Privacy Policy

Vendariz is a registered trade name (“DBA”) of Vendoza LLC (“Company”, “we”, “our”, or “us”). We are committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information when you use the Vendariz platform, website, mobile applications, and related services (the “Service”).

By accessing or using the Service, you consent to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect the following categories of information:

a) Account Information

Vendariz is invite-only, so there are exactly two ways to get an account: we create one for you, or you accept an invitation from an existing Vendariz business account. There is no self-service sign-up, and we no longer offer sign-in through Google or any other third-party identity provider — that option was removed on August 11, 2026, and no sign-in information is exchanged with any such provider. Asking for access through the early-access form on our website does not create an account and never has: it sends us a message, and a person decides. Depending on the path, we collect:

• Email address — required, and used as your sign-in identifier.
• Password — stored by AWS Cognito in hashed form. We never see it.
• Profile details you choose to add — name, a contact email, phone number, mailing address, and a profile picture.
• Two-factor authentication — if you enable it, an authenticator secret held by AWS Cognito.
• Business details — your business name, contact email and phone, and business address.
• Terms acceptance record — when you accept our Terms and Conditions, we record the version you accepted, the time, the IP address the acceptance came from, and your browser’s user-agent string. An acceptance with no time or address attached is an assertion rather than a record, which is why these are kept — for the life of the account. You can see your own current record in account settings.

b) Business Records You Enter

The Service exists to hold your operating records, and those records are the bulk of what we store: locations and their addresses, products, pricing, inventory, planograms and layouts, routes, restock history, and support tickets. Two categories deserve to be called out because they are more sensitive than the rest:

• Receipts. Images and PDFs you upload, and the vendor, date, totals, tax and line items extracted from them. A photographed receipt can contain whatever happened to be on the paper — please do not upload documents containing information you would not want stored.
• Mileage and vehicle records. Trip dates, start and end odometer readings, the addresses of the stops you made, the business purpose you wrote, whether you marked a stop personal, and for each vehicle its description and license plate, if you enter one.
• Host site contacts and commission records. If you record the locations that host your markets, those records can include the name, email address, and phone number of the host’s contact person, and where you track commissions, the payee’s name and email along with payout records — amount, date, method, and any reference you enter, such as a cheque number. These describe people who may have no Vendariz account of their own; you enter them, and they are visible only within your business account (see Section 6).

c) Usage and Technical Data

When you use the Service, our servers record technical data needed to run and secure it: the requests your app makes, timestamps, error and performance logs, and IP address in server and security logs. We also record device, app version, and browser information when you send a bug report, so we can reproduce the problem.

The Vendariz application contains no analytics or advertising trackers. The signed-in product at app.vendariz.com and our mobile apps contain no advertising, attribution, or session-recording SDKs, and nothing in them reports your activity to a third party — with one narrow exception in the mobile apps: crash reports. When the mobile app crashes or hits an unexpected error, it sends Google Firebase Crashlytics a technical report: the kind of error and where in our code it happened, the app version, the device model and operating system, the name of the screen that was open, and a random identifier for that installation of the app (not your device’s advertising identifier). It also notes each time the app is opened, with the device, operating system and mobile network, so we can tell what share of sessions end in a crash. A crash report never contains your name, email address, business, markets, products, amounts, or anything you typed, and it is not linked to your Vendariz account. Google keeps it for 90 days. You can turn crash reports off in the mobile app under Settings → Crash reports.

We do record when your business first completes each setup step. On our own servers, and only for your business as a whole, we note the first time it creates a market, builds and assigns a layout, adds inventory, and starts and completes a restock — the date, which account did it, and whether it happened on the web or in the mobile app. We use this to see where new customers get stuck so we can fix it. It is not shared with anyone, it is never used for advertising, and it is deleted with your account. There is no tracking code in the app doing this: it is a record of actions you already asked us to save.

The public marketing website (vendariz.com) uses Google Analytics, and only with your consent. Nothing is loaded and no cookie is set until you choose "Accept" on the banner shown on your first visit. If you decline, or simply ignore it, no analytics code is downloaded at all. If you accept, we collect the pages you view, approximate location derived from a truncated IP address, and general device and browser information — enough to know which pages are useful and which are not.

• We also record which buttons you click and how far you get in the early-access form — which link brought you to the form, whether you started filling it in, and whether a validation or verification step stopped you. This is how we find out that a page is persuading people and a form is losing them, which a count of page views cannot tell us. We never record what you typed. Your name, email, business name, and anything you write in the free-text boxes are sent to us when you submit the form, and are never included in analytics.
• Advertising signals are switched off permanently, not merely pending consent. Vendariz runs no advertising and builds no remarketing audiences, so ad storage, ad personalization and ad user data are set to denied and are never enabled.
• No cross-site tracking and no data sale. We do not link website analytics to your Vendariz account, and we do not sell or share personal information as those terms are used in US state privacy laws.
• Changing your mind: use the Analytics preferences link at the bottom of any page. It reopens the same banner, shows what you chose last time, and lets you switch. Withdrawing is exactly as easy as agreeing was, which is the point.
• Global Privacy Control is honoured automatically. If your browser sends the GPC signal — Brave does by default; Firefox and DuckDuckGo when you enable it — we treat that as a decision to decline. Analytics never loads, no banner is shown, and a GPC signal overrides any earlier acceptance you may have given us. You do not have to do anything else.
• Separately from analytics, our content delivery network keeps standard web server access logs — including IP address — for 90 days, to investigate abuse and errors. Those are collected regardless of consent because they are how the site is operated and defended, not a way of measuring you.
• Cloudflare Turnstile runs on the early-access form for the same reason: it is what tells a person from a bot on a form you are actively submitting, so it loads whether or not you accept analytics. It sets no tracking cookie and is not used to follow you between sites.

Requesting early access. If you submit the early-access form on our website, we store the name and email address you give us, and whatever you choose to tell us about your operation — your business name, roughly how many markets you run, what software you use today, and any note you add. We use it to reply to you and to decide who to onboard next, and for nothing else. It is deleted automatically after two years if you have not become a customer, and sooner if you ask. The form is protected by Cloudflare Turnstile, which receives your IP address to tell a person from a bot.

Help and support requests. When you contact us for help through the Service, we store the category and priority you selected, a subject line, the message you wrote, the reply-to email address you gave us, and the conversation that follows. For bug reports we also record your app version, the page you were on, and your browser user-agent string, so we can reproduce the problem. Please do not include passwords, payment card numbers, or other people's personal information in a support message.

• Who reads it: Vendariz support staff only. We do not share support conversations with anyone else.
• Notifications: so that we are alerted promptly, a short summary — your business name, plan, the request category and priority, and up to the first 300 characters of your message — is sent to our internal Slack workspace. Your name and email address are not included. Slack acts as a processor for us under a data processing agreement.
• How long we keep it: three years after the request is resolved. An open request is retained until it is resolved. If your account is closed, support requests are scheduled for deletion within 30 days.

d) Market Visitors and Feedback Submitters

Some of our customers place a QR code on their market. Anyone who scans it can submit feedback — report a problem, or ask that a product be stocked — without creating an account. If that is you, this section describes what we collect and why. It is the part of this policy written for people who are not Vendariz users (Section 1(b) also describes records our customers keep about people outside their team, such as host-site contacts).

• What we collect: the reason you selected or the product you asked for, and optionally an email address, a phone number, and a short free-text comment. We do not ask for your name.
• Contact details are optional. You only need to provide an email address or phone number if you would like a reply, a follow-up question answered, or a refund. If you leave them blank, your feedback is still submitted — nobody will be able to contact you about it.
• Who receives it: the business that operates the market you scanned. They are a separate company from Vendariz, and they use your details to respond to you. Vendariz stores the submission on their behalf.
• Abuse prevention: we record a one-way, keyed hash of your IP address on the feedback record so that repeated automated submissions can be blocked. The hash cannot be reversed to recover your IP address. Separately, and only for that hour, your IP address itself is held in a short-lived rate-limiting record that is automatically deleted after one hour. Your IP address is also sent to Cloudflare Turnstile, which we use to tell people apart from bots.
• How long we keep it: up to one year, or up to three years where the operating business is on our Enterprise plan. If that business closes its Vendariz account, we shorten the retention of its feedback records to 30 days.
• Deletion: you can ask us to delete a submission and any contact details attached to it by emailing privacy@vendariz.com. Tell us which market you scanned and roughly when you submitted it.

Please do not include sensitive personal information in the free-text comment. It is stored as written and is visible to the business operating the market.

Connected sales feeds. If the business operating a market has connected its card reader’s sales feed (see Nayax in Section 5), the reader’s provider sends us sales records — the time of a sale, the product, and the amount. Depending on the provider, those records can also carry a masked card number, the card brand, and occasionally a phone number. None of these are written into the sales figures shown to the operator. However, we keep a copy of each payload exactly as the provider sent it in a restricted, encrypted archive, so that sales records can be rebuilt if we later find we read a feed incorrectly — and that archive therefore retains whatever the provider included. It is not readable by our application servers, is never shown to anyone, and is automatically deleted after approximately three years (see Section 9).

e) Location

• Addresses you enter. The locations in Vendariz are addresses you type in. We send them to Google to validate and geocode them, and we cache the resulting coordinates for up to 30 days.
• Device location, mobile app only. If you grant permission, the Vendariz mobile app reads your device location to show your position on a map while you are looking at it. This is while-in-use only — we do not access your location in the background — and the reading is used to draw your position on screen and nothing else. It is not sent to our servers, not stored on your device, and not used to track you. You can decline the permission and the rest of the app still works.
• Mileage is not GPS-tracked. Mileage comes from odometer readings you enter and the stops you record. We do not follow your vehicle.

2. Cookies and Local Storage

We use browser local storage and similar technologies for a narrow set of purposes:

• Keeping you signed in (authentication tokens)
• Remembering your preferences and settings
• Keeping unsaved work while you are mid-task
• Holding a crash report on the mobile device until it can be sent (Section 1(c))

We do not set advertising cookies, and we do not use cookies to track you across other websites. Inside the signed-in product, the storage we use is strictly necessary to operate the Service, so there is nothing there to opt out of. The one non-essential exception is on the public marketing website: Google Analytics sets a cookie only after you choose “Accept” on the consent banner, as described in Section 1(c) — if you decline, no analytics cookie is ever set, and you can change your choice at any time via the Analytics preferences link in the footer. You can clear all of this storage through your browser settings, but doing so will sign you out and may affect functionality.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Bill you and manage your subscription
• Personalize and improve your experience
• Analyze usage patterns to improve features and performance
• Generate insights, analytics, and reports about how the Service is used
• Develop our business and, in aggregated or de-identified form, pursue partnerships, collaborations, distribution relationships, and advertising opportunities with other businesses (see Section 7)
• Communicate with you about updates, security alerts, or support matters
• Detect, investigate, and prevent fraudulent or unauthorized activity
• Comply with legal obligations

4. Automated Processing and AI

When you upload a receipt, we first try to read it on our own servers. If that does not work — or the file is a PDF — the receipt image or document itself is sent to Amazon Web Services’ Bedrock service and processed by an Anthropic Claude model to extract the vendor, date, totals, and line items. Otherwise, only the text we extracted is sent. This processing happens in the United States, in a different AWS region from where the rest of your data lives.

• The result is a draft you review and correct. Where our confidence is low, we say so and ask you to check it.
• We do not make decisions about you that produce legal or similarly significant effects by automated means alone.
• Route planning sends the ordered list of stops on a route to Google’s mapping services to calculate distances and suggest an order.

5. Third-Party Services

We use the following third-party services, each of which receives only what it needs to do its job:

• Amazon Web Services (AWS) — our hosting provider. AWS stores essentially all of your data and provides authentication (Cognito), storage, email delivery (SES), and content delivery. AWS processes data in accordance with the AWS Privacy Notice.
• Anthropic (via AWS Bedrock) — receipt images, documents, and extracted text are processed by a Claude model to read receipts, as described in Section 4.
• Google Analytics — used on the public marketing website only, and only after you accept the consent banner. It never runs inside the signed-in product, and it receives no information that identifies you or your Vendariz account. Advertising features are permanently disabled. See the Google Privacy Policy.
• Cloudflare Turnstile — a privacy-preserving alternative to a CAPTCHA, used on our public forms — the early-access form on this site and the market-feedback (QR support) form — to tell a person from a bot. It receives the IP address and basic browser signals of anyone submitting those forms, and is not used to track you across sites. See the Cloudflare Privacy Policy.
• Stripe — our payment processor. Stripe receives your billing email address, an account identifier, and your plan and invoice details. Payment card details are entered directly with Stripe and never reach Vendariz’s systems. See the Stripe Privacy Policy.
• Google Maps Platform — receives the business and location addresses you enter, the ordered stops on a route, and map marker coordinates. Because maps are drawn in your browser, Google also receives your IP address and referring page when a map loads.
• Google Firebase Crashlytics — receives the mobile app’s crash reports described in Section 1(c): the kind of error and where in our code it happened, the app version, device model and operating system, the open screen’s name, a random installation identifier, and a note each time the app is opened (with the device, operating system and mobile network). Never your name, email address, business data, or anything you typed, and nothing that links a report to your Vendariz account. Google processes it as our service provider under the Firebase Data Processing and Security Terms, and keeps it for 90 days.
• Slack — receives the short internal alert summary described in Section 1(c), under a data processing agreement.
• Nayax — only if you choose to connect a Nayax sales feed. We send the API token you generated in your own Nayax account and the machine numbers you have linked to your markets, so that we can read those machines’ recent sales. We do not send Nayax any personal information, and we only ever read from them — nothing in Vendariz can change anything in your Nayax account. Their sales records can include a masked card number, the card brand, and occasionally a customer phone number; none of these appear in the sales figures we show you, but they are retained in the restricted raw archive described in Section 1(d) until it is deleted.
• UI Avatars — generates a placeholder profile image from your initials when you have not uploaded a picture.

We do not sell your personal information to any third party.

6. Data Sharing

We do not sell, rent, or trade your personal information. Your data is shared only in the following circumstances:

• People your records describe: some records you enter describe people outside your team — the contact person at a site that hosts one of your markets, or a commission payee (Section 1(b)). Those details stay within your business account: we store them on your behalf, we do not contact those people, and we do not share their details with anyone else.
• Within your business account: the Service is a team tool. Teammates on your business account see each other’s work attributed by display name (for example, “Dana W.”) on restocks, routes, mileage entries, receipts, and inventory adjustments. If you are an account owner or administrator, you can see which teammate drove which route, when, and the mileage they reported. If you were invited to someone else’s business account, your activity in it is visible to them.
• Content you choose to publish: if you publish a layout or planogram to other Vendariz businesses, that content — and, if you enable it, a creator display name — becomes visible to them and can be copied into their accounts. We strip the details identifying your own operation before showing it. Publishing is optional and off by default.
• Service Providers: the vendors listed in Section 5, who are bound by confidentiality obligations and may use the data only to provide their service to us.
• Aggregated or De-Identified Data: with partners, advertisers, distributors, and other businesses, but only in aggregated or de-identified form that does not identify you personally (see Section 7).
• Legal Requirements: when required by law, subpoena, court order, or governmental regulation.
• Safety: to protect the rights, property, or safety of the Company, our users, or the public.
• Business Transfers: in connection with a merger, acquisition, or sale of assets, in which case your data may be transferred to the acquiring entity.

7. Aggregated and De-Identified Data & Business Development

We may aggregate, anonymize, or de-identify usage data so that it no longer reasonably identifies you or your business. We may use and share this aggregated or de-identified data for any lawful business purpose, including to evaluate trends, generate market insights, attract advertising revenue, and form partnerships, collaborations, and distribution relationships with other businesses (such as suppliers, distributors, and advertisers). We maintain this data in de-identified form and do not attempt to re-identify it. Because it does not identify you personally, it is not treated as personal information under this policy, and the restrictions in Sections 5 and 6 on selling personal information do not apply to it. To be clear about how this sits with Section 1(c): this section is about offering aggregated market insights to other businesses. It does not mean advertising to you — the Service contains no ads — and no personal information is ever used for advertising or remarketing.

8. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest for our databases and file storage, authentication through AWS Cognito with optional two-factor authentication, and access controls for internal systems. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

9. Data Retention

We keep different categories of data for different periods. We would rather state this accurately than round it off:

• Your business records — locations, products, inventory, layouts, routes, restock history, mileage logs, vehicle records, receipt metadata, host site contacts, and commission payout records — are retained for as long as your account exists, and are not automatically deleted on a timer. They are your operating history, and we keep them so you can get them back.
• Terms acceptance records (version, time, IP address, user-agent — Section 1(a)) are kept for the life of the account.
• The raw sales-feed archive described in Section 1(d) is automatically deleted approximately three years after each payload is received.
• Receipt images and documents are retained for up to seven years from upload, then automatically deleted. This is a fixed schedule and it continues to run after an account is closed.
• Cached addresses, coordinates, and route geometry are deleted after 30 days.
• Route change history is deleted after 365 days. Records of routes actually driven are retained because they substantiate mileage entries.
• In-app notifications are deleted after 30 to 180 days depending on importance.
• Support and help requests are deleted three years after they are resolved; market-visitor feedback after one year, or three on Enterprise.
• Server and security logs are retained for 30 to 90 days. Backups are retained for up to 35 days.
• Mobile crash reports are kept by Google for 90 days, then deleted. They carry no account identifier, so that expiry is how they are erased (Section 1(c)).

When you close your account. Closing a business account immediately removes access for you and your team, marks the account as deleted, switches off your teammates’ sign-ins, and shortens the retention of support requests and preferences to 30 days. You can reopen the account yourself within 30 days by signing in with the same email, and everything is restored as you left it; after that, we can still restore it on request. That window is about who can reopen the account — it is not a deletion schedule. Data persists beyond it: the account, owner and teammate records are retained in a deleted state, business records are retained as described above, and receipt images continue on their seven-year schedule. If you want your remaining data erased sooner, email privacy@vendariz.com and we will process the request as described in Section 10. We are working toward making that erasure automatic; until then it is a request we handle manually, and we would rather tell you that than imply otherwise.

We may retain data longer where we are required to by law, or where it is necessary to resolve disputes, prevent fraud, or enforce our agreements.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Object to or restrict certain processing of your data
• Request a portable copy of your data
• Withdraw consent at any time (where processing is based on consent)
• Not be discriminated against for exercising any of these rights

Much of this you can do yourself: you can edit your profile and business details in account settings, export your mileage, financial, inventory and history records from the app, and delete a business account from account settings.

To exercise any right that is not self-service, contact us at privacy@vendariz.com. We will respond within 30 days. We may need to verify your identity before acting on a request, and we may decline where an exception applies — if so, we will tell you why.

If you were invited to someone else’s business account, that business controls the operating records in it. We will pass your request on to them and help where we can.

11. California Residents (CCPA/CPRA)

If you are a California resident, you have the rights described in Section 10, including the right to know what personal information we collect and how it is used and shared, the right to request correction or deletion, the right to limit the use of sensitive personal information, and the right to opt out of the sale or sharing of personal information.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for any purpose beyond providing the Service. The categories we collect, our purposes, and our retention periods are described in Sections 1, 3 and 9. To exercise your rights, contact privacy@vendariz.com. You may use an authorized agent, and we will not discriminate against you for exercising a right.

12. International Users

The Service is operated from the United States and intended for use by businesses in the United States. If you access the Service from outside the U.S., your data will be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your country. By using the Service, you consent to such transfer. We apply the safeguards described in this policy regardless of where you are.

13. Children’s Privacy

The Service is a business tool and is not intended for anyone under the age of 18, and we do not knowingly collect personal information from children. Our public market-feedback form can be submitted by anyone who scans a QR code, and it does not ask for a name or age — we ask that it not be used by anyone under 18. If we discover that a child under 18 has provided us with personal information, we will promptly delete it. If you believe a child has submitted personal data to us, contact privacy@vendariz.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Your continued use of the Service after changes constitutes acceptance of the updated policy. For material changes, we will notify you via the email associated with your account.

15. Contact

For privacy questions, requests, or complaints, contact privacy@vendariz.com. For other legal matters, including those under our Terms and Conditions, contact legal@vendariz.com.