Privacy policy

Last updated October 19, 2026

Vauren (“Vauren”, “we”, “us”) provides software that helps organizers of markets, fairs and festivals track vendor sales, booth fees and commission. This policy explains what personal information we handle, why, and the choices you have. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial laws including Québec’s Law 25, Alberta’s PIPA and British Columbia’s PIPA.

The short version

We collect only what the service needs to work.
We never see or store card numbers, and we never hold or move anyone’s money.
We don’t sell personal information, show ads, or use tracking or analytics cookies.
Our app and database run in Canadian data centres (Montréal).
You can ask to see, correct or delete your information at any time.

Whose information, and our role

Organizers create accounts and events. Vendors are businesses that sell at those events and join through a private invite link from the organizer. When an organizer adds vendor details or views vendor sales, we process that information on the organizer’s behalf and under their instructions; the organizer is responsible for having the right to share it with us. For organizer accounts, and for information vendors give us directly through their invite link, we are responsible for it under this policy.

What we collect

Organizer accounts: name, email, organization name, a securely hashed password, and the Interac e-Transfer email you choose to show vendors.
Events: names, dates, times, commission rates and booth fees.
Vendors: business name, contact name, email and, optionally, phone number.
Sales from a connected card machine (only if a vendor chooses to connect, with read-only access): merchant and location name, and for each payment its amount, time, tip, tax and refunds. We do not receive card numbers or the names of a vendor’s customers.
Self-reported sales: totals a vendor enters, and photos or files they upload as proof (for example a receipt or a batch report). Proof photos may contain other details a vendor chooses to include.
Booth fees and tokens: amounts owed and paid, payment reference codes, token sales, redemptions, payouts and cash counts.
Technical information: one essential sign-in cookie, and standard server logs kept by our hosting providers (such as IP address, browser type and time of request) to keep the service secure and working.

How we use it

To run the service: show live sales, calculate commission, track booth fees and produce reports and statements.
To secure the service, prevent fraud and abuse, and fix problems.
To contact organizers about their account, the service and changes to it.
To meet legal obligations.

We rely on your consent, which you can withdraw at any time (this may mean we can no longer provide part of the service). We do not use personal information for advertising, and we do not sell or rent it. We may use information that has been aggregated and de-identified so it can no longer identify anyone, for example to understand how the product is used.

Cookies

We use one strictly necessary cookie to keep you signed in. We don’t use analytics, advertising or third-party tracking cookies, so there is nothing to opt out of.

Who we share it with

The event’s organizer: a vendor’s sales, booth fee status and statement are visible to the organizer of the events that vendor joined, and to no other organizer.
Service providers that host and run Vauren for us, under contracts that require them to protect the information: Vercel (application hosting) and Supabase (database and file storage). Both run our service in Canada (Montréal).
Card machine providers (currently Square), only when a vendor chooses to connect, and governed by that provider’s own privacy policy.
When the law requires it, for example a valid court order, or to protect the rights, safety or property of our users or others.
In a business transfer such as a merger or acquisition, where the information would stay protected under terms at least as strong as this policy.

Where it is stored

Our application and database are hosted in Canada. Some of our service providers are based in, or may process limited information (such as network logs or support requests) in, other countries including the United States, where it may be accessible to authorities under local law. We assess providers before using them and require them to protect personal information.

How long we keep it

We keep information while an organizer’s account is active, because organizers often need event records for their bookkeeping. When an account is closed we delete or de-identify its information within 90 days, except where we must keep it longer by law. Backups are overwritten on a rolling schedule. A vendor can stop syncing at any time by revoking Vauren’s access in their Square dashboard.

How we protect it

We use encryption in transit and at rest, encrypt card machine access tokens, hash passwords and invite links, keep each organizer’s data separate, and limit who can access production systems. No system is perfectly secure, but we work to protect your information and to respond quickly if something goes wrong. Read more on our security page.

If there is a breach

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify the people affected and report it to the Office of the Privacy Commissioner of Canada (and, where required, Québec’s Commission d’accès à l’information and other provincial regulators) as soon as feasible, and keep a record of it as the law requires.

Your rights

You can ask to access the personal information we hold about you, correct it, or have it deleted, and you can withdraw your consent. Email privacy@getvauren.com; we respond within 30 days. If a request is about information an organizer added, we may pass it to that organizer, who controls it. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

Children

Vauren is a business tool and is not meant for anyone under 16. We do not knowingly collect children’s information.

Person in charge of privacy

Our Privacy Officer is responsible for protecting personal information at Vauren and for this policy. Contact: privacy@getvauren.com.

Changes

We will update this policy as the service changes and post the new date at the top. If a change is significant we will tell organizers by email before it takes effect.