Effective October 31, 2026 · Terms of Service

VendorDesk Privacy Policy

This policy explains how Fantasium Media LLC ("Fantasium Media," "we," "us") handles personal information in the VendorDesk app at vendordesk.deskapps.app, including VendorDesk Connect, product feeds, emailed purchase orders, private order pages, and retailer-facing emails.

It covers the VendorDesk app only. Our marketing site, deskapps.app, has its own website privacy page.

Questions: support@deskapps.app. Fantasium Media LLC is based in Bozeman, Montana. Mail: PO Box 186, Gallatin Gateway, MT 59730, USA.

1. Who this policy is about

• Customers: wholesalers and brands that pay for VendorDesk, and their team members.
• Retailers: businesses that sell a Customer's products and send orders through VendorDesk. Retailers never pay VendorDesk.
• End customers: the people who buy from a retailer and whose shipping details appear on orders.

2. Our two roles

• For Customer account information (who signed up, team members, billing), we decide how the information is used. We are the controller.
• For retailer and end-customer information, the Customer decides how it is used. The Customer is the controller and we are the processor: we handle it only on the Customer's behalf and on their instructions, as described in the Data Processing section below.

If you are a retailer or end customer, the wholesaler you deal with is responsible for your information. Their own privacy notice applies, and requests about your data should go to them first (see Section 7).

3. What we collect

We never see or store full card numbers. Card payments from retailers go through the Customer's own Stripe account (Stripe Connect, standard accounts) and money goes straight to the Customer.

Cookies. The app uses only the cookies needed to keep users signed in and secure. We do not use advertising cookies in the app.

4. How we use it

We use personal information to:

• Provide the Service: check orders (stock, address, shipping regions), charge or invoice retailers on the Customer's behalf, create orders in the Customer's store, and send tracking back to retailers.
• Send service emails, such as order confirmations, invoices, and tracking updates (with the Customer's branding if they use white-label branding).
• Run Customer accounts, including billing for VendorDesk through Stripe.
• Provide support when asked.
• Keep the Service secure, prevent abuse, and fix problems.
• Meet legal obligations.

We do not sell personal information, and we do not use retailer or end-customer data for our own marketing.

5. Who we share it with

• Subprocessors that help us run the Service (listed in Section D below).
• The Customer, for retailer and end-customer data processed for them.
• Retailers, to the extent the Service shows them information about their own orders (for example, tracking).
• Authorities or others, if required by law or to protect rights and safety.
• A successor business, if Fantasium Media's business is sold or merged, with this policy continuing to apply.

6. How long we keep it

• End-customer shipping details are kept only as long as needed to fulfill and support orders, then removed on a schedule: 90 days after an order ships or is cancelled (the state and country are kept for reporting).
• Other Customer Data (catalog, retailer contacts, order records without end-customer shipping details) is kept while the Customer's account is active.
• When an account ends, the Customer has 30 days to export their data. We then delete it within 30 days, except where the law requires us to keep it. Copies in backups are deleted as those backups expire, within a further 30 days.
• Billing records are kept for 7 years for tax and accounting.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or get a copy of your personal information, or to object to certain uses.

• Customers and team users: email support@deskapps.app, or update details in the app.
• Retailers and end customers: contact the wholesaler you deal with. If you contact us, we will pass your request to that wholesaler and help them respond.

8. Security

See Section E below. No system is perfectly secure, but we take reasonable steps to protect information.

9. Children

VendorDesk is a business tool and is not directed at children.

10. Changes

If we make material changes to this policy, we will tell Customers by email or in the app before they take effect. The effective date above shows the latest version.

Data Processing

This section applies when Fantasium Media processes personal information on a Customer's behalf. It forms part of the VendorDesk Terms of Service.

A. Roles and instructions

• The Customer is the controller of retailer and end-customer personal information. Fantasium Media is the processor.
• We process that information only to provide the Service, following the Customer's documented instructions (the Terms, this section, and the Customer's use and settings in the app).
• The Customer is responsible for having a lawful basis to share the information with us and for giving any required notices to its retailers and end customers.

B. What is processed

• People: Customer team users, retailer contacts, end customers.
• Data: names, emails, phone numbers, addresses, order details, and payment metadata (card brand and last 4 digits from Stripe).
• Purpose: operating the Customer's dropship program through VendorDesk.
• Duration: while the Customer's account is active, plus the export and deletion periods in Section F.

C. Our people

Access to Customer Data is limited to the operator of Fantasium Media. Anyone given access in the future will be bound to keep it confidential.

D. Subprocessors

We will notify Customers at least 30 days before adding or replacing a subprocessor, by email or in the app. A Customer that reasonably objects may cancel before the change takes effect. We require subprocessors to protect data to a standard at least as protective as this section.

E. Security

• All traffic to and from the app is encrypted in transit (HTTPS).
• Store access tokens and payment credentials are encrypted at rest.
• Access to Customer Data is limited to the operator.
• Customers control which team members can access their account.

F. Retention and deletion

• End-customer shipping details are removed 90 days after an order ships or is cancelled.
• On account termination, the Customer has 30 days to export its data; we then delete it within 30 days, except where the law requires us to keep it. Backup copies are deleted as those backups expire, within a further 30 days.

G. Data subject requests

If a retailer or end customer contacts us directly about their personal information, we will pass the request to the relevant Customer without undue delay and will not respond ourselves unless the Customer asks us to or the law requires it. We will give the Customer reasonable help to respond.

H. Breach notification

If we become aware of a security breach affecting Customer personal information, we will notify the affected Customer without undue delay. We will share what we know about what happened, what data is affected, and what we are doing about it, and update the Customer as we learn more.

I. International transfers

VendorDesk stores data in the United States, and its subprocessors process it there or in the locations listed in Section D. Customers with retailers or end customers in the EU, the UK, or other regions with data transfer rules can contact support@deskapps.app about additional terms.

J. Help and security questionnaires

We will give the Customer reasonable information needed to show compliance with this section, and answer reasonable security questionnaires, on request to support@deskapps.app. We do not offer on-site audits.