Privacy policy

Vendor Hub is a platform that event operators use to manage food vendors, bar companies and trade contractors at events in Australia: their paperwork, bookings, compliance sign-off, invoices and sales. This policy explains what personal information Vendor Hub handles, why, who it is shared with and how you can access or correct it. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Vendor Hub is a trading name of Zachery Joseph La Rosa (“we”, “us”). For any privacy question or request, email hello@vendor-hub.com.au.

What we collect

• Account and contact details — names, email addresses and phone numbers of vendors, bar companies, contractors, their staff, and the operator's own team.
• Business records — business names, ABNs, the details of trading units, bookings, site fees and commission terms, and signed booking agreements.
• Compliance documents — food licences, insurance certificates, responsible service of alcohol certificates, trade licences and similar documents uploaded to the platform, including the personal details printed on them.
• Sales information — where a vendor connects their Square account, the payments taken at an event (amounts, times, payment type, and the payment details Square provides with each payment), used to report takings and calculate commission.
• Event and site records — check-in times, inspections, incident reports and accreditation passes.
• Messages to our feedback line — if you are a member of the operator's team and report a problem through the app or our WhatsApp business number, the message, any photo or screenshot you send, and your phone number.
• Technical information — the pages you use and error messages from your browser when you report a problem, and standard server logs.

How we use it

To run the platform for the event operator: onboarding vendors, checking and recording compliance, managing bookings and events, reporting sales, issuing invoices, sending the notifications each of those involves (by email, in the app, and in limited urgent cases by SMS), and fixing problems our users report. We do not sell personal information, and we do not use it for advertising.

Who we share it with

Information is visible to the event operator and, as the platform's roles allow, to the promoters of events you trade at. We also use service providers who process information on our behalf, each only for the service they provide:

• Railway — application hosting and storage
• Square — connected point-of-sale accounts, at the vendor's request
• Resend — sending email
• ClickSend — sending SMS
• Meta (WhatsApp Business Platform) — our feedback line
• Anthropic — an AI service that reads reports to our feedback line and writes them up as tasks for our developers
• GitHub — where those tasks are tracked

Some of these providers store or process information outside Australia, including in the United States. We take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles.

Our mobile apps

The Vendor Hub and VH Ops apps for iPhone and Android show the same records as the portals and handle personal information the same way. They use your camera or photo library only when you choose to photograph or attach a document, certificate or incident photo, and what you attach is uploaded to Vendor Hub like any other upload. Your sign-in is kept in your phone's secure storage (the iOS Keychain or the Android Keystore) and removed when you sign out. The apps contain no advertising or analytics services and do not track you across other apps or websites.

Keeping it secure

Access is by individual account with role-based permissions. Connection credentials for third-party services are encrypted, uploaded files are checked on arrival, and changes to records are logged. Records are kept for as long as the operator needs them for the events they relate to and for its legal and compliance obligations.

Access, correction and complaints

You can see and update much of your own information in your portal. To ask for a copy of the personal information we hold about you, to correct it, or to make a complaint about how we have handled it, email hello@vendor-hub.com.au. We will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Deleting your account

To ask us to delete your account and the personal information held with it, email hello@vendor-hub.com.au from the address you sign in with. Accounts are created by invitation, so there is no delete button in the portals or the apps; email is the way to ask. We will confirm the request came from you, tell the event operator, and respond within 30 days. Records the operator is required to keep, such as issued invoices and its compliance history, may be retained for as long as that obligation lasts; everything else is deleted or de-identified. Deleting an app from your phone does not delete your account.

Changes

We will update this policy when what we do changes, and the date at the top will say when.