private information in free-text messages, reviews, or issue descriptions.

3. How we use information

We use information to:

  • create and secure accounts and verify authorized roles;
  • prepare private storefront drafts from public business information, record source URLs and permission details, provide a private preview, and let an authorized representative verify email and claim the draft;
  • publish and operate Vendor storefronts and marketplace discovery;
  • validate coverage, availability, capacity, timing, and price;
  • create and administer requests, quotes, Bookings, changes, reschedules, cancellations, payments, refunds, disputes, receipts, and payouts;
  • administer Vendor plan selection, reusable card setup, recurring-billing consent, free-month timing, subscription creation and reconciliation, plan changes, cancellation, billing recovery, first-charge notices, private workspace retention, reactivation, and eligible deletion;
  • protect existing Bookings, receipts, refunds, disputes, payouts, financial evidence, consent records, and legal or safety holds when a Vendor changes or cancels a plan; and
  • deliver required notices and preference-controlled reminders or summaries;
  • provide messages, issue handling, reviews, credential review, moderation, support, and fraud/safety response;
  • maintain financial, tax, legal, audit, and acceptance records;
  • diagnose errors, protect the Platform, prevent abuse, and improve reliability and usability;
  • comply with law, court orders, processor rules, and enforceable agreements; and
  • use aggregated or de-identified information for operations and product planning where it cannot reasonably identify a person.

We do not sell personal information. We do not use personal information for targeted advertising, credit eligibility, or generalized AI/model training. Marketing is off unless we implement a separate lawful consent flow. We do not use plan, payment-method, recurring-consent, cancellation, or retention information to create a new marketing purpose. Required billing, privacy, security, legal, and account notices remain distinct from optional marketing.

4. When we disclose information

We may disclose information:

  • between a Customer and Vendor as reasonably needed to evaluate and perform a Booking, coordinate the event, resolve an issue, or comply with law;
  • to Stripe for payments, identity, connected accounts, tax, refunds, disputes, and payouts;
  • to Supabase for database, authentication, and private file storage;
  • to Vercel for hosting and runtime delivery;
  • to Resend for transactional email;
  • to Geoapify for address lookup and driving-route calculations needed for service coverage and travel pricing; these server-side requests include necessary address components or route coordinates, not account email addresses, payment details or Booking descriptions;
  • to Sentry or a successor monitoring provider for restricted error/performance data;
  • to professional advisers, insurers, auditors, acquirers, lenders, and vendors under appropriate duties and only as reasonably necessary;
  • to authorities or other parties when reasonably necessary to comply with law, protect rights or safety, investigate fraud/security, or establish or defend legal claims; and
  • in a corporate transaction subject to applicable confidentiality and notice requirements.

Service providers may use information only for the services and lawful purposes established by their agreements and applicable law. We do not publicly disclose a Vendor's private contact email that it entered in the private field described in the Vendor Agreement, private credential files, payment identifiers, issue evidence, exact event addresses, private reports, or internal moderation notes. This protection applies to what the Platform itself stores and displays; it cannot control information a Vendor separately chooses to include in its own public listing text, photos, or messages.

5. Payments and financial information

Stripe collects and processes payment and connected-account information under its own terms and privacy policy. We store only the references, amounts, statuses, allocation evidence, and limited account details needed for Bookings, receipts, refunds, disputes, payouts, accounting, and legal obligations. Stripe may independently determine identity, fraud, risk, and compliance requirements.

6. Location services and external calendars

We use Geoapify to look up business and event addresses and calculate driving distances for service coverage and travel pricing. Geoapify processes the necessary address components or coordinates under its privacy policy. We do not send apartment or suite details in the address search. Our private route cache stores distances under HMAC-based identifiers, not readable addresses. Google Maps and external Google Calendar synchronization are not used in the MVP. Previously connected Google calendars are disconnected locally: stored OAuth tokens, mappings, synchronization cursors and imported busy blocks are removed from active application records. Native marketplace Bookings and availability remain. Events previously exported to a user's Google calendar may remain there; the user may remove those events and revoke the former connection through their Google account.

7. Credential documents

Credential uploads are stored privately and are available only to the submitting Vendor Owner, authorized internal reviewer, and infrastructure providers needed to store or secure the file. Public users receive only a limited current badge projection, not the document, internal reason, or private identifiers. We may retain decision and audit records after a badge expires or is revoked.

8. Reviews, issues, and moderation

Visible reviews, ratings, and Vendor replies are public. Account and Booking identifiers, private reports, appeals, issue descriptions, private operator notes, and moderation evidence are restricted. Removed content and revision history may be retained for audit, safety, dispute, and legal purposes even when no longer public.

Issue cases share only appropriate status and shared events with the Customer and authorized Vendor participants. An internal operator may access the case and private evidence for triage, resolution, appeal, safety, and legal purposes.

9. Cookies, local storage, and telemetry

We use essential cookies and browser storage for authentication, security, preferences, and necessary Platform operation. Private draft preview, claim, and removal also use essential first-party cookies. Preview pages do not load third-party analytics or embeds. The raw preview link is not stored or logged. We may use first-party structured analytics and restricted error/performance monitoring to understand reliability and user journeys. A Trackable marketing link or QR code may set a signed, first-party cookie, valid for up to 30 days, that records which link a visitor followed so the Vendor can see reporting for that link. Invalid links do not set this cookie. We use a hash derived from request IP and browser information to deduplicate repeated link opens. The cookie itself carries no Customer name, contact, or payment information. A Pro Vendor's storefront may include a video hosted by YouTube or Vimeo. The Platform loads the embedded player only after the visitor chooses to play it. Once loaded, the video host receives connection and playback data and may use cookies under its own privacy policy. We do not use third-party advertising cookies or cross-site targeted advertising for Platform advertising; we do not control the video host's independent practices. This is not a promise that playing a third-party video creates no cookies or that those cookies expire when playback ends. The deployed site's cookie and network inventory controls the final publication disclosure and must be rechecked when technology changes.

10. Retention and deletion

We retain information only as long as reasonably necessary for the purposes described here, including active accounts and Bookings, payment/refund/dispute and tax records, fraud and security, credential decisions, issue and moderation history, contract proof, legal claims, consent records, and required business records. Retention periods differ by record and legal obligation.

When a Vendor cancels a paid plan, the Platform immediately removes the storefront from public, search, direct-link, QR-code, and new-booking access. The Vendor's login remains available for a private workspace for 12 calendar months from the cancellation request, subject to the records and holds described below. The private workspace may include the Vendor's saved storefront content, plan and billing history, receipts, Booking support records, messages needed for existing obligations, and other records needed to document or fulfill accepted Bookings. Private workspace access does not publish the storefront, reopen new sales, or create a new free month.

The Platform shows the planned removal date and intends to send a notice 30 calendar days before removal and another notice 7 calendar days before removal when a valid delivery path exists. Notices may be suppressed or delayed when the account is revoked, delivery fails, or the Platform cannot safely send them. Notice timing is an operational commitment for this retention flow, not a promise that every email will be delivered.

At the planned removal date, the Platform may remove eligible storefront, media, profile, and Vendor-access data within the documented deletion scope. The Platform does not delete Customer accounts or cascade-delete Booking, payment, refund, payout, dispute, chargeback, tax, consent, or other financial records merely because the Vendor workspace is removed. It does not promise that every reference in required financial, safety, accounting, legal, fraud, or dispute records will be erased at 12 months; where appropriate, retained references may be minimized or de-identified when that remains compatible with the required evidence.

The Platform does not purge information needed for a future or unresolved Booking, refund, chargeback, dispute, fraud or security review, safety matter, legal hold, tax or accounting duty, payment-network requirement, consent record, or defense of a claim. It records a concrete hold reason and re-evaluates the affected scope later. A hold may apply to some records while eligible unrelated records are removed.

Before removal, successful reactivation clears the planned removal date for the restored workspace and preserves eligible content. If reactivation occurs before the original onboarding free-month end, that original end date is reused; no early charge, extension, or second free month is created. After the original end date, reactivation requires a paid plan. Reactivation does not erase cancellation history, publish the storefront, or reopen new bookings by itself. The Vendor must complete the current paid-plan and publication requirements separately. Auth identity deletion is permitted only when the identity has no remaining Customer role, Vendor role, Booking, financial, consent, legal, safety, or other record obligation.

Account closure removes or deactivates information from ordinary use where practical but does not require deletion of records the Platform must retain for Bookings, money movement, safety, abuse, legal compliance, tax, payment-network rules, or defense of claims. Backups may persist for a limited recovery cycle. We delete or de-identify information when the applicable purpose and retention obligation end.

Private draft pages and sources

Before first contact, staff may prepare a private storefront draft from the public business information described in Section 2. Without recorded permission, a draft contains no business photos or copied text. Staff record permission date, method, and scope before adding material covered by that permission; photo permission does not cover text. The claimant uses a verified account email matching the invitation, unless authorized staff verify business authority and approve and record a different verified claimant email. After a successful claim, the Vendor may upload content under the usual rules. Creating or viewing a draft does not send an invitation.

A preview link expires 30 days after issuance and may be extended once for 30 days. We record only the first and most recent preview times. Automated link checks may create those times, so they do not show that a person read the preview. Essential cookies support preview, claim, and removal. We periodically delete HMAC-based IP rate-limit identifiers after 24 hours have passed since their last use; they are not stored as view analytics. The raw preview link is not stored or logged, and preview pages use no third-party analytics or embeds.

Removal immediately revokes preview access. An unclaimed draft becomes eligible for cleanup 30 days after expiry. Delayed or failed cleanup is retried. Cleanup is confirmed only after deletion of all draft-owned storage objects is confirmed. After confirmed cleanup, we delete draft content, invited email, source URLs, and permission details.

During cleanup and for a limited period after it is confirmed, we retain the draft ID and a hashed cleanup-status token so the requester can check completion status. The status token expires within 90 days of its latest update. After cleanup is confirmed, limited lifecycle audit entries record draft ID, action, actor, time, and outcome. A separate cleanup status record retains the information needed to show completion. We periodically delete both once 90 days have passed after confirmation.

Scoped staff API request records contain the principal ID, optional draft ID, action, outcome, HTTP status, and time, including failed requests. They do not contain request bodies, email addresses, source URLs, exception text, IP addresses, API keys, or preview tokens. API request records become eligible for deletion once 90 days have passed after the request.

11. Your choices and rights

You may update available account, listing, notification, payment-method, calendar, and content settings through the Platform. Required transactional and legal notices cannot be disabled.

You may request access, correction, deletion, portability, or appeal of a privacy decision by contacting hello@vendorlineup.com. We may verify identity and authority, deny or limit a request where permitted, retain legally required records, and explain applicable appeal rights. Authorized agents may submit requests where recognized by law, subject to verification. We will not discriminate against a person for exercising a privacy right.

12. Security and incidents

We use measures designed for the service, including authenticated access, row-level and server-side authorization, private file controls, signed payment webhooks, rate limits, audit records, restricted third-party credentials, and minimization of client-visible data. No system is completely secure. We will investigate suspected incidents and provide notices required by applicable law.

13. Children's privacy

The Platform is for adults and is not directed to children under 13. A person must be at least 18 to create an account, request or accept a Booking, or represent a Vendor. If we learn that we collected personal information directly from a child under 13, we will disable the affected use and delete the information unless limited retention is legally required for safety, fraud, or compliance.

14. Changes and contact

We may update this Policy as our practices change. We will publish a new version/effective date and give advance notice of a material change when required. An update alone is not consent to a materially different use where consent is legally required.

Privacy questions and requests: hello@vendorlineup.com or M2 AI, LLC, 2240 Murphy Road, Suite 4020, Missouri City, Texas 77459.

Cross-references: Marketplace Customer Terms · Vendor Agreement · Review and Content Policy