Privacy policy.

Valtis Desk is used by three kinds of people, and our role is different for each:

• Distributors (our customers) who create an account to collect credit applications. For their account information, we decide how the data is used.
• Applicants who fill in a distributor's credit application. That information belongs to the distributor. We process it on their behalf and only to provide the service to them.
• Trade references, the vendors an applicant lists, who answer a reference request. Their answers also belong to the distributor who asked.

If you applied for credit or answered a reference, the distributor named on the form is your main point of contact for your information.

Distributor accounts: your name, work email, password (stored only as a secure hash by our authentication provider), company name, application link, brand color, logo, business address, tax ID if you add it, and billing details. If you sign in with Google, we receive your name, email address and profile picture from Google. We do not receive your Google password or access to your other Google data.

Credit applications: the business details an applicant enters, such as legal name, trade name, EIN, address, phone, email, years in business, expected purchases and requested credit; the principal's name, title and contact details; the trade references they list; and their signature. With each signature we record the time, IP address and browser or device, and a SHA-256 fingerprint of the signed application, so the record can be shown to be unchanged.

Reference answers: how long the account has been open, credit extended, balances, payment behavior, comments, and the IP address and time the answer was submitted.

Payments: handled by our payment provider, listed below. We receive your subscription status, plan and invoice records. We never see or store full card numbers.

Technical data: the minimum needed to run the service securely, such as server logs with IP addresses and request times. We do not use advertising trackers or sell information to anyone.

• To run the service: show applications to the distributor, email reference requests, notify the distributor, and produce the audit PDF.
• To create and secure accounts, including sign-in with Google.
• To bill subscriptions.
• To send service emails, such as account confirmations, alerts and receipts. We do not send marketing email without your consent.
• To prevent fraud and abuse, keep the service secure, and meet legal obligations.

When you choose “Continue with Google”, we request only your basic profile (name, email address and profile picture) to create and sign in to your account. We use this information for nothing else, do not share it with third parties except the service providers below that run sign-in, and do not use it for advertising. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can remove Valtis Desk's access at any time from your Google Account's security settings.

We share information only with the distributor it belongs to and with the service providers that run Valtis Desk for us:

• Supabase: database and authentication, hosted in the United States.
• Vercel: website and application hosting.
• Resend: sending email, such as reference requests and notifications.
• Stripe: subscription payments.
• Google: sign-in, if you choose it.

These providers may only use the information to provide their service to us. We may also disclose information if the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply.

Data is encrypted in transit and at rest. Applications are visible only to people signed in to the distributor's account. Database access is locked down so public keys cannot read it. Reference links are private and stop working once used. No system is perfectly secure, but we work to protect your information and will notify affected customers of a breach as the law requires.

We keep distributor account data for as long as the account is open. Applications and reference answers are kept for as long as the distributor keeps them in their account, because they form part of the distributor's credit records. When a distributor closes their account, we delete their data within 90 days, except records we must keep for tax, accounting or legal reasons.

You can ask to see, correct, export or delete your personal information by writing to support@valtisdesk.com. Distributors can update most account details in settings. If you are an applicant or a reference, we will pass your request to the distributor who holds your information, or you can contact them directly.

Depending on where you live, including California under the CCPA, you may have additional rights. We do not sell or share personal information for cross-context behavioral advertising, and we will not treat you differently for exercising your rights.

We use only the cookies needed to keep you signed in and remember your light or dark theme. We do not use advertising or tracking cookies.

Valtis Desk is a business service. It is not meant for anyone under 18, and we do not knowingly collect information from children.

If we change this policy, we will update the date at the top. If a change is significant, we will tell account holders by email before it takes effect.

For privacy questions or requests, write to support@valtisdesk.com. We aim to reply within 30 days.