Privacy policy
Last updated:
Who we are
Vendly is operated by Magi Jouets LLC, 1234 Example St, Sheridan, WY 82801, USA, United States (Wyoming) ("Vendly", "we"). We are the controller of the personal data described here. Questions and requests: support@vendlyy.com.
This policy covers the Vendly app at https://app.vendlyy.com and this website, vendlyy.com. Vendly is a tool for businesses: it turns a merchant's product catalog into advertising creatives and Meta campaigns.
What we collect
- Your account: email address, password (stored only as an irreversible argon2id hash), optional display name, interface language and theme, and your organization's name. If you sign in with Google, the Google account id and email Google confirms.
- Security records: for each session, the IP address, browser user agent, a device label and timestamps; an audit log of sign-ins and account, store, billing and campaign actions with the IP address and user agent.
- Your Shopify store: the store's domain and name, the access token Shopify issues (encrypted), and your product catalog: titles, descriptions, prices, product types, product URLs and product photos. Vendly asks Shopify for read-only access to products and never reads your customers or orders.
- What you create: the options you choose for each generation (product, angles, placement, market, language), the offers and facts you switch on, photos you upload, and the creatives, ad copy and campaign drafts Vendly produces.
- Your Meta connection: the access token Meta issues (encrypted) and its expiry, your Facebook name and user id as returned by Meta, the ad accounts, Pages, Instagram accounts and pixels you give access to (names, ids, currency, time zone), the campaigns, ad sets, ads and images Vendly creates, and a log of the operations sent to Meta (without tokens or images).
- Credits and billing: your credit balance and its history. When paid plans are available, payments are handled by Stripe: we keep the Stripe customer id and purchase records, and never see your card number.
- Emails: we send you transactional emails only (address verification, password reset, email change and security notices).
This website sets no cookies and uses no analytics or advertising trackers.
Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service: your account, store sync, generating creatives and copy, building and publishing campaigns, credits | Performance of our contract with you |
| Sending transactional emails | Performance of the contract |
| Keeping accounts secure: sessions, rate limits, lockouts, the audit log | Our legitimate interest in protecting you and the service |
| Billing and accounting records | Contract; legal obligation |
We do not sell personal data, use it for advertising, or build profiles of you.
AI processing
To draw a creative, Vendly sends your product photos, the options and facts you chose and the instructions it writes to OpenAI's API; the finished image is sent back to OpenAI to check that it only states the facts you allowed. Account, session and billing data are never sent. Vendly does not train AI models, and under OpenAI's API terms this data is not used to train OpenAI's models. Please don't upload photos of identifiable people unless you have their permission.
Who processes your data
| Provider | What for | Where |
|---|---|---|
| Render | Hosting of the app and its database | Frankfurt, EU |
| OpenAI | Drawing and checking creatives, writing ad copy | United States |
| Brevo | Sending transactional emails | EU |
| Shopify | Your store connection, when you connect a store | Shopify's terms |
| Meta | Your ad accounts and campaigns, when you connect Meta | Meta's terms |
| Stripe | Payments, once paid plans are offered | Stripe's terms |
| Sign-in, only if you choose "Sign in with Google" | Google's terms |
Shopify, Meta, Stripe and Google also act under their own terms and privacy policies for the accounts you hold with them. Transfers to OpenAI in the United States rely on the European Commission's Standard Contractual Clauses in OpenAI's data processing addendum.
Cookies in the app
The app uses only cookies it needs to work. None is used for analytics or advertising.
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-vendly_session | Keeps you signed in | 30 days |
__Host-vendly_csrf | Protects forms against cross-site request forgery | Session |
__Host-vendly_theme | Remembers light or dark mode before you sign in | 1 year |
__Host-vendly_shopify_oauth, __Host-vendly_meta_oauth, __Host-vendly_google | Secures the connection to Shopify, Meta or Google while you approve it | 10 minutes |
How long we keep it
- Account, store, creative and campaign data: for as long as your account exists.
- Download bundles of your creatives: 7 days.
- When you remove a store in Vendly, its access token is deleted and its products are archived. When you uninstall Vendly in Shopify, the token is no longer used.
- When you remove Vendly from your Facebook settings, or Meta sends us a data deletion request, we delete the Meta access token and the names of your Pages, Instagram accounts and pixels.
- When you ask us to delete your account, we delete your data within 30 days, except records we must keep by law (such as invoices).
Deleting your data
To delete your Vendly account and its data, email support@vendlyy.com from the address of your account. We confirm the request and complete it within 30 days.
To remove only the Meta data: in Facebook, open Settings & privacy → Settings → Business integrations (or Apps and websites), select Vendly and remove it. Meta then tells Vendly, which deletes the access token and the cached names of your Pages, Instagram accounts and pixels. Campaigns already created stay in your ad account, where you control them.
To remove only a store: open Integrations → Stores in Vendly and remove it, or uninstall the app in Shopify.
Your rights
You can ask to access, correct, delete or receive a copy of your personal data, and to restrict or object to its use. You can change your name, language, email and password yourself in the app's settings; for anything else, email support@vendlyy.com. We answer within one month. You can also complain to your data protection authority.
Security
All traffic is encrypted with HTTPS. Store and Meta access tokens are encrypted at rest, passwords are hashed, and each organization's data is isolated at the database level. Access to production systems is restricted.
Children
Vendly is a service for businesses and is not meant for anyone under 18.
Changes
If we change this policy, we update the date above; for significant changes we also tell account holders by email before they take effect.