Privacy

Who we are

Vendl is operated by Vendl.app, 41B Luck Street, Macclesfield, SA 5153. Contact: hello@vendl.app.

What we collect

• Account email and session data for owner sign-in (magic link).
• Business, stand, product, inventory, and order records you enter.
• Payment-related identifiers when you connect Stripe or PayPal (handled by those providers).
• Device and usage data needed to run the service (e.g. push notification tokens on the owner app).
• Messages you send via our contact form (name, email, message).
• OAuth tokens and basic profile details for social accounts you choose to connect (for example YouTube), used only to publish content you request.

Why we collect it

We use this information to provide and improve Vendl, authenticate users, process subscriptions and payments, send operational alerts (sales, low stock), respond to enquiries, and meet legal obligations under Australian law.

Processors and overseas disclosure

We use trusted processors (for example hosting, email delivery, Stripe, and PayPal). Some processors store or process data outside Australia. We take reasonable steps to ensure appropriate handling consistent with the Australian Privacy Principles where they apply.

How we protect your data

We use technical and organisational safeguards to protect personal and sensitive data, including OAuth tokens for connected accounts:

• Encryption in transit: all traffic to and from our app and APIs uses HTTPS (TLS). Calls we make to third-party APIs (such as Google) also use TLS.
• Encryption at rest: data is stored in managed databases and storage whose disks are encrypted at rest (AES-256).
• Server-side token storage: OAuth access and refresh tokens are stored only on our servers. They are never sent to your browser or exposed in page source.
• Access control: databases holding connected-account data deny all public and client access. Only our server, using restricted service credentials kept in encrypted environment configuration, can read them. Staff access is limited to the minimum needed to operate and support the service.
• Authentication: account sign-in uses one-time email codes or links (no passwords to steal), and every request is checked against your account and business before data is returned.
• Payments: card details are handled directly by Stripe, PayPal, or Square. We never receive or store full card numbers.
• Minimisation and deletion: we only request the access a feature needs, and delete tokens when you disconnect an account.

If a data breach is likely to cause serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Report security concerns to hello@vendl.app.

Google user data (YouTube)

If you choose to connect a YouTube channel, Vendl requests access through Google OAuth with these scopes only:

• youtube.readonly - to read your channel ID, name, and thumbnail so we can show which channel is connected.
• youtube.upload - to upload videos to your channel, with the title, description, tags, and privacy setting you choose, only when you publish or schedule a post.

How we use it: only to show your connected channel and publish the videos you ask us to. We do not use Google user data for advertising, do not sell it, and do not use it to train AI or machine-learning models. Our staff do not read it unless you ask us to for support, or it is needed for security or legal reasons.

Sharing: we do not share Google user data with third parties, except the hosting and database providers that run Vendl on our behalf, or where required by law.

Storage and protection:access and refresh tokens and channel details are stored server-side only, protected as described in "How we protect your data" (TLS in transit, encryption at rest, no browser or public access).

Retention and deletion: we keep this data only while YouTube is connected. When you disconnect, we revoke the token with Google and delete the tokens and channel details from our systems. You can also remove access at any time in your Google Account permissions, or email hello@vendl.app to ask us to delete it.

Vendl's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Restock alerts

When you buy from a stand, you may opt in to an email when that stand restocks. Opt-in and restock notify emails are available on Free and Pro.Vendl.app (Vendl) is the controller: we store your email and consent record solely for that purpose. Stand owners see a subscriber count and can ask us to send a restock notice - they never receive or export your address. Emails are delivered via Resend (processor). You can unsubscribe any time via the link in each email (no login). We retain active subscriptions until you unsubscribe or the stand is removed; unsubscribed records may be kept briefly for audit.

Cookies and sessions

We use session cookies and similar technologies necessary to keep you signed in and operate the service. We do not sell personal information.

Advertising measurement

We use Meta, Google Analytics, and Reddit advertising pixels to understand how people find Vendl and to measure campaigns. When you are signed in as an owner, we may pass a hashed (SHA-256) copy of your account email and internal user id to Reddit for advanced matching. We do not put plaintext emails in page source for this purpose. You can limit ad tracking via your browser or platform settings where available.

Retention and your rights

We retain account and transaction data while your account is active and for a reasonable period afterward for billing, disputes, and legal requirements. You can delete your account anytime in Settings → Delete account (this cancels any Vendl subscription and removes your stands and related data). You may also request access to or correction of personal information we hold about you by emailing hello@vendl.app.

Changes

We may update this policy as Vendl evolves. Continued use after changes means you accept the updated draft unless a successor policy states otherwise.