Privacy Policy

VendSheet is a vending-operations management service operated by Rainey Web Co. (“VendSheet,” “we,” “us”), based in Illinois, USA. This policy explains what information we collect when you use VendSheet at vendsheet.app and how we handle it.

Account information. When you create an account we collect your name, email address, and organization name. Passwords are handled by our authentication provider and are never visible to us in plain text.

Operational data you enter. The content you put into VendSheet to run your operation: locations, machines and planograms, products and prices, inventory counts, service trips, pick lists, and notes.

Machine telemetry. If you connect vending telemetry (for example Cantaloupe/Seed or your own devices), sales and machine events your equipment reports are delivered to your organization’s private ingest endpoint and stored as part of your operational data.

Cookies and device storage. We use cookies only to keep you signed in (authentication session). We do not use advertising or third-party analytics cookies. Your browser also stores a few preferences locally on your device — your light/dark theme choice and pick-list check-off progress — which never leave your device.

We do not collect payment card information — VendSheet currently has no in-app payments.

We use your information solely to provide and operate the service: authenticating you, storing and displaying your operational data, and sending transactional email such as teammate invitations and password resets. We do not sell your data, and we do not show ads.

We rely on a small number of infrastructure providers to run VendSheet:

• Supabase — database and authentication hosting (data stored in the United States).
• Vercel — application hosting and content delivery.
• Resend — delivery of transactional email.

These providers process data only on our behalf to run the service. We may also disclose information if required by law.

VendSheet is multi-tenant: every record belongs to one organization, and access is enforced at the database level so members of one organization can never read another’s data. Within your organization, role-based permissions (owner, admin, manager, driver, picker) control who sees what.

Your data is retained while your account is active. Organization owners can erase their operation’s data at any time with the “Clear all data” tool under Configuration. To delete your account or your entire organization, contact us and we will remove it.

All traffic is encrypted in transit (HTTPS). Access to data is restricted by authentication, role-based permissions, and database row-level security. No method of storage or transmission is 100% secure, but we design the service so the failure of any one safeguard does not expose your data.

VendSheet is a business tool and is not directed to children under 13. We do not knowingly collect information from children.

If we make material changes to this policy, we will update the date above and, for significant changes, notify account owners by email or in the app.

Questions about privacy or your data: support@vendsheet.app.Copy