Privacy policy

Effective October 8, 2026Last updated October 31, 2026

This is a short policy for the vendumo.com website and the Vendumo app. It says what personal data we collect and what we do with it. We will update this page before we collect anything new.

Who we are

Vendumo is run by Talent Pool Ltd, a company registered in Bulgaria.

VAT ID: BG207455483
Contact: [email protected]

Talent Pool Ltd decides how the personal data on this page is used, except shoppers’ data in the app, which we handle for the store (see “The Vendumo app”). If that changes, we will update this page.

Privacy questions and requests: [email protected].

What we collect on this website

This site has no accounts, no advertising trackers and no analytics. It sets no cookies today.

Through this site we collect personal data in three ways only:

When you visit. Our hosting provider, Cloudflare, receives the technical data your browser sends with every request: your IP address, the page you ask for, the time, and your browser and device type. Cloudflare uses it to deliver the page and to protect the site from attacks. We do not use it to find out who you are.
When you email us. If you write to [email protected] or another vendumo.com address, we get your email address, your name if you give it, and your message. We use it only to answer you.
When you fill in a form. Our audit, contact and waitlist forms ask for your email address and, depending on the form, your name, your store address, your message and a few details about your store. With each form we keep the time, the page and language you sent it from, the consent line you saw, whether you ticked the box for product news, and any campaign tags or ad click IDs in the page address. Our site checks the form and sends it to our mailbox through Postmark. To stop abuse, it counts sends from each IP address for 10 minutes and then forgets them. We do not keep your IP address or browser details with the form.

We do not buy personal data about you, and we do not collect anything else through this site.

The Vendumo app

This part is for store owners who connect a store to the Vendumo app, and for their shoppers. The app only reads data. It changes nothing in a store or an ad account unless the store owner approves that one change.

From the store owner: your name and email address, to sign you in and send you login links and service emails.
From Shopify, when you install the app: your store details, products, stock levels, orders and refunds, shipping settings, store policies and markets, and customer records. A customer record holds the shopper’s email address, first name and email consent state. We never store shoppers’ phone numbers or postal addresses.
From your store’s website: page and shopping events (pages viewed, cart and checkout steps), with the page address, referrer, campaign tags, device type and time. Each event carries a coded visitor ID. When the shopper is a known customer of the store, we link that visitor ID to the store’s customer record, which holds the shopper’s email address, first name and email consent state. So those events can be tied to a named person.
From Google, if you connect it: your Google account name and email address, and, for each part you allow: Google Ads (campaign and product spend and results), Merchant Center (product and account status), Google Analytics (reports, read only) and Search Console (search results data, read only).
From Meta, if you connect it: the spend and results of your Meta ad campaigns (read only).

We use this data only to show the store owner their numbers and to carry out the actions the store owner approves. For shoppers’ data, the store owner decides how it is used, and we process it for them. A shopper who wants their data seen or deleted should ask the store; we handle Shopify’s data and deletion requests within 30 days.

Vendumo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We keep:

a shopper’s email address and name until the store asks us to delete them, or until 48 hours after the store removes the app, unless the store reconnects or still has another of our apps installed. At the same time we delete the link between that shopper’s on-site events and their customer record, so those events can no longer be tied to them;
a coded customer record with no email address or name (the Shopify customer ID, the number of orders, the first order date and the consent state) until Shopify asks us to delete the store’s data;
coded on-site events and daily totals with no time limit;
backups for up to about 37 days (30 daily copies plus up to 7 days of storage snapshots); after a deletion they cannot be read, because the store’s key is deleted;
error details for 7 days.

If you unsubscribe, we keep a coded form of your email address so we do not email you again.

Why we may use it

We use website data because we have a legitimate interest in running the site, keeping it safe and answering the people who write to us. We use app data to provide the service the store owner signed up for. We use form details to answer you and to handle your audit or waitlist request, because you asked us to. We send product news only if you ticked the box, and you can stop it at any time.

Who receives it

Cloudflare, Inc., which hosts and protects the website and protects the app.
Proton AG (Proton Mail), which stores our email.
Hetzner, which runs the app’s servers and stores its backups.
Postmark, which sends the app’s emails and delivers our website forms to us.
Sentry, which receives error reports from the app.

They act on our instructions. We do not sell your personal data for money. We do not use it for advertising today. Our forms keep any ad click IDs from the page address so that we can later measure our own ads. We will update this page before we send them to anyone. We may disclose it if the law requires us to.

Where it is processed

Cloudflare serves the site from data centers in many countries, including the United States. Our email is stored by Proton AG in Switzerland. App data is stored on servers in the European Union. App backups are encrypted and stored in Germany or Finland.

How long we keep website data

For the app, see “The Vendumo app”.

Visit data: we keep no copy. Cloudflare keeps it for a short time under its own rules.
Emails: up to 24 months after our last contact with you, unless you ask us to delete them sooner.
Form details: if you do not become a customer, up to 24 months after our last contact with you, unless you ask us to delete them sooner.
Waitlist entries: until 30 days after we email you that what you waited for is ready, or 24 months, whichever comes first.

Cookies we use

This site sets no cookies today. We use no analytics, no ad pixels, no chat widgets and no session recording.

If we add analytics later, we will update this page and list every cookie here before it is set. Your privacy choices will then show whether it runs in your browser.

Your rights

You can ask us to:

tell you what personal data we hold about you and send you a copy;
correct it;
delete it;
stop or limit using it, or object to how we use it.

You can stop product news at any time with the unsubscribe link in each news email, or by writing to [email protected]. Email [email protected]. Shoppers whose data we hold for a store can also ask that store. We answer within 30 days. Asking is free, and we will not treat you differently for it.

You can also complain to a data protection authority. In Bulgaria that is the Commission for Personal Data Protection (cpdp.bg). If you live in the European Economic Area, the UK or Switzerland, you can also complain to the authority where you live.

Children

This site and the app are for businesses. They are not meant for children, and we do not knowingly collect their data.

Changes

When what we collect changes, for example when we add a new data source to the app, we update this page before the change goes live and change the date at the top.