Privacy Policy

Who we are

Vendee Labs (Jersey) Ltd ("Vendee Labs", "we", "us") is the data controller for this website and for the VendeeX app. Our registered office is 2 Bagatelle Terrace, St Saviour, Jersey JE2 7TS (Company No. 164895). You can reach us about privacy at privacy@vendeelabs.com.

The short version

VendeeX is free to use and runs on your computer. Your identity, preferences, cart, history and record stay there. Your searches travel through a gateway we operate to reach merchants' product feeds, without your name attached and without being kept. We don't build an advertising profile, we don't sell your data, and we don't track you across the web. The sections below give the detail.

What stays on your device

When you use VendeeX, the following is stored locally on your computer and is not sent to us:

• Your identity and setup for the app.
• Your preferences, wishlist, and cart.
• Your purchase history and your Verified Record.
• Any listings you create in the Sell space.
• The AI model that runs your searches. It runs on your computer, and we do not receive what it produces.

VendeeX sends us no behavioural telemetry: we do not receive a log of what you view, choose, or buy, and we do not build an advertising or shopping profile about you.

Your searches, and our gateway

To find products, your search has to reach merchants' product feeds, and it travels through a gateway we operate to get there. We describe this plainly because it is the one part of shopping with VendeeX that does involve our systems.

• Your search is sent to our gateway without your identity attached. It carries the terms you searched for and what is needed to filter results (for example a delivery region), not your name, your account, or a profile.
• Our gateway passes the search to the relevant merchant feeds and returns the results to your device.
• We do not retain your search, and we do not associate it with you or with your other searches.
• Some feeds require credentials that cannot safely be held on your computer. Our server holds those and issues your installation a short-lived, scoped token so your search can reach the feed. The credential itself never leaves our server.

Your installation has an identifier that lets us issue those tokens, count requests, and rate-limit abuse. It is not your name and we do not link it to you, but it is capable of distinguishing one installation from another, so we treat it as personal data.

What we receive

We receive a limited amount of personal data in three situations.

When a referral leads to a sale, the merchant or its affiliate network tells us that a referred installation converted, so that our commission can be attributed. This typically includes the merchant, the order value, the date, and a reference. It does not include your name, the items in your basket, or your card details.

When we are paid a share of the payment processing fee, we may receive settlement data from the payment provider to reconcile it, such as the transaction amount, the fee, the date, and a reference. This is a share of the fee the merchant already pays to process a card; it is not a charge to you, and we do not process your payment. You pay the merchant directly, at the merchant's own checkout, and your card details go to the merchant and its payment provider, never to us.

When you contact us by email, we receive whatever you send, including your email address and the content of your message.

Legal bases for processing

Under the Data Protection (Jersey) Law 2018 and the EU GDPR, we rely on the following legal bases for the limited processing we carry out.

• Legitimate interests — to pass your searches to merchant feeds and return the results, which is the function you asked the app to perform; to issue tokens and rate-limit abuse so the service stays available; to respond to your emails and support requests; to keep accurate accounting and commission records; and to keep the service and website secure. Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see Your rights).
• Legal obligation — to keep records we are required by law to retain, such as tax and accounting records.
• Consent — where consent is ever required (for example any optional communications), we will ask for it clearly and you can withdraw it at any time.

We do not carry out advertising profiling or automated decision-making that produces legal or similarly significant effects about you.

The website: analytics and cookies

This website uses no analytics and sets no tracking or advertising cookies. We do not measure or profile visitors. The site uses only strictly-necessary cookies required for it to function, which do not require consent under applicable law, so we do not show a cookie-consent banner.

Merchants and payment providers

When you buy from a store through VendeeX, you complete the purchase at that store's own checkout. VendeeX hands over only what that store needs to complete and fulfil your order, by your own action, and each merchant receives only its own order — never the rest of your cart or your history. From that point the store and its payment provider process your order and payment as controllers under their own privacy policies, and we recommend reading the policy of any merchant you buy from. We are not party to your payment.

Selling

If you list an item in the Sell space, the listing is created and stored on your device. Where a buyer and seller agree a sale, they arrange payment directly between themselves. We do not process that payment, take a share of it, or hold either party's card details.

Your rights

If you are in Jersey, the EU, or the UK, you have rights over your personal data, including the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• delete your data ("the right to be forgotten");
• restrict or object to how we process it;
• portability — receive a copy of your data in a usable format; and
• withdraw consent at any time, where we rely on consent.

Because most of your VendeeX data lives only on your device, you already hold and control it directly — you can delete it by removing it from your computer. For any data we hold, contact privacy@vendeelabs.com and we'll respond within the time the law requires.

You also have the right to complain to a data protection authority. In Jersey that is the Jersey Office of the Information Commissioner. If you are in the EU or the UK, you may also complain to your local supervisory authority.

How long we keep data

We keep personal data only as long as we need it, then delete it. As a guide:

• Email correspondence — kept while we handle your query and for a reasonable period afterwards, then deleted.
• Fee-settlement and accounting records — kept for as long as required for accounting and tax law, then deleted.

International transfers

We're based in Jersey, which the EU recognises as providing an adequate level of data protection. Where we work with service providers outside your country, we use providers that offer protections recognised under applicable data protection law, such as an adequacy decision or appropriate contractual safeguards.

Children

VendeeX is for adults. It isn't directed at children, and we don't knowingly collect data from anyone under 18.

Changes

We'll update this policy as the product changes. When we make a material change, we'll note it here and update the date at the top.

Contact

Questions about privacy: privacy@vendeelabs.com.