Privacy Policy
How Vendz collects, uses, and protects your business data. Your privacy is our priority.
Last updated: April 19, 2025
Our commitment: We never sell your data. Your business records, GST data, and customer information stay private and are only used to power your Vendz experience.
1. Overview
Vendz ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights as a user. This policy applies to all users of the Vendz platform, accessible at our website and deployed application. By using Vendz, you consent to the practices described herein.
2. Information We Collect
We collect the following categories of data when you use Vendz:
Account & Profile Information
- Full name and email address (via Google OAuth or email registration)
- Profile photo (optional, uploaded by you and stored on Cloudinary)
- Business name, GSTIN, PAN number, and registered business address
- Bank account name, account number, IFSC code, and branch (for invoice display only)
- Company logo (optional, uploaded and stored on Cloudinary)
Business Data You Enter
- Product catalog: names, SKUs, HSN codes, UQC, prices, costs, GST rates, and product images
- Purchase records: supplier details, invoice numbers, items, quantities, tax data
- Sales records: customer details, invoice numbers, items, GST calculations, payment status
- Customer and supplier information: names, GSTIN, contact info, state codes
- Employee information: names, emails, roles, and access permissions
- Stock ledger entries: IN/OUT transactions with quantities, unit prices, and references
Technical & Usage Data
- Authentication session tokens managed by NextAuth.js
- IP addresses and browser/device information (collected by hosting infrastructure)
- API request logs for debugging and security purposes
- Error logs and performance data via server-side logging
3. How We Use Your Information
We use the data collected for the following purposes:
- To provide and operate the Vendz platform and all its features
- To generate GST-compliant invoices (B2B, B2CS, CDNR, CDNUR) and GSTR-1 JSON exports
- To compute HSN summaries, RCM liabilities, and compensation cess calculations
- To display your company logo and GSTIN on generated sales invoices
- To manage your stock levels, purchase records, and sales history
- To authenticate your identity and maintain secure sessions
- To send important service notifications (account, subscription, billing)
- To improve platform features and fix bugs based on usage patterns
4. GST and Tax Data
Vendz processes sensitive business tax data including GSTINs, HSN codes, invoice amounts, tax breakdowns, and state codes. This data is used exclusively to:
- Generate GSTR-1 compliant JSON files based on your sales data
- Compute GST amounts (CGST, SGST, IGST, Cess) on invoices
- Calculate HSN-wise summary for filing purposes
- Identify B2B vs B2CS transactions based on customer GSTIN and invoice value
- Track RCM (Reverse Charge Mechanism) applicability on purchases
5. Image and File Data
Product images, company logos, and profile photos are uploaded via Vendz and stored securely on Cloudinary. Key facts:
- Images are stored under your unique user ID folder structure (e.g., products/userId/productId)
- Images are compressed automatically (max 512×512 for profiles, max 800×800 for products)
- Cloudinary uses stable public_id paths — re-uploading replaces the old image without accumulation
- We do not use your product images for advertising or training AI models
- Deleting your account triggers deletion of associated images within 30 days
6. Data Sharing and Third Parties
We do not sell your personal or business data. We share data only with these service providers to operate the platform:
- Cloudinary — product image, logo, and profile photo storage
- Supabase — PostgreSQL database hosting for all business records
- Vercel — application hosting and serverless API deployment
- Google OAuth — authentication only (name, email, and profile picture)
- NextAuth.js — session management running on our own servers
7. Data Security
We implement multiple layers of security to protect your data:
- All API routes require authenticated sessions — unauthenticated requests are rejected
- Role-based access control (RBAC) ensures Staff users can only access permitted data
- Database queries are scoped to userId, preventing any cross-user data access
- All data is transmitted over HTTPS (TLS encryption)
- Cloudinary images use secure URLs (https://res.cloudinary.com)
- Sensitive environment variables (API keys, secrets) are never exposed to the client
8. Data Retention
We retain your data as follows:
- Active account data is retained for as long as your account is active
- Upon account deletion, business data is retained for 90 days before permanent deletion
- Cloudinary images associated with deleted accounts are queued for deletion within 30 days
- Anonymized aggregate data (e.g., platform usage statistics) may be retained indefinitely
9. Your Rights
As a Vendz user, you have the following rights:
- Access: Request a copy of all data we hold about you
- Correction: Update or correct inaccurate information via your Profile settings
- Deletion: Request permanent deletion of your account and all associated data
- Portability: Export your sales, purchase, and product data (JSON, Excel)
- Restriction: Request that we limit processing of your data
- Objection: Object to data processing beyond service provision
11. Children's Privacy
Vendz is a business management platform intended for adults running registered businesses. We do not knowingly collect data from individuals under 18 years of age. If you believe a minor has registered, please contact us and we will delete the account promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or an in-app notification. The "Last Updated" date indicates when the most recent changes were made. Continued use of the platform after changes constitutes your acceptance of the updated policy.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us through our platform's support channels. We take privacy seriously and aim to resolve all inquiries within 2–3 business days.