Privacy Policy

Vendra (“Vendra”, “we”, “us”) provides a hosted dashboard and Discord bots at vendradash.com. If you have any question about this policy or your data, email support@vendradash.com and a human will answer.

Two different roles matter throughout this policy. When you sign up for Vendra, we are the controller of your account data. When you connect your store and your Discord server, we act as a processor handling your buyers’ data on your instructions — you remain responsible for that data and for telling your own customers how you use it.

Account data. Your email address, a hashed password (or, if you use Google sign-in, the information described in section 4), your workspace name, and your branding settings such as bot name, logo URL, and accent color.

Store connections. API keys for the services you connect (Komerza, SellAuth, SellHub, Stripe). These are write-only: once saved, they cannot be read back through the dashboard or the API — the interface only ever shows a masked hint such as ••••4242.

Store and buyer data. When you connect a storefront we sync order records, product and stock information, and buyer identifiers such as purchase email addresses, order IDs, amounts, gateway names, and the last four digits of payment cards. We never receive or store full card numbers, CVCs, or bank credentials — those stay with your payment processor.

Anti-fraud signals. To provide the anti-fraud features you enable, we process purchase timing, the number of distinct payment methods used per buyer email, and IP addresses associated with orders. You control how strict these rules are, and you can turn them off.

Discord data. Server (guild) and channel identifiers, role identifiers, member identifiers of people who interact with the bots, and — where you enable ticketing — the content of messages sent inside ticket channels so transcripts can be saved for you.

Billing data. If you buy a plan: the plan and term you chose, your subscription status, and the identifiers Stripe gives us for your customer and subscription records. Your card number goes to Stripe directly — we never receive or store it.

Technical data. Standard server logs including IP address, browser type, pages requested, and timestamps, used for security, debugging, and abuse prevention.

We use the data above only to:

• operate your dashboard, workspace, and hosted bots;
• sync your sales, stock, tickets, giveaways, and buyer roles, and send the alerts you configure;
• run the anti-fraud checks you have switched on;
• send you transactional email such as sign-in confirmations, alerts, and service notices;
• keep the service secure and investigate abuse; and
• comply with law.

We do not sell your data, we do not sell your buyers’ data, and we do not use it to train machine-learning models.

If you choose “Continue with Google”, Google shares a limited profile with us: your email address, your basic profile information (name and profile picture), and a stable account identifier. We use this solely to create and authenticate your Vendra account and to display who is signed in.

Vendra’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not transfer it to others except as needed to provide the service, to comply with law, or as part of a merger or acquisition with equivalent protections.

You can disconnect Vendra at any time from your Google Account’s third-party access settings. Doing so stops future Google sign-ins; to also remove your Vendra account, see section 8.

We share data only with the infrastructure providers needed to run Vendra, each bound by their own security and privacy commitments:

• Supabase — authentication and database hosting.
• Railway — application and bot hosting.
• Cloudflare — DNS and email routing.
• Resend — transactional email delivery.
• Stripe — to take payment for your Vendra subscription. We send Stripe your email address so it can identify you; your card details go to Stripe directly and never reach us.
• Discord — to operate the bots inside your server.
• Your connected stores (Komerza, SellAuth, SellHub, Stripe) and WEAO — only where you have connected them, and only to fetch the data you asked us to sync.

We may also disclose data if legally required, or to protect the rights, safety, and property of Vendra, our customers, or the public.

Vendra is operated from the United States and our providers process data on servers in the United States and other countries. If you are located elsewhere, using Vendra means your data is transferred to and processed in those countries.

Account and workspace data is kept for as long as your account is active. Synced store, buyer, and Discord data is kept while the relevant connection is active so the dashboard can show history. Server logs are kept for a short period for security and debugging.

When you delete a connection, the stored API key for that service is deleted immediately. When you delete your account, we delete or irreversibly anonymize your workspace data within 30 days, except where we must keep records to comply with law.

You can view and change your workspace, branding, and connections at any time from the dashboard, and disconnect any store with one click.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to complain to a data protection authority. To exercise any of these — including deleting your account entirely — email support@vendradash.com. We will respond within 30 days and will not charge you for it.

If you are a buyer in someone else’s Discord server and want your data removed, please contact that store owner first — they control that data. If you cannot reach them, contact us and we will help.

Connections are encrypted in transit with TLS. Store API keys are write-only and are never readable through the dashboard or API. Workspace data is isolated per tenant with database-level row security, so one workspace cannot read another’s data. No system is perfectly secure; if a breach affects your data we will notify you promptly.

Vendra is a business tool and is not directed to children. You must be at least 13 years old, and old enough to use Discord in your country, to hold a Vendra account. We do not knowingly collect personal data from children under 13; if you believe we have, contact us and we will delete it.

We may update this policy as the product changes. If a change is material, we will notify account holders by email or in the dashboard before it takes effect. The “last updated” date at the top always reflects the current version.

Questions, requests, or complaints: support@vendradash.com. See also our Terms of Service.