Privacy Policy

This policy explains how Vendar handles personal information when you browse a store, buy something, or sell on the platform. It applies to residents of the United States and Canada. Vendar is owned and operated by Radiant Crest Inc., which is responsible for the personal information described here.

1. Information we collect

Buyers

• Contact details: name, email, phone number (optional).
• Shipping address.
• Order history, reviews and any issue reports you submit.
• Payment details are collected directly by Stripe. Vendar receives only a payment reference, card brand and last four digits.

Sellers

• Account details: name, email, phone number (optional), password (stored hashed).
• Store information, product listings, images and files.
• Origin address for shipping and pickups.
• Identity and bank details are collected directly by Stripe for verification and payouts.
• Device push tokens, if you enable notifications.
• If you connect social accounts for posting, the account and token data described in section 4.

Everyone

• Technical data such as IP address, browser type and pages viewed, used for security, fraud prevention and aggregate analytics.
• Your cart and US/Canada preference are stored in your browser's local storage, not on our servers.

2. How we use it

• To process orders, payments, shipping, refunds and payouts.
• To send transactional messages: receipts, tracking updates, verification codes.
• To prevent fraud and abuse and keep the platform secure.
• To improve the Service using aggregated, de-identified data.
• To send marketing email only where you have opted in. You can unsubscribe at any time.

3. Who we share it with

• The seller you buy from receives your name, shipping address and order contents so they can fulfil the order.
• Service providers acting on our behalf: Stripe (payments and identity), EasyPost and the carriers (USPS, UPS, FedEx, Canada Post) for shipping, Cloudflare (hosting, storage and email delivery, including verification codes), Neon and Vercel (hosting and storage), and error-monitoring and analytics tools.
• Authorities where required by law, or to protect the rights and safety of users and Vendar.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

4. Connected social accounts

Sellers can choose to connect their own Instagram professional account, Facebook Page, Threads profile and Pinterest account to Vendar. We use this access for one purpose: to publish the product posts you create in the Vendar app (images, caption and a link to your product on vendar.co) to your account when you tap Publish. Connecting is optional, and nothing is posted without your action.

What we access, per platform

• Instagram (Instagram API with Instagram Login): your account ID, username and profile picture (instagram_business_basic), and permission to publish photos and carousels to your account (instagram_business_content_publish).
• Facebook (Facebook Login for Business): your name and ID (public_profile), the list of Pages you manage so you can pick one (pages_show_list), basic Page details such as name and picture (pages_read_engagement), and permission to publish posts to the Page you choose (pages_manage_posts).
• Threads: your profile ID, username and picture (threads_basic) and permission to publish posts (threads_content_publish).
• Pinterest: your account details (user_accounts:read), your boards so you can choose where to pin and optionally create one (boards:read, boards:write), and permission to create and check pins (pins:read, pins:write).

We do not access or store your password, direct messages, followers, contacts, or analytics beyond whether a post Vendar published succeeded. Future networks (such as TikTok) will follow the same rules and are listed here before they launch.

What we store

• The platform account ID, username or Page name, profile picture URL and the permissions you granted.
• Access and refresh tokens, encrypted with AES-256-GCM before they are saved, and their expiry dates. Tokens are only decrypted in memory to publish a post you requested or to renew access.
• The IDs, links and status of posts Vendar published for you.

This data is stored with our infrastructure providers in the United States (Cloudflare, and Neon on AWS us-east-1) and is only accessible to the systems that publish your posts and to a small number of authorised staff for support.

Retention, disconnecting and deletion

• We keep this data only while the account stays connected.
• Disconnect any time in the app under Profile → Connected accounts. Tokens are deleted immediately, and the rest of the connection record within 30 days.
• If you remove Vendar in Facebook, Instagram or Threads settings, or send a data-deletion request from Meta, we delete the tokens and connection data automatically. Revoking Vendar in Pinterest stops our access at once; we delete the stored record when we detect the revocation or when you disconnect. Deleting your Vendar account removes all connections.
• Posts already published stay on your social account until you delete them there. Full instructions and a status checker are on our Data Deletion page.

Sharing and platform rules

We never sell data received from social platforms, use it for advertising, or share it with third parties except the service providers that host Vendar. We use it only to provide the publishing feature you asked for, and we comply with the Meta Platform Terms and Developer Policies, the Pinterest Developer Guidelines and, when TikTok is added, the TikTok Developer Terms.

5. Where it is stored

Data is stored in the United States. If you are in Canada, your information is transferred to and processed in the US, where it is subject to US law. We use contractual and technical safeguards with our providers.

6. How long we keep it

Order and payment records are kept for as long as needed to meet tax, accounting and legal obligations, typically seven years. Account data is kept while the account is open and deleted or anonymised within a reasonable period after closure, subject to those obligations.

7. Your choices and rights

• You may ask for access to, correction of, or deletion of your personal information.
• Canadian residents have rights under PIPEDA and applicable provincial law, including the right to withdraw consent and to complain to the Office of the Privacy Commissioner of Canada.
• Residents of California and other US states with privacy statutes have rights to know, delete, correct and to non-discrimination for exercising those rights.
• Sellers can delete their account from the app. Buyers can write to us from the email used at checkout.

8. Cookies and local storage

The storefront uses local storage to remember your cart and region. Stripe sets cookies needed for fraud prevention during checkout. We do not use third-party advertising cookies.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect their information.

10. Security

We use encryption in transit, hashed passwords, short-lived access tokens and role-based access internally. No system is perfectly secure; if we learn of a breach affecting you, we will notify you as the law requires.

11. Changes and contact

We will post updates here and, where changes are material, notify you. Privacy questions and requests: support@vendar.co.