Privacy policy

We collect personal information when you provide it to us, when Shopify shares it with us, and automatically when you use the Services.

Information you provide to us

• Account information, such as your email address and your sign-in credentials. Passwords are stored only in hashed form.
• Business information, such as the names and email addresses of a merchant's vendors and their contacts, the consignor rates and schedules agreed with them, and records of payments.
• Payout details, such as the PayPal or Venmo address at which a vendor wishes to be paid, and, if a merchant chooses to send payments through the Services, the credentials of its PayPal application.
• Content, such as messages between a store and its vendors, notes, and the files attached to them.
• Support requests. When you contact us, we collect the information you choose to send, including your email address, your message and any screenshots, along with details of your account and the page you were on so that we can help. Please do not include passwords, sign-in codes or anything else we do not need to see.

Information we receive from Shopify

When a merchant installs VendorDue, Shopify provides information about the store, such as its name, web address, currency and time zone, and about the orders and products we need to work out what each vendor is owed. Shopify also provides the name and email address of each staff member who opens VendorDue from the Shopify admin, and information about the store's VendorDue plan and billing status.

Order information from Shopify may include details about a store's customers. We do not store customers' names, contact details or addresses, and we do not request customer records from Shopify.

Information we collect automatically

When you use the Services, we collect information about your device and how you use the Services, including your IP address, your browser and operating system, your approximate location, the pages you view, the actions you take and how quickly pages load. We collect some of this information using cookies and similar technologies, as described in section 6.

In our help pages at vendordue.com/docs, when a search finds nothing we keep the words you searched and the day. When you answer "Did this answer it?", we keep the page, your answer, anything you write in the box, and the day. Neither is linked to your IP address, an account or a cookie, and both are deleted after 90 days.

We use personal information to:

• provide, operate and maintain the Services, including calculating vendor earnings, publishing payouts, recording payments and delivering messages between stores and vendors;
• carry out actions you request, such as sending a payment through PayPal or preparing a copy of your data;
• create and secure accounts, verify identity, and prevent fraud, abuse and unauthorised access;
• send service communications, such as sign-in codes, notices, payouts and replies to support requests;
• understand how the Services are used and improve them;
• administer billing, which Shopify handles for us; and
• comply with the law, enforce our terms, and establish, exercise or defend legal claims.

We do not send marketing email, and we do not use personal information for advertising. We do not use Store Data to train artificial intelligence models. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

If you are in the European Economic Area or the United Kingdom, we process your personal information only where we have a legal basis to do so. We rely on the performance of our contract with you or your store when we provide the Services and support; on our legitimate interests in operating, securing and improving the Services, where those interests are not overridden by your rights; on compliance with our legal obligations; and, where the law requires it, on your consent, which you may withdraw at any time.

We do not sell personal information, and we do not share it for targeted advertising. We disclose it only in the following circumstances.

• Service providers. We work with companies that provide hosting, data storage, email delivery, payment processing and security services on our behalf. They may use personal information only to provide those services to us, and they are bound by contract to keep it confidential and secure.
• Within a store. A store's members see its records according to the role the store gives them. A vendor sees only their own payouts, payments, consignor rates and messages with that store.
• At your direction. When a merchant sends a payment through the Services, we give PayPal the vendor's payout address and the amount so that the payment can be made.
• For legal reasons. We may disclose information where we believe in good faith that the law, a regulation or a legal process requires it, or where it is necessary to protect the rights, property or safety of VendorDue, our users or others, including to prevent fraud or abuse.
• Business transfers. If VendorDue is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction and will remain subject to this policy.

Our personnel access personal information only where needed to provide support, maintain the Services or keep them secure, and that access is recorded.

We use cookies and browser storage that the Services need in order to work: to keep you signed in, to secure your session, to keep your place in sign-in and support forms, and to remember preferences such as your display theme. We do not use advertising or analytics cookies, and we do not allow third parties to place tracking cookies through the Services. Because these technologies are strictly necessary, we do not ask for consent to use them.

On our public website we may count visits with a web analytics service that sets no cookies and does not follow you across other sites. It records the page you open, the site that sent you, and your general location and type of device, and shows us only totals. We do not count visitors in the European Union, browsers that send a Global Privacy Control signal, or anyone who chooses Turn off analytics at the foot of a page, which keeps that choice in your browser for one year.

Some forms, such as sign-in and support, use a bot-detection service that looks at information such as your browser and IP address to tell people from automated programs.

Most browsers let you block or delete cookies. If you do, you will be signed out, and parts of the Services may stop working.

We store personal information in the United States and operate the Services from India. Our service providers may process it in other countries where they operate. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that has not been found to provide an adequate level of protection, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission and the United Kingdom's International Data Transfer Addendum.

We keep personal information for as long as we need it to provide the Services and for the other purposes described in this policy, unless the law requires us to keep it longer.

Store Data is kept while the store uses VendorDue. When a merchant uninstalls VendorDue or deletes its workspace, we delete the store's information after a 48-hour period in which the decision can be reversed, and it leaves our backups within seven days after that. Messages between a store and its vendors are deleted 12 months after they are sent. Support requests, security records and usage information are kept for limited periods, generally no longer than 13 months, and are then deleted or combined into totals that no longer identify anyone.

After a store is deleted, we may keep a limited record of its installation and billing history where we need it for accounting, legal or security purposes.

We use technical and organisational measures designed to protect personal information, including encryption in transit and at rest, separation of each store's records, access controls and logging. Contact details, payout details, messages and files are also encrypted with a key that belongs to each store. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Our Security page describes these measures in more detail.

Depending on where you live, you may have the right to ask for access to the personal information we hold about you, to correct it, to delete it, to receive it in a portable format, and to object to or restrict certain processing. Where we rely on your consent, you may withdraw it at any time.

You can exercise many of these rights in the Services. A store's admins can correct its records, download a copy of the workspace and delete it from Settings, and you can change your sign-in details at any time. For any other request, contact us at support@vendordue.com. We will verify your identity before acting on a request and will respond within the time the law allows. You may use an authorised agent to make a request for you, in which case we may ask for proof that the agent is authorised.

If your request concerns Store Data, we will refer it to the store and help the store respond. We will not treat you differently for exercising any of your rights.

European Economic Area, United Kingdom and Switzerland

You have the right to lodge a complaint with your data protection authority. We would appreciate the chance to address your concern first.

United States

Residents of California and certain other states have the right to know what personal information we collect, use and disclose, to access, correct and delete it, and to opt out of its sale, its sharing for targeted advertising, and certain profiling. We do not sell or share personal information, as those terms are defined under California law, and we do not use sensitive personal information to infer characteristics about you. The categories of personal information we collect, their sources, the purposes for which we use them and the categories of recipients are described in sections 2, 3 and 5.

India

You may raise a grievance with our Grievance Officer at support@vendordue.com. We will respond within the time required by law.

The Services are intended for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.

The Services work with Shopify and, if a merchant chooses, with PayPal. Those services are operated by other companies under their own terms and privacy policies, and we are not responsible for their practices.

We may update this policy from time to time. When we do, we will change the date at the top of this page. If a change is material, we will tell store owners by email or in the Services at least 14 days before it takes effect, unless the law requires it to take effect sooner.

If you have questions about this policy or wish to exercise your rights, contact us at support@vendordue.com.