VendBook

Privacy Policy

Last updated: July 9, 2026

1. Who we are

VendBook is a software-as-a-service product built and operated by Julian Engels (“we,” “us,” or “our”). VendBook helps food truck operators forecast event revenue, track performance, and optimize booking decisions. Questions about this policy can be directed to support@vendbook.com.

2. What data we collect

When you use VendBook, we collect:

  • Account information: your email address, business name, city, and state.
  • Event data: event names, dates, locations, sales figures, fee structures, event types, weather conditions, attendance estimates, and any notes you enter.
  • POS data: sales totals imported from connected point-of-sale systems (Square, Clover, Toast). OAuth tokens are stored encrypted and never exposed.
  • Usage data: pages visited, features used, and general interaction patterns within the app.
  • Payment data: billing and subscription information processed by Stripe. VendBook does not store full payment card details.
  • Booking and inquiry form data: if you submit a booking request or event inquiry through a vendor's public page, we collect the details you enter (name, email, phone, event date, location, and notes) and share them with the vendor you're contacting so they can respond.

3. How we use your data

We use your data to:

  • Provide the VendBook service — forecasting, performance tracking, and analytics.
  • Maintain and improve the application.
  • Process payments and manage your subscription.
  • Send transactional emails (account confirmation, billing receipts).

4. Internal model improvement — how we use your event data

VendBook's forecast engine improves over time as more event data accumulates. By default, your event data (including event names, dates, types, locations, sales figures, weather conditions, and fee structures) may be accessed by VendBook internally to analyze patterns, validate forecast accuracy, and improve the forecasting model for all users.

This data is never sold, shared with third parties, or made accessible to other VendBook users. It is used exclusively by VendBook's operator (Julian Engels) for internal product development and model refinement.

If you prefer that your event data not be used for model improvement, you can opt out at any time in Dashboard → Settings → Data & Privacy. Opting out does not affect the core functionality of VendBook for your account.

5. Data isolation and security

All user data is stored in a Supabase PostgreSQL database with Row Level Security enforced at the database level. No VendBook user can view another user's events, sales, contacts, or forecasts through the application. POS OAuth credentials are stored encrypted in Supabase Vault and are never transmitted to the client.

6. Third-party services

VendBook uses the following third-party services:

  • Supabase — database and authentication hosting.
  • Vercel — application hosting and deployment.
  • Stripe — payment processing and subscription management.
  • Resend — transactional and notification email delivery.
  • Sentry — application error monitoring.
  • Google Analytics & Google Ads — website analytics and advertising measurement (see Section 7 — only active with your consent).
  • Open-Meteo — weather forecast data (no personal data shared).

Each of these services has their own privacy policy governing their data practices.

7. Cookies, analytics, and advertising

We use Google Analytics 4 to understand how visitors use our public pages, and Google Ads conversion tracking to measure whether our advertising works (for example, counting a submitted booking request that arrived from an ad). These tools use cookies and similar identifiers.

No analytics or advertising cookies are set until you consent. We run Google Consent Mode v2 with all storage denied by default. A consent banner lets you allow or decline; if you decline, Google receives only aggregated, cookieless signals and no cookies are stored on your device.

If you consent, we may also send Google a one-way hashed (SHA-256) version of the email address you enter when submitting a booking request, to improve conversion measurement (Google “enhanced conversions”). The hash cannot be reversed into your email address by us or used by Google to contact you.

You can change your mind at any time by clearing this site's data in your browser settings — the consent banner will ask again on your next visit. Essential cookies (login sessions, security) don't require consent and are always active.

8. Data retention

We retain your data for as long as your account is active. To delete your account, email us at support@vendbook.com and we'll remove your account and associated data within 30 days, except where retention is required for legal or billing purposes (e.g. invoice records).

9. Your rights

You have the right to:

  • Access the data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and associated data.
  • Opt out of internal model improvement data use (Settings → Data & Privacy).
  • Decline or withdraw analytics/advertising consent (Section 7).

To exercise any of these rights, contact us at support@vendbook.com.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or via an in-app notice. Continued use of VendBook after changes take effect constitutes acceptance of the revised policy.