Privacy Policy

This policy explains what Grove Hill Research collects when you visit VendorStacks, create an account, or call the API — and what we do with it. It covers two very different kinds of data, and the distinction matters, so we keep them separate throughout.

1. The two kinds of data

• Customer data — information about you as a user of the service: your email, account, credits, and API usage.
• Indexed disclosure data — text that companies publish on their own public websites (subprocessor lists, privacy pages, terms). This is business information about vendor relationships, not consumer profiles. We do not build profiles of individuals, and we do not sell personal information.

2. Customer data we collect

• Account — email address and authentication identifiers, handled by our identity provider (Clerk). We never see your password.
• Billing — purchase amount, credit pack, and Stripe identifiers. Card numbers go directly to Stripe; we never receive them.
• Usage — the endpoints you call, timestamps, credits consumed, response status, and the IP address and user agent of the request. We use this for billing accuracy, rate limiting, abuse detection, and debugging.
• Support — anything you send us through the support form or by email, including the message body and the context needed to answer.
• Product analytics — pages viewed and in-app events, via PostHog, to understand how the product is used.

3. Why we may process it

To perform our contract with you (running the service, billing), for our legitimate interests (security, abuse prevention, understanding and improving the product), and to meet legal obligations (tax and accounting records). Where consent is required for analytics or marketing in your jurisdiction, we rely on consent and you can withdraw it at any time.

4. How long we keep it

• Account records: for the life of the account, then deleted or anonymized within 90 days of a deletion request.
• Usage and request logs: retained for operational and billing-dispute purposes, then aggregated.
• Billing records: retained as long as tax and accounting law requires.
• Support correspondence: retained while it is useful to support you, then deleted.

5. Who we share it with

Only the subprocessors we need to run the service — hosting, database, authentication, payments, email, analytics, and the crawling infrastructure. They are listed, by name and purpose, on our Subprocessors page. We do not sell customer data, and we do not share it for cross-context behavioral advertising. We may disclose data where legally compelled, and will tell you unless we are prohibited from doing so.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to complain to a supervisory authority. Email josh@grovehillresearch.com and we will respond within the period your law requires (30 days unless stated otherwise). We will not discriminate against you for exercising these rights.

7. If you are a company we indexed

We only index pages that are publicly reachable and intended for publication, we identify our crawler honestly, and we respect robots.txt. If a page of yours is in the index and should not be — or is out of date — write to josh@grovehillresearch.com or use the support form and we will correct or remove it. See also our Acceptable Use Policy.

8. Security

Data is encrypted in transit. Access to production systems is limited to people who need it. API keys are stored hashed, and shown in full only once at creation. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you without undue delay.

9. International transfers

Our infrastructure is operated in the United States. If you access the service from elsewhere, your data is transferred there, protected by the appropriate safeguards our subprocessors maintain.

10. Children

The service is for business use and is not directed to anyone under 16.

11. Changes and contact

Material changes will be announced by email to account holders before they take effect, and the effective date above will change. Questions or requests: josh@grovehillresearch.com.