Privacy policy

Vendo Store is run by a small team in Kerala, India. We are the data fiduciary for the data described here under India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

• Order details: your name, email, mobile number and delivery address, and what you ordered.
• Payment details: the amount, status and Razorpay reference. Card, UPI and bank details are entered on Razorpay's secure page; we never see or store them.
• Messages: what you write to us about an order, including photos you send for a return.
• Browsing: pages visited, device and browser type and the website that sent you, collected through privacy-friendly analytics that don't use advertising cookies.

Your cart is kept in your own browser (local storage) until you check out. We don't create accounts or store passwords.

• To take payment, pack and ship your order and send you order and tracking emails.
• To handle cancellations, returns, refunds and support requests.
• To prevent fraud and misuse of the store and payments.
• To understand which pages and products work, so we can improve the store.
• To meet our legal, tax and accounting obligations.

We won't send you marketing emails unless you've opted in, and every marketing email has an unsubscribe link.

Only with the service providers who help us run the store, and only what each needs:

• Fulfilment partners and warehouses: your name, address and phone, to pack and ship your parcel.
• Courier companies: your name, address and phone, to deliver it.
• Razorpay: payment processing and refunds.
• Supabase (database, hosted in Mumbai), Vercel (website hosting) and Resend (order emails): to run the store.
• Sentry: error reports, so we can fix problems. These may include technical details of your visit.

We may also disclose data when the law requires it, for example to a court or a government authority. We never sell or rent your personal data.

We keep order and payment records for 8 years, as Indian tax and accounting law requires. Support messages and return photos are deleted 2 years after the case is closed. Analytics data is kept in aggregate form only.

You can ask us to:

• tell you what personal data we hold about you and how we use it,
• correct or update it,
• delete it, except what we must keep by law, and
• stop sending you marketing, at any time.

Write to shop@getvendo.io from the email you ordered with. We'll respond within 30 days. You can also nominate someone to exercise these rights for you if you're unable to.

All pages are served over HTTPS, and payments go through Razorpay's PCI-DSS compliant checkout. Access to order data is limited to the people who need it. No system is perfectly secure, but if a breach ever affects your data we'll tell you and the authorities as the law requires.

The store is meant for adults. If you are under 18, please shop with a parent or guardian. We don't knowingly collect data from children.

If we change this policy we'll update the date at the top of this page. For significant changes we'll also put a notice on the store.

If you're not satisfied with how we've handled a complaint or a request about your personal data, you can escalate it to our Grievance Officer:

• Name: Grievance Officer
• Email: shop@getvendo.io (subject line: "Grievance")

We acknowledge every grievance within 48 hours and aim to resolve it within 30 days of receiving it.