Privacy policy

Vendo is run by a small team in Kerala, India. This policy covers getvendo.io, app.getvendo.io and the shop pages at web.getvendo.io. Our store at shop.getvendo.io has its own privacy policy.

For shop owners' account data, we are the data fiduciary under India's Digital Personal Data Protection Act, 2023. For data visitors give to a shop (enquiries, orders, loyalty cards), the shop decides how it's used and we process it on the shop's behalf.

• Account details: your name, email, phone number and password (stored only as a secure hash).
• Shop details: your business name, address, hours, photos, offers, menu, prices and any other content you add.
• Billing: your plan, payment dates, amounts and Razorpay references. Card and UPI details stay with Razorpay.
• Usage: how you use the dashboard, and the device, browser and IP address you sign in from, for security.
• Where you came from: the link, campaign or affiliate that referred you, so we can credit them.
• Messages you send us, and notes from calls with our team.

• Anonymous activity: page views and taps on buttons like call, directions, UPI pay and review. We use this for the shop's reports and don't tie it to your name.
• What you choose to send a shop: your name, phone number, email, address, order or enquiry when you fill in a form; your phone number when you join a loyalty card; and a browser push token if you allow notifications.
• Coupons you claim, so the shop can check and redeem them.

A shop only gets your contact details if you give them in one of these forms.

• To run your account and your shop page, and to show you reports.
• To deliver enquiries, orders, loyalty updates and notifications between shops and their customers.
• To take payments, send receipts and keep accounting records.
• To send service emails about your account, trial, renewals and security.
• To send product news and tips. You can unsubscribe from these anytime.
• To pay affiliate commission, and to prevent fraud, spam and abuse.
• To fix bugs and improve Vendo, using aggregated statistics wherever possible.

• Sign-in cookies keep you logged in to your dashboard. They're essential and can't be turned off.
• An affiliate cookie remembers which affiliate link you opened, for 90 days.
• An attribution cookie remembers which campaign brought you to Vendo, for 90 days.
• Privacy-friendly analytics (Vercel Analytics) measures page visits and speed without advertising cookies or cross-site tracking.

We don't use advertising or social-media tracking cookies.

Only with the providers that help us run Vendo, each under a contract to protect it and use it only for us:

• Supabase: database and sign-in, hosted in Mumbai, India.
• Vercel: website hosting and analytics.
• Razorpay: payments and refunds.
• Resend: account and notification emails.
• Sentry: error reports so we can fix problems.

When a visitor sends a shop an enquiry or order, the shop owner sees it. If you joined through an affiliate, they see your shop name and payment status, not your other data.

We also disclose data when the law requires it. We never sell or rent personal data.

Our main database is in India. Some providers, such as our email, hosting and error-reporting services, may process data outside India, with safeguards in place and as Indian law permits.

• Account and shop content: while your account is open. If you close it, we delete it within 90 days, apart from what we must keep by law.
• Billing records: 8 years, as Indian tax law requires.
• Visitor enquiries, orders and loyalty data: while the shop's account is open, or until the shop or the visitor asks us to delete it.
• Page activity: kept as daily totals; raw events are deleted after 180 days.

You can ask to see the personal data we hold about you, correct it, delete it, or withdraw consent you've given. Shop owners can edit most of their data directly in the dashboard.

If you're a visitor and want your details removed from a shop's list, contact the shop, or write to us at hello@getvendo.io and we'll pass it on and help. We respond to every request within 30 days.

Everything is encrypted in transit with HTTPS, passwords are hashed, accounts can use two-factor sign-in, and each shop can only see its own data. If a breach ever affects your data, we'll notify you and the Data Protection Board of India as the law requires.

Vendo accounts are for adults running a business. We don't knowingly collect data from children under 18.

If we make significant changes, we'll email shop owners and update the date at the top of this page.

If you're not satisfied with how we've handled a complaint or a request about your personal data, you can escalate it to our Grievance Officer:

• Name: Grievance Officer
• Email: hello@getvendo.io (subject line: "Grievance")

We acknowledge every grievance within 48 hours and aim to resolve it within 30 days of receiving it.