Back to home

Privacy Policy

Effective Date: 1 Jan 2026
Provider: Vendita
Platform: vendita.io

1. Introduction and Scope

This Privacy Policy explains how Vendita collects, uses, stores, discloses, and otherwise processes personal data in connection with vendita.io, including any related websites, applications, messaging tools, artificial intelligence features, analytics, integrations, and support services.

Vendita.io is a business-to-business software platform designed for use by organisations and their authorised users. This Privacy Policy applies to personal data processed in connection with:

  • website visitors and people who interact with us directly
  • trial users, subscribers, and authorised users of the Platform
  • business contacts who communicate with us directly
  • personal data processed through the Platform on behalf of subscribers

This Privacy Policy does not replace any contract between us and a subscriber, including our Terms of Service or Data Processing Agreement where applicable.

2. Our Role: When We Are Controller and When We Process Data for Subscribers

Our role depends on the type of personal data involved and the context in which it is processed.

2.1 When we act as controller

We generally act as the controller of personal data relating to:

  • subscriber and user account registration
  • account administration
  • billing and payment administration
  • platform access and authentication
  • support and service communications
  • website usage, enquiries, and business relationship management
  • fraud prevention, platform security, and internal operations

In those cases, we decide how and why that personal data is processed.

2.2 When we process data on behalf of subscribers

We generally act as a processor, service provider, or equivalent role when subscribers upload, import, sync, store, organise, or use personal data through the Platform in connection with their own contacts, campaigns, communications, CRM records, and outreach activities.

In those cases:

  • the subscriber generally determines the purposes for which the data is used
  • the subscriber is generally responsible for identifying the appropriate legal basis and complying with applicable outreach and privacy laws
  • we process that data in order to provide the Platform and related services to the subscriber

2.3 Contacts uploaded by subscribers

If you are a contact whose information has been uploaded to the Platform by one of our subscribers, you typically do not have a direct contractual relationship with us. In most cases, the relevant subscriber is the party primarily responsible for your personal data and communications with you.

3. Categories of Personal Data We Collect and Process

The personal data we collect and process depends on how the Platform is used and the relationship involved.

3.1 Subscriber and user account data

We may collect and process:

  • name
  • business email address
  • organisation name
  • account login and authentication information
  • subscription plan details
  • billing and payment information
  • support enquiries and correspondence
  • account preferences and settings
  • device, log, session, and access data
  • usage and interaction data relating to the Platform

3.2 Contact data processed on behalf of subscribers

Subscribers may upload or sync personal data relating to their contacts, including:

  • first name and last name
  • email address
  • phone number
  • company name
  • job title
  • CRM identifiers and external reference IDs
  • tags, segmentation data, and campaign status
  • message history, email content, SMS content, WhatsApp content, call records, and conversation history
  • opportunity and pipeline stage data
  • opt-out, unsubscribe, suppression, or do-not-contact status
  • response activity and behavioural engagement data
  • AI-generated summaries, classifications, and related metadata linked to communications

3.3 Website, marketing, and enquiry data

If you visit our website, request information, book a demo, or otherwise contact us directly, we may collect:

  • name and business contact details
  • company details
  • message and enquiry content
  • website usage and analytics data
  • cookies or similar online identifiers where used

3.4 Integration and technical data

Where the Platform connects to third-party systems, we may process:

  • CRM data
  • integration tokens or credentials
  • messaging and telephony account details
  • platform diagnostics
  • webhook and event logs
  • technical metadata relating to connected services

4. Sources of Personal Data

We collect personal data from a range of sources depending on how the Platform is used.

These sources may include:

  • directly from subscribers, users, and website visitors
  • from subscriber uploads, manual entry, and platform configuration
  • from subscriber CRM systems and other integrations connected by the subscriber
  • from communications sent or received through the Platform
  • from websites or URLs submitted for knowledge generation or business context creation
  • automatically from platform usage, session activity, logs, telemetry, and technical events
  • from payment processors and service providers involved in billing and service delivery
  • from our service providers, business partners, or publicly available sources where relevant and lawful

5. How We Use Personal Data

We use personal data for different purposes depending on whether we are acting as controller or processing data on behalf of a subscriber.

5.1 How we use personal data when we act as controller

Where we act as controller, we may use personal data to:

  • create and manage accounts
  • authenticate users and secure access
  • provide customer support and respond to enquiries
  • administer subscriptions, billing, credits, and payments
  • operate, maintain, troubleshoot, and secure the Platform
  • monitor usage, detect misuse, and prevent fraud or abuse
  • communicate about service updates, support matters, account activity, and legal notices
  • improve platform functionality, reliability, and performance
  • analyse trends and usage patterns
  • comply with legal, regulatory, tax, and accounting obligations
  • enforce our contractual rights, policies, and legitimate business interests

5.2 How we process personal data on behalf of subscribers

Where we process personal data on behalf of subscribers, we may process that data to:

  • host, store, organise, and make available subscriber data within the Platform
  • enable subscribers to manage contacts, campaigns, conversations, and workflows
  • send, receive, route, and track communications through supported channels
  • provide analytics, reporting, and operational insights to subscribers
  • generate AI outputs requested or enabled by subscribers
  • support integrations and synchronisation with connected systems
  • provide technical support, maintenance, diagnostics, and service administration
  • secure the Platform, monitor service integrity, and prevent misuse

5.3 Legal bases where we act as controller

Where required by applicable law, we rely on one or more of the following legal bases:

  • performance of a contract
  • our legitimate interests in operating, securing, improving, and administering the Platform and related business operations
  • compliance with legal obligations
  • consent, where we specifically request and rely on consent

Where we process personal data on behalf of subscribers, the subscriber is generally responsible for identifying the appropriate legal basis for that processing.

6. Customer Data Ownership and Export Rights

We recognise that subscribers place significant trust in us when using the Platform.

As between us and the subscriber:

  • subscribers retain their rights in the contacts, customer records, campaign materials, business information, and other content they upload, sync, or submit to the Platform
  • we do not claim ownership of subscriber contact lists or subscriber business content
  • subscribers may export their data, including analytics and reporting data made available through the Platform, subject to the functionality of the Platform and any applicable contractual limits
  • identifiable subscriber data and contact data are processed in order to provide, secure, support, maintain, and administer the Platform and related services for the subscriber

We do not use identifiable subscriber-uploaded contact data or subscriber business content for unrelated third-party commercial purposes.

7. De-Identified, Aggregated, and Derived Data

We may create and use de-identified, aggregated, statistical, analytical, operational, and derived data from information processed through the Platform, provided that such data does not reasonably identify an individual, a contact, or a subscriber.

This may include data relating to:

  • platform usage and feature interaction
  • service performance and diagnostics
  • aggregated communication activity
  • model quality signals and response patterns
  • trend analysis
  • benchmarking and service analytics
  • platform reliability, safety, and abuse prevention
  • product development and optimisation

We may use such de-identified, aggregated, statistical, operational, and derived data to:

  • maintain and improve the Platform
  • optimise service performance, security, and reliability
  • develop and improve platform features and workflows
  • improve the quality, effectiveness, and performance of the AI systems we host
  • conduct internal research, testing, analytics, and modelling
  • generate business insights and service benchmarks
  • support business operations and strategic planning

Where we use de-identified data, we will take reasonable measures designed to prevent re-identification.

8. AI Features and Automated Processing

The Platform includes AI and automation features that may process personal data and business data in order to provide requested functionality.

8.1 AI-related processing

Depending on the features enabled by a subscriber, the Platform may use AI to:

  • generate outbound messages
  • draft or suggest replies
  • summarise conversations
  • classify interactions and outcomes
  • generate knowledge materials and business context
  • assist with campaign optimisation
  • support workflow automation and decision support

8.2 Automated processing and profiling

The Platform may also use automated systems to:

  • classify leads, contacts, conversations, or opportunities
  • analyse behavioural activity such as replies, timing, and engagement
  • suppress or route communications based on configured rules
  • assign records to workflows, variants, or operational categories
  • generate insights, recommendations, or analytics for subscribers

8.3 AI providers

To provide AI features, we may share relevant personal data and business data with third-party AI providers and related service providers acting on our instructions or the subscriber’s enabled configuration.

8.4 Important notice

AI-generated output may be inaccurate, incomplete, or unsuitable in some cases. The use of AI features may involve limited or no individual human review at the point of generation or communication, depending on the configuration selected by the subscriber.

9. When We Share Personal Data

We may share personal data where reasonably necessary for the purposes described in this Privacy Policy, including with the following categories of recipients:

  • hosting, infrastructure, and cloud service providers
  • database, storage, and platform operations providers
  • artificial intelligence and machine learning providers
  • messaging, telephony, email, and communications providers
  • payment processors and billing providers
  • CRM, integration, and workflow providers enabled by subscribers
  • customer support, security, analytics, and monitoring providers
  • professional advisers such as lawyers, auditors, insurers, and accountants
  • regulators, courts, law enforcement, or governmental authorities where required by law or where necessary to protect rights and safety
  • corporate transaction counterparties and their advisers in connection with a merger, acquisition, financing, restructuring, or sale of assets

Our service providers and sub-processors may include providers such as Claude, Google Gemini, Perplexity, OpenAI, Twilio, Stripe, Supabase, and other technology and infrastructure partners used to operate the Platform.

We do not sell identifiable subscriber-uploaded contact data to third parties.

10. International Transfers

Personal data may be processed in countries other than the country in which it was originally collected.

Where required by applicable law, we take steps designed to ensure that international transfers are subject to appropriate safeguards, which may include:

  • contractual protections such as standard contractual clauses
  • transfers to jurisdictions recognised as providing adequate protection
  • other lawful transfer mechanisms permitted by applicable law

By using the Platform, you acknowledge that personal data may be processed in multiple jurisdictions, subject to applicable safeguards where required.

11. Data Retention

We retain personal data for different periods depending on the type of data, the purpose for which it is processed, contractual requirements, legal obligations, operational necessity, and legitimate business needs.

In general:

  • subscriber account, billing, support, and business relationship data may be retained for the duration of the account and for a reasonable period afterward
  • contact data, communication records, analytics, and operational history processed on behalf of subscribers may be retained while the subscriber account remains active and for a reasonable period after account closure, subject to legal, contractual, and operational requirements
  • technical logs, security records, and audit trails may be retained as necessary for fraud prevention, dispute resolution, compliance, and platform integrity
  • de-identified, aggregated, statistical, and derived data may be retained for longer where permitted by law because it no longer reasonably identifies an individual or subscriber

We may retain data for longer where necessary to comply with legal obligations, resolve disputes, enforce agreements, detect or prevent misuse, maintain backups, or protect the security and integrity of the Platform.

12. Your Rights and How Requests Are Handled

Depending on your jurisdiction, you may have rights in relation to your personal data, including rights to:

  • request access to personal data
  • request correction of inaccurate data
  • request deletion of personal data
  • object to or restrict certain processing
  • request portability of certain data
  • withdraw consent where processing is based on consent
  • lodge a complaint with a regulator or supervisory authority

If we process your personal data as a controller, we will handle your request in accordance with applicable law.

If we process your personal data on behalf of a subscriber, we may need to direct your request to the relevant subscriber, because that subscriber is generally the party primarily responsible for the relevant processing decisions.

We may request information necessary to verify identity before responding to a privacy request.

13. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, misuse, loss, or destruction.

These measures may include administrative safeguards, access controls, encryption, authentication measures, monitoring, service provider controls, and other security practices appropriate to the nature of the data and the service.

No method of transmission or storage is completely secure. While we take reasonable steps to protect personal data, we cannot guarantee absolute security.

14. Corporate Transactions

If we are involved in an actual or proposed merger, acquisition, investment, financing, reorganisation, insolvency event, sale of assets, or similar corporate transaction, personal data may be disclosed to relevant counterparties, advisers, lenders, or acquirers and may be transferred as part of that transaction, subject to applicable confidentiality and legal requirements.

Any successor or acquirer may continue to use personal data in a manner consistent with this Privacy Policy and applicable law.

15. Children and Sensitive Data

The Platform is intended for business use and is not directed to children.

Subscribers must not use the Platform to upload or process sensitive personal data, special category data, or similarly regulated information unless expressly authorised by us in writing and handled in accordance with applicable law.

This includes, by way of example, information revealing health status, biometric data, political opinions, religious beliefs, sexual orientation, or similarly sensitive categories of personal data.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform, our practices, applicable law, or regulatory expectations.

When we update this Privacy Policy, we will revise the effective date above. Where required by law, we will provide additional notice of material changes.

17. Contact Details

If you have questions about this Privacy Policy or wish to make a privacy-related request, please contact:

Vendita
privacy@vendita.io
support@vendita.io
vendita.io

If applicable, you may also contact our data protection representative or data protection officer.