Privacy Policy

Last updated: May 22, 2026.

1. Scope and Our Role

This Privacy Policy applies to Project Automation LLC ("Project Automation," "Vendee Pro," "we," "us," or "our") and to the data we process in connection with the Vendee Pro website at vendeepro.app, our mobile and web applications, our APIs, and our integrations (collectively, the "Service").

Our role under data protection laws depends on context:

• Visitors to the marketing site. When you visit our public pages, request a demo, sign up for marketing emails, or contact us, we are the controller (or "business" under U.S. state privacy laws) of the personal information you submit.
• Account holders and authorized users. When you register for and use the Service, we are the controller of administrative information (such as billing, account credentials, support correspondence, and security and audit logs) and a processor (or "service provider") of the Customer Data you upload, generate, or sync into the Service.
• End users of our customers. If your business uses Vendee Pro to manage products, vendors, purchase orders, sales, or other records that contain personal information of third parties, we process that information on your behalf and you are the controller responsible for the lawful basis for that processing.

2. Information We Collect

2.1 Information you provide

• Account details, such as name, email address, phone number, business name, role, and password (stored hashed).
• Billing information, such as billing address, tax identification, and the last four digits and expiration date of your payment card. Full card details are handled by our payment processor and are not stored on our systems.
• Communications, including support messages, feedback, and replies to surveys.
• Customer Data, including products, variants, vendors, suppliers, locations, stores, sales history, purchase orders, transfers, stocktakes, snapshots, photographs you upload, files you import, and any other content you place into the Service.
• AI inputs and outputs, including prompts, voice transcripts, attached context, the outputs the AI returns, and your confirmations or rejections of any proposed action.

2.2 Information we collect automatically

• Usage data, including pages viewed, features used, time stamps, referring URLs, search queries inside the Service, and AI tool-call history.
• Device and connection data, including IP address, browser type and version, operating system, device identifiers, and approximate location derived from IP.
• Diagnostic and security logs, including authentication events, error stack traces, request metadata, and rate-limit and abuse signals.
• Cookies and similar technologies as described in Section 8.

2.3 Information from integrations

When you connect a Third-Party Service (such as Shopify, Heartland Retail, or another point-of-sale or commerce system), we receive the data permitted by that integration. The specific scope is described where you authorize the connection. We use that data to operate the integration, calculate reports, and surface insights inside the Service.

2.4 Information from other sources

We may receive information about you from your colleagues (for example, when an Owner adds you as a Sub-User), from an Enterprise Admin who has invited your Account, from Consultants assigned to your Account, from referrers, and from publicly available sources for fraud prevention.

3. How We Use Information

We use information to:

• provide, operate, secure, and improve the Service;
• create and authenticate Accounts, and enforce permissions and audit controls;
• process payments and manage Subscriptions and AI Credits;
• generate AI Output, run reports, and execute the actions you confirm;
• communicate with you about the Service, including announcements, security alerts, and policy updates;
• send marketing communications where permitted, with an option to unsubscribe in every email;
• monitor for fraud, abuse, security incidents, and violations of our Terms;
• perform analytics on usage to understand performance, prioritize improvements, and inform product decisions;
• generate aggregated or de-identified data that no longer reasonably identifies any person, which we may use for any lawful purpose, including improving the Service and publishing industry insights;
• comply with our legal obligations and enforce our agreements; and
• establish, exercise, or defend legal claims.

4. Artificial Intelligence Processing

4.1 What we process

When you use AI features, we process the prompt you submit, the relevant context drawn from your Customer Data (for example, products, purchase orders, inventory, and sales records), any voice transcript you provide, and the AI Output. We retain a log of each AI tool call, including which tool was invoked, what data was returned to the model, and which actions you confirmed.

4.2 Routing to AI Providers

We send AI requests to one or more third-party large language model providers (each, an “AI Provider”). We do not contract directly with the underlying foundation-model providers. Instead, we route AI requests through OpenRouter, an AI API aggregator that maintains its own contractual relationships with the foundation-model providers and publishes the current list of those providers in its own Data Processing Agreement (Schedule 3) at openrouter.ai/data-processing-agreement. That list is incorporated into this Policy by reference. The specific AI Provider and model that process a given request may change over time as OpenRouter adds or removes downstream providers; those changes are governed by OpenRouter’s own sub-processor change-notification process described in Section 18.

Zero Data Retention. Our routing layer is configured to use only those provider endpoints that OpenRouter exposes as Zero Data Retention (“ZDR”) compliant under OpenRouter’s contracts with the foundation-model providers. Under those ZDR commitments, the foundation-model provider does not persist your prompt, the contextual Customer Data sent with it, or the AI Output beyond what is needed to compute the response. Endpoints that OpenRouter does not classify as ZDR-compliant are not enabled in our routing layer.

4.3 No model training on Customer Data

We do not use Customer Data to train, fine-tune, or otherwise improve foundation models owned by us or by any third party. Our routing layer is configured to use only AI Provider endpoints that, per the published terms of our routing aggregator, do not use Customer Data for training, fine-tuning, or model improvement either. This applies to your prompts, voice transcripts, attached files, the contextual data the AI reads to answer you, and the AI Output. We do, however, use anonymized, aggregated, or de-identified data, which cannot reasonably be associated with you, your Authorized Users, or your business, to evaluate and improve the Service.

4.4 Voice features

Voice capture in your browser typically uses your operating system or browser’s native speech recognition (such as the Web Speech API). The audio may be processed by your device or by your browser’s vendor under that vendor’s privacy policy. We do not record or store continuous audio. Once your speech is converted to text, the resulting text is treated as Customer Data.

4.5 Logs and audit

We keep a short-lived local copy of AI prompts, tool calls, proposed actions, and your confirmations so that you can resume a conversation, undo a recently confirmed action, and so we can investigate abuse, security incidents, billing disputes, and bugs. These logs live inside Vendee Pro and are automatically purged on the schedule described in Section 9. Aggregated, de-identified billing and abuse-prevention metrics may be retained longer.

5. Enterprise, Consultant, and Sub-User Access

If your Account is part of an Enterprise Account, the Enterprise Admin has administrative access to your Account, including the ability to view configuration, Customer Data, billing, AI usage, and audit logs, and to impersonate the Account for support and oversight purposes. If you accept a Consultant assignment, the assigned Consultant has the access permissions you have granted them. If you are an Authorized User of an Account that you do not own, the Owner of that Account controls how your activity within the Service is logged and viewed.

You should not place any personal information of third parties into the Service unless you have a lawful basis to do so and have provided any required notices to those third parties. By using the Service, you instruct us to process such personal information on your behalf in accordance with this Privacy Policy and our Terms.

6. Sharing and Disclosure

We share personal information only as described in this Section. We do not sell personal information for monetary consideration.

• Sub-processors and service providers, including hosting, AI providers, payment processors, email and notification providers, error monitoring, customer support tooling, and analytics. These vendors process information under written contracts that limit their use to providing services to us. The current list is in Section 7.
• Third-Party Services you connect, such as Shopify or Heartland Retail. Data flows to and from these services to operate the integrations you authorize.
• Enterprise Admins and assigned Consultants, where you are a Member Account or have authorized a Consultant assignment.
• Authorized Users you invite, who can see and act on the data within the permissions you grant.
• Legal and safety disclosures, where we believe in good faith that disclosure is required to comply with a legal obligation or valid request from law enforcement, to protect the rights, property, or safety of Project Automation, our users, or the public, or to detect, prevent, or address fraud, abuse, or security issues.
• Business transactions, where personal information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction. We will provide notice of any such transfer that materially changes how your information is handled.
• With your direction, where you instruct us to share information with a specific recipient.

7. Sub-Processors

The following service providers process personal information on our behalf to deliver the Service. We may add or change sub-processors and will update this list when we do. Each sub-processor is engaged under a written agreement that includes data protection terms appropriate to the nature of its services and that flow through, where applicable, the requirements of Quebec Law 25, the California Consumer Privacy Act, and other data protection laws applicable to our customers and their end users.

8. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies to operate the Service, remember your preferences, secure your session, and gather usage analytics. We use:

• Strictly necessary cookies required for authentication, session management, security, and load balancing.
• Preference cookies that remember your settings such as default store, sort order, and table density.
• Analytics cookies and pixels that help us understand how the Service is used. These may be set by our analytics sub-processors.

You can control cookies through your browser settings, including blocking or deleting them. Some features will not work if you disable strictly necessary cookies. We do not currently respond to "Do Not Track" signals because no consistent industry standard exists for them.

9. Retention

We retain personal information for as long as is needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Account records and Customer Data: for the duration of your Subscription. After termination, we make Customer Data available for export for thirty (30) days, after which we may permanently delete it from active systems. Backups may persist for an additional reasonable period before being purged in the ordinary course.
• Billing records: retained for at least seven (7) years to comply with tax and accounting obligations.
• AI conversation history: prompts, AI Output, scope memory, undo snapshots, pending action payloads, tool-call audit, and the parsed text we extract from any file you attach to the AI are automatically and permanently deleted from our systems on a rolling thirty-one (31) day window from the date the record was created. You may also delete an individual conversation at any time from the AI panel. Anonymized, aggregated billing and abuse-prevention metrics derived from this data may be retained longer.
• Uploaded AI attachments: the underlying files you upload to the AI are force-deleted from disk within twenty-four (24) hours of upload (seven (7) days for AI-generated exports). The metadata row is then purged on the same thirty-one (31) day window described above.
• Security and audit logs: retained as needed to investigate incidents, typically for at least twelve (12) months.
• Marketing data: retained until you opt out, after which we keep a suppression record so we do not contact you again.

Aggregated and de-identified data may be retained indefinitely.

10. Security

We use administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS), encryption at rest where supported by our infrastructure, role-based access control, tenant-isolated database scoping, multi-factor authentication for administrative access, audit logging, and a documented incident response process. No method of transmission or storage is fully secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and for the security of any device or network you use to access the Service.

11. International Data Transfers

Vendee Pro is operated from the United States. If you access the Service from outside the United States, you understand that your personal information will be transferred to and processed in the United States and other countries where our sub-processors operate. Where required, we rely on appropriate transfer mechanisms such as the Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum. Additional disclosures for residents of Quebec are set out in Section 14A.

12. Your Rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, object to processing, and withdraw consent. You may exercise these rights through our contact form. We will respond within the time frame required by applicable law. We may need to verify your identity before fulfilling your request, and we may decline a request where permitted by law, including where your request would compromise the privacy or rights of another person, would interfere with our legal obligations, or relates to information we hold as a processor on behalf of one of our customers (in which case you should contact that customer).

If you are an end user whose personal information is in a customer’s Account (for example, an employee or contact stored in our customer’s Vendee Pro Account), please contact that customer directly. We will assist them in responding to your request.

13. California Residents

This Section provides additional disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

Categories of personal information collected. In the past twelve months we have collected the following categories of personal information from or about California residents: identifiers (such as name, email, phone, IP address); commercial information (such as Subscription history); internet or other electronic network activity (such as usage and device data); geolocation data (approximate, derived from IP); audio data (transient voice transcription input); professional or employment information (such as job title); and inferences drawn from the foregoing. Sources include you, your Authorized Users, your integrations, and our service providers.

Sale and sharing. We do not sell personal information for monetary consideration and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA.

Sensitive personal information. We do not use or disclose sensitive personal information for any purpose other than those permitted under the CCPA without further notice or consent.

Your rights. California residents have the right to request to know, delete, correct, and limit the use of personal information, and the right not to be discriminated against for exercising those rights. Submit a request through our contact form. You may use an authorized agent to submit a request, subject to verification.

14. European Economic Area, United Kingdom, and Switzerland

If you are in the European Economic Area, the United Kingdom, or Switzerland, this Section provides additional disclosures.

Legal bases. We process personal information based on (a) the performance of our contract with you; (b) your consent, where required; (c) our legitimate interests in operating, securing, and improving the Service, where those interests are not overridden by your rights; and (d) compliance with our legal obligations.

International transfers. Where we transfer personal information outside the EEA, the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we rely on the Standard Contractual Clauses or another lawful transfer mechanism.

Your rights. You have the right to access, rectify, erase, restrict, and port your personal information, and to object to processing. You also have the right to lodge a complaint with your local data protection authority.

Data Processing Addendum. If you require a Data Processing Addendum, including the Standard Contractual Clauses, please reach us through our contact form.

14A. Quebec Residents (Law 25)

The Service is available to customers operating in Canada, including the province of Quebec. If you reside in Quebec or your business is located in Quebec, the following additional disclosures apply under An Act to modernize legislative provisions as regards the protection of personal information (Quebec Law 25) and the Quebec Act respecting the protection of personal information in the private sector.

Privacy Officer. Project Automation LLC has designated a Privacy Officer responsible for ensuring compliance with applicable Quebec privacy law. Contact information for our Privacy Officer is set out in Section 19.

French-language availability. A French-language summary of this Privacy Policy is available upon request from our Privacy Officer. We will provide the summary in French within a reasonable time at no cost. Quebec residents may communicate with us in French regarding any matter arising under this Policy.

Cross-border transfers. The personal information of Quebec residents that we process in connection with the Service is transferred to recipients located outside Quebec, principally to our United States cloud hosting provider, to OpenRouter for AI request routing, and to Stripe for payment processing. Each of these recipients operates under a published Data Processing Agreement that we have accepted, and the personal information involved is predominantly low-sensitivity business and operational data of the kind ordinarily handled by retail back-office software. For more information about the safeguards we rely on for a particular transfer, contact our Privacy Officer.

Your rights under Law 25. Quebec residents have the right to (a) be informed of the existence of personal information held about them and the purposes of processing; (b) access and obtain a copy of that information; (c) request correction of inaccurate, incomplete, or ambiguous information; (d) request that we cease processing or disseminating personal information, or that we de-index or remove a hyperlink, in the circumstances permitted by Law 25; (e) request data portability of computerized personal information; (f) withdraw consent where processing is based on consent; and (g) lodge a complaint with the Commission d’accès à l’information du Québec (CAI). To exercise any of these rights, contact our Privacy Officer using the channels in Section 19. We will respond within thirty (30) days of receiving a verifiable request.

Confidentiality incidents. In the event of a confidentiality incident involving personal information of Quebec residents that presents a risk of serious injury, we will promptly notify the CAI and the affected individuals and will keep a register of confidentiality incidents in accordance with Law 25.

Automated decision making. We do not make decisions about Quebec residents based exclusively on automated processing of personal information that produces legal effects or similarly significant effects. AI features in the Service propose actions for review and require explicit human confirmation before any change is written; this is not automated decision making within the meaning of Law 25.

15. Shopify App Data

When a merchant installs our Shopify application, we access limited order and inventory data from the merchant’s Shopify store solely to provide app functionality.

Data we access

• Order line items (products, SKUs, quantities)
• Net sales amounts
• Discount and markdown values
• Inventory levels and inventory valuation
• Fulfillment status
• Return information, where applicable

Data we do not access

• Customer names
• Customer email addresses
• Customer phone numbers
• Customer shipping or billing addresses
• Payment or financial information

How we use this data

Shopify order and inventory data is used to power reports and inventory features within the Service. It is never used for advertising, profiling, resale, or sharing with unrelated third parties.

Storage and retention

For Shopify report features that operate on a real-time basis, data is retrieved on demand, processed in memory, and discarded after the report is delivered. For features that depend on synced product, variant, location, or sales records, that data is stored within your Account in encrypted form and retained for the duration of your Subscription. Shopify API credentials are stored securely and are deleted within 24 hours after the merchant uninstalls the app.

Security

All data transmission between our application and Shopify occurs over TLS-encrypted connections. Access controls, audit logging, and tenant isolation apply to any synced data we store.

Merchant control

Merchants can disconnect our application from their Shopify store at any time through the Shopify admin panel. Uninstallation immediately revokes our access to live store data.

16. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please reach us through our contact form so we can take appropriate action.

17. Third-Party Sites

The Service may contain links to websites or services we do not operate. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policy of every site you visit.

18. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, if the changes are material, provide additional notice (such as an in-app notification or email) at least seven (7) days before the changes take effect. Your continued use of the Service after the effective date of the updated Policy constitutes your acceptance of the changes.

Downstream model-provider changes. Our direct sub-processors are listed in Section 7. We use a stable, intentionally narrow set of foundation models routed through OpenRouter, and the great majority of additions or removals within OpenRouter’s broader downstream sub-processor list (i.e., OpenRouter’s own sub-processors, as published in Schedule 3 of OpenRouter’s Data Processing Agreement) do not affect the Service. Such downstream changes are governed by OpenRouter’s own change-notification process and do not require an update to this Policy or notice from us. Customers who want direct notice of those downstream changes may subscribe with OpenRouter at the contact address published on its DPA page. We will continue to provide notice as described above for any change to our own direct sub-processors, including any change to the routing aggregator we use, and for any change to the foundation-model providers actively in use by the Service that materially alters the categories of recipients of Customer Data.

19. Contact

If you have questions or requests regarding this Privacy Policy, please contact us:

Project Automation LLC
Atlanta, Georgia, United States
Contact: vendeepro.app/contact
Web: https://vendeepro.app/

Privacy Officer. Project Automation LLC has designated a Privacy Officer responsible for compliance with applicable privacy law, including Quebec Law 25. Quebec residents and any other individuals exercising rights under applicable privacy law may reach the Privacy Officer at:

Privacy Officer, Project Automation LLC
Atlanta, Georgia, United States
Contact: vendeepro.app/contact (subject line: Privacy Officer)