Legal, disclaimers & refunds
Service provider: Integra Solutions, a sole proprietorship operating from Panama City, Panama. Responsible: Jonathan Bonilla. Tax ID (RUC) is provided in the Service Agreement. Last updated: October 2026.
This page summarises the terms that apply to every engagement. The full Service Agreement, Data Processing Agreement (DPA) and Non-Disclosure Agreement are provided before you upload any document; by purchasing, you accept them.
1. What VendorAnswers does
VendorAnswers prepares and evidence-maps responses to vendor security questionnaires, based exclusively on the documents and information you provide. We deliver a completed questionnaire, an evidence map, a list of gaps and an executive summary.
2. Disclaimers
- Not a certification or audit. VendorAnswers does not certify, attest, audit or guarantee compliance with any framework (SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS or any other). We are not an auditor or a certification body.
- Not legal advice. Nothing in the deliverable is legal advice. VendorAnswers is not a law firm and does not provide legal opinions.
- No guarantee of acceptance. We do not guarantee that your customer, its security team or any third party will accept the questionnaire, approve your company or close the deal.
- You are responsible for the truth. You are solely responsible for the accuracy, truthfulness and completeness of the information and evidence you provide, and for reviewing the final deliverable before submitting it.
- Gaps are flagged, never fabricated. Where no evidence exists for a question, the answer is marked as a GAP. We do not create, alter or infer evidence, policies or facts. We are not responsible for the absence of that information, for the resulting gaps, or for any consequence of submitting a questionnaire with gaps.
- We do not create policies. We do not draft, modify or implement security policies or controls on your behalf. We only map and draft answers against documentation you already have.
- AI assistance and human review. Drafts are produced with AI assistance and reviewed by a human operator. You must review the deliverable before sending it to your customer.
- Liability cap. Our aggregate liability is limited to the fees you paid for the specific order (1× fee), except for confidentiality and personal-data breaches (3× fee).
- Data. Documents are retained for 30 days after delivery, then deleted with a certificate. We do not train models on your data. We act as processor; you remain the controller.
- Right to share. You represent that you have the right to share the documents and information you upload, and that doing so does not breach any obligation to a third party.
3. Refund and cancellation policy
| Situation | Outcome |
|---|---|
| We do not deliver within 48 hours of a complete intake | Full refund of the amount paid (the payment provider's processing fee is not recoverable) or free delivery, your choice |
| Cancellation before the intake starts | Full refund minus the payment processing fee |
| Cancellation after the intake starts but before delivery | 50% refund or a 12-month credit |
| Delivered, but you do not use it | One revision round included; no refund |
| No documents submitted for 30 days | 50% refund or a 12-month credit |
| Demonstrable error on our side (a fact not attributable to you) | Redone at no cost, plus a partial refund at our discretion |
| Chargeback | Handled through our merchant of record; evidence provided |
Refunds are processed through Lemon Squeezy, our merchant of record. The payment processing fee (5% + $0.50 + 1.5% for international cards) is not recoverable.
4. Data Processing Agreement (summary)
- Roles: you are the controller; VendorAnswers is the processor.
- Purpose: prepare and deliver the questionnaire response. No other use.
- Sub-processors: Cloudflare, Supabase, Google, Resend, Lemon Squeezy.
- Transfers: under standard contractual clauses where required.
- Security: encryption in transit and at rest, MFA, least-privilege access.
- Deletion: documents deleted 30 days after delivery with a certificate; backups expire within 60 days.
- Breach: notification within 24 hours of confirmation.
The full DPA is provided before intake and prevails over this summary.
5. Privacy summary
- Roles: you are the controller of your data and your customers' data; VendorAnswers is the processor.
- What we collect: account and billing data (through Lemon Squeezy), the questionnaire, the documents you upload, and the correspondence needed to deliver the service.
- Purpose: to produce and deliver the service, and to comply with legal obligations. Nothing else.
- Sub-processors: Cloudflare (hosting, DNS), Supabase (database and storage), Google (email and workspace), Resend (transactional email), Lemon Squeezy (payments). The current list is provided in the DPA.
- Retention: documents are deleted 30 days after delivery; backups expire within 60 days; billing records are kept as required by law.
- Your rights: access, correction, export and deletion. Email vendoranswers@gmail.com and we respond within 5 business days.
- Security: encryption in transit and at rest, access restricted to the operator, MFA on all accounts, and no training of AI models on your data.
6. Terms summary
- Scope: one questionnaire per order, up to 150 questions, one revision round, 48 hours from a complete intake. Additional questions are billed in blocks of 150.
- Payment: 100% in advance through Lemon Squeezy, which acts as merchant of record and handles applicable sales taxes.
- Acceptable use: you may not use VendorAnswers to fabricate evidence, to misrepresent your security posture, to send unsolicited messages, or to process data you are not authorised to share.
- Confidentiality: mutual, for 3 years after the engagement ends.
- Intellectual property: you own your documents and the final deliverable; we retain the methodology and templates.
- Governing law and forum: the laws of the Republic of Panama; courts of Panama City.
- Termination: either party may terminate for material breach with 15 days' written notice; confidentiality and liability clauses survive.
7. Trademarks
All third-party product names and logos mentioned on this site (including OneTrust, Whistic, SecurityScorecard, Panorays, Prevalent, SIG, CAIQ and VSA) are trademarks of their respective owners and are used for identification purposes only. VendorAnswers is not affiliated with, endorsed by or sponsored by any of them.
8. Contact
Questions about these terms: vendoranswers@gmail.com. We answer within one business day.