Privacy Policy

This Privacy Policy explains what data Vendlio collects when you use the Platform, either as a Merchant running a store or as a customer buying from one, and how that data is used.

1. Data we collect

• Account data: email address, password hash, and store settings you provide when you register as a Merchant.
• Transaction data: order records, customer email addresses, and payment status needed to deliver a purchase and let a Merchant manage their store. Card and payment account details are handled directly by the payment provider (Stripe, PayPal, etc.) and are not stored on our servers.
• Usage data: pages visited, referrers, and approximate location (from IP address) used for the analytics shown to Merchants in their dashboard, and to detect fraud and abuse.
• Cookies: used to keep you logged in, remember your cart, and measure aggregate traffic. See Section 5.

2. How we use this data

• To operate the storefronts and process orders
• To send transactional email (order confirmations, delivery, password resets)
• To provide Merchants with analytics about their own store
• To detect fraud, abuse, and security incidents
• To comply with legal obligations

We do not sell personal data to third parties.

3. Who we share data with

Data is shared only where necessary to run the Platform: the payment provider a Merchant connects (to process that specific order), our email delivery infrastructure (to send transactional email), and infrastructure providers who host the Platform. Each of these processes data under their own privacy terms.

4. Data retention

Account and order data is kept for as long as the account is active, plus a reasonable period afterward for accounting, tax, and fraud-prevention purposes. You can request deletion of your account data as described in Section 6.

5. Cookies

Vendlio uses a session cookie to keep you logged in and a cart cookie to remember items you've added to a cart. These are functional and not used for third-party advertising.

6. Your rights

If you are located in the EU/EEA or UK, you have the right under GDPR to access, correct, export, or request deletion of your personal data, and to object to certain processing. To exercise any of these rights, contact [email protected]. We will respond within the timeframe required by applicable law.

7. Children

The Platform is not directed at children under 16, and we do not knowingly collect personal data from them.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date above.

9. Contact

Questions about this policy can be sent to [email protected].