Privacy Policy

This policy explains how Vendar handles personal information when you browse a store, buy something, or sell on the platform. It applies to residents of the United States and Canada.

1. Information we collect

Buyers

• Contact details: name, email, phone number (optional).
• Shipping address.
• Order history, reviews and any issue reports you submit.
• Payment details are collected directly by Stripe. Vendar receives only a payment reference, card brand and last four digits.

Sellers

• Account details: name, email, phone number (optional), password (stored hashed).
• Store information, product listings, images and files.
• Origin address for shipping and pickups.
• Identity and bank details are collected directly by Stripe for verification and payouts.
• Device push tokens, if you enable notifications.

Everyone

• Technical data such as IP address, browser type and pages viewed, used for security, fraud prevention and aggregate analytics.
• Your cart and US/Canada preference are stored in your browser's local storage, not on our servers.

2. How we use it

• To process orders, payments, shipping, refunds and payouts.
• To send transactional messages: receipts, tracking updates, verification codes.
• To prevent fraud and abuse and keep the platform secure.
• To improve the Service using aggregated, de-identified data.
• To send marketing email only where you have opted in. You can unsubscribe at any time.

3. Who we share it with

• The seller you buy from receives your name, shipping address and order contents so they can fulfil the order.
• Service providers acting on our behalf: Stripe (payments and identity), EasyPost and the carriers (USPS, UPS, FedEx, Canada Post) for shipping, Cloudflare (hosting, storage and email delivery, including verification codes), Neon and Vercel (hosting and storage), and error-monitoring and analytics tools.
• Authorities where required by law, or to protect the rights and safety of users and Vendar.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

4. Where it is stored

Data is stored in the United States. If you are in Canada, your information is transferred to and processed in the US, where it is subject to US law. We use contractual and technical safeguards with our providers.

5. How long we keep it

Order and payment records are kept for as long as needed to meet tax, accounting and legal obligations, typically seven years. Account data is kept while the account is open and deleted or anonymised within a reasonable period after closure, subject to those obligations.

6. Your choices and rights

• You may ask for access to, correction of, or deletion of your personal information.
• Canadian residents have rights under PIPEDA and applicable provincial law, including the right to withdraw consent and to complain to the Office of the Privacy Commissioner of Canada.
• Residents of California and other US states with privacy statutes have rights to know, delete, correct and to non-discrimination for exercising those rights.
• Sellers can delete their account from the app. Buyers can write to us from the email used at checkout.

7. Cookies and local storage

The storefront uses local storage to remember your cart and region. Stripe sets cookies needed for fraud prevention during checkout. We do not use third-party advertising cookies.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect their information.

9. Security

We use encryption in transit, hashed passwords, short-lived access tokens and role-based access internally. No system is perfectly secure; if we learn of a breach affecting you, we will notify you as the law requires.

10. Changes and contact

We will post updates here and, where changes are material, notify you. Privacy questions and requests: support@vendar.co.