Privacy Policy

Account data: email, name, role in the workspace, workspace settings.

Operational data: your customers’ messages from the channels you connect, contacts, orders, the product catalog and AI-generated replies.

Technical data: event logs, performance metrics and errors — for the reliability and security of the service.

To provide the core function of the product — automated replies by an AI sales assistant in your sales channels.

To bill transparently (see the Vendu Bill of Rights) and to prevent abuse.

We do not sell your data and do not use the content of your customers’ conversations to train third-party models.

Every workspace is isolated at the database level through Row Level Security — one business’s data is not accessible to another.

Sensitive tokens (for example, channel access tokens) are stored encrypted, never in plain text.

An automatic retention policy applies: logs and temporary data are deleted on a schedule.

We rely on third-party providers for hosting and the database, AI models, message queues, email delivery and error monitoring.

Subscription payments are handled by Paddle.com, our reseller and Merchant of Record. Paddle receives the payment details of the account owner and processes them as an independent controller under its own Privacy Notice (paddle.com/legal/privacy); we do not store card data.

The full current list — with each provider’s purpose, processing region and data processing terms — is published in the Data Processing Addendum at /legal/dpa.

We set only the cookies the service cannot work without: your sign-in session, the workspace you are working in (active_tenant_id), the interface language (ui_language), your choice in the cookie banner (vendu_cookie_consent, kept for 12 months) and short-lived cookies while you connect a channel or an integration. Interface settings such as inbox filters and unsent drafts are kept in your browser’s local storage.

We use no advertising cookies and no cross-site tracking. Page-speed measurements are sent without any identifier of you. Error reports go to our error-monitoring provider without your email or IP address.

A recording of the session around an error is made only if you allow it in the cookie banner; it is off until you do. You can change or withdraw that choice at any time through “Cookie settings” at the bottom of the home page.

Vendu is a service for businesses. An account may be created only by a person who is 18 or older; we do not knowingly register younger people, and we send no marketing mailings to anyone.

Shoppers write to the businesses that use Vendu, and we process those messages on the business’s instructions. If you believe a child’s personal data has reached us, write to anton.babiienko@vendu.space — we will delete it.

You can access your data, export it and request its deletion.

Contacts and conversations are exported from the corresponding dashboard sections; you can delete your account in the profile settings or by writing to us.

If you are in the EU/EEA, you have rights under GDPR, including the right to lodge a complaint with a supervisory authority.