Privacy notice

Last updated: 24 October 2026

Who we are

SupplierVault is a trading name of Gary Callaway, a sole trader. For personal information about our own customers and website visitors, Gary Callaway trading as SupplierVault is the controller.

Address: 61 Harcourt Gardens, Bath, BA1 4DL, United Kingdom. Email: hello@suppliervault.co.uk. ICO registration number: ZC262506.

Information our customers put into SupplierVault

Our customers use SupplierVault to manage their suppliers. The information they enter, such as supplier contacts, stakeholders and records, belongs to them. For that information, the customer is the controller and we act as their processor. We only use it to provide the service, on the customer's instructions. If you are a supplier contact or stakeholder and have a question about your information, please contact the organisation that holds it. We will help them respond.

Supplier accounts

If a customer sends you requests through SupplierVault, you can create a free supplier account with the same email address. For your account details (your name, email address and, if you use one, your hashed password) we are the controller. Your account shows only the requests sent to your confirmed email address, the documents you sent with them and your signature receipts. What you send to a customer is held for that customer, who is the controller of it, and no customer can see what you send to another. You can delete your supplier account at any time from the account page; what you've already sent stays with each customer.

Groups of companies

An organisation can choose to join a group (for example a group of companies or a multi-academy trust). The group can then see a summary of that organisation's suppliers: names, company numbers, stage, tier, area, contract values and dates, and certificate expiry dates. It can't see documents, bank or payment details, forms, sign-offs or history. Each time the group opens the summary, it's recorded in the organisation's access log, and either side can end the link.

Accounting software

An organisation can connect its own accounting software: Xero, QuickBooks Online (provided by Intuit), Sage Accounting or Sage 200 (provided by Sage), or Microsoft Dynamics 365 Business Central (provided by Microsoft). If it does, we read its supplier bills, credit notes and payments (supplier names, invoice numbers, amounts, VAT and dates) every morning to add them to its supplier records. If the organisation chooses, we also fill in a supplier's empty company number, VAT number or address from its accounting software. We never read bank details from it. These are data sources the organisation chooses to connect, not our sub-processors. We only read; we never change anything in the organisation's accounting software. Each connection's access keys are stored securely and are removed when the organisation disconnects.

Automatic user syncing

An organisation can let its identity provider (Microsoft Entra ID or Okta) add and remove its staff in SupplierVault automatically. If it does, we receive each person's name, email address, role and whether they are active, and use them only to give or remove access to that organisation. The organisation is the controller of this information. We keep a record of who was added this way, and the changes appear in the organisation's audit trail.

What we collect

• Account details: your name, work email address and, if you use one, your password (stored only in a securely hashed form by our authentication provider). If you sign in with Microsoft or Google, we receive your name and verified email address from them; we never see your Microsoft or Google password.
• Organisation details: your organisation's name and the team members you invite, with their email addresses and roles.
• Usage records: a log of changes made in the app, with who made them and when, kept as an audit trail for your organisation.
• Messages: anything you send us by email.
• Partner applications: if you apply to be a partner, your name, work email, firm, website and the kind of clients you work with. If a partner introduced your organisation, we record which partner it was.
• Technical information: our hosting providers process your IP address and browser details to deliver the website and keep it secure.

Why we use it, and our lawful basis

We don't sell personal information, and we don't use it for advertising.

Who we share it with

We use these service providers, who process personal information on our behalf:

• Supabase: database and sign-in. Our database is hosted in London, UK.
• Resend: sends our emails, such as invitations to join an organisation, email confirmations, password resets and email reminders.
• Cloudflare: website hosting and delivery.
• Anthropic: provides the AI assistant and the contract and invoice readers. When someone in an organisation asks the assistant a question, the question and the records that person can see are sent to Anthropic to work out the answer. When someone uses a reader, the document being read is sent. Anthropic doesn't use this to train its models. Organisations can switch the assistant off.
• Google Fonts: our pages load fonts from Google's servers, which means your browser sends your IP address to Google.
• jsDelivr: the app and supplier pages load their sign-in and database code library from jsDelivr's network, which means your browser sends your IP address to jsDelivr.

The full list, with where each one holds data and how we tell customers about changes, is on our sub-processors page.

We may also share information if the law requires it.

International transfers

Some of our providers, or their support teams, may process information outside the UK. Where that happens, we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.

How long we keep it

• Account and organisation information: while your account is active, and for 30 days after it is closed.
• Backups: up to 7 days, after which they are overwritten.
• Emails with us: as long as needed to deal with your question, and then for a reasonable period in case it comes up again.
• Financial records: as long as the law requires.
• Partner applications we decline: 12 months. Approved partners: while they are a partner, and as long as needed to settle rewards after that.

Counting visits to our website

When someone opens a page of our public website or the demo, we record the page, the date and time, where the visit came from (a tag in the link, for example "linkedin", or the name of the website that linked to us) and the type of device (phone, tablet or computer). We don't use cookies for this and store nothing on your device.

To count how many different people visit each day, we make a one-way code from your network address and browser type, combined with a random value that we create each day and delete the next. We store only the code, never your network address. Once the day's random value is deleted, the code can't be turned back into your address or linked to your visits on other days. Known search-engine robots aren't counted.

We use the counts to see which posts and pages bring people to SupplierVault, and delete them after 18 months. Our lawful basis is legitimate interests: understanding how our website is used, in a way that doesn't identify you.

Cookies and browser storage

We don't use advertising or analytics cookies. The app uses your browser's storage to keep you signed in and to remember preferences, such as panel sizes and filters. These are strictly necessary for the service or are set by your own choices. The live demo saves the changes you make in your own browser only. They never reach our servers, and you can clear them with the "Reset demo" button.

Your rights

You have the right to:

• ask for a copy of your personal information
• ask us to correct it
• ask us to delete it
• ask us to restrict how we use it
• object to how we use it
• ask us to transfer it to you or another organisation

To use any of these rights, email hello@suppliervault.co.uk. We will reply within one month.

Complaints

If you are unhappy with how we have used your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes

We will update this notice if anything changes, and show the date at the top.