Privacy Policy

This policy explains how Vendigo (“we”) processes personal data when you use our website and platform. We process data in accordance with the EU General Data Protection Regulation (GDPR). The controller’s identity and contact details are listed in the imprint.

1. Data We Collect

Account data

When you register we collect your name, email address, password (stored as a hash), and organization details. When you subscribe to a paid plan, our payment processor collects billing details; we never see or store full card numbers.

Chat transcripts and end-user data

When your end users talk to a chat agent you have embedded on your website, we store the conversation transcripts, any contact details the end user submits (for example an email address for a support ticket), and technical metadata needed to run the widget. For this data, you — our customer — are the data controller, and we act as your processor: we process it only to provide the Service to you.

Usage and technical data

We collect log data (IP address, browser type, timestamps, pages visited) to secure and operate the platform, enforce rate limits, and prevent abuse. Our website analytics (Vercel Web Analytics) is cookieless and does not track you across sites.

First-party website statistics

On our own website we also count page views ourselves, without cookies and without any third party. For each view we store the page path (without any query parameters), the website that linked to you (host name only, never the full address), your country, whether you are on a mobile, tablet or desktop device, and the time. We do not store your IP address, your full browser user-agent string, or any cookie or persistent identifier. To count visitors without identifying anyone, your IP address and browser user-agent are combined with the current date and a secret key into a one-way hash; only that hash is stored, it changes every day, and it cannot be linked back to you or followed from one day to the next. These statistics are collected only on Vendigo’s own pages — websites our customers build and publish with Vendigo are not measured by us. Raw records are automatically deleted after 90 days.

Marketing data

If you have an account, we may send you product emails. Every marketing email includes an unsubscribe link; transactional emails (receipts, security notices) are sent regardless because they are required to operate your account.

2. Cookies and Consent

We use essential cookies for authentication and security; these are required for the Service to work. Advertising measurement (Google Ads) is loaded only if you accept it in our cookie banner. You can decline non-essential cookies with one click, and your choice is remembered in your browser.

3. Processors and Recipients

We share data with the following processors, each bound by a data processing agreement:

Some processors are located outside the EU/EEA. Where data is transferred internationally, we rely on adequacy decisions or the EU Standard Contractual Clauses. We do not sell personal data.

4. Legal Bases

• Contract (Art. 6(1)(b) GDPR): account management, providing the platform, billing, transactional email.
• Legitimate interests (Art. 6(1)(f)): security logging, abuse prevention, cookieless analytics, product emails to existing customers (with opt-out).
• Consent (Art. 6(1)(a)): advertising cookies and measurement. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): retaining invoices and tax records.

5. Retention

We keep account data for as long as your account exists. Chat transcripts are retained while your workspace is active or until you delete them. After account deletion, personal data is removed within a reasonable period except where law requires longer retention (for example, invoicing records). Security logs are kept for a short, limited period. First-party website statistics are deleted automatically 90 days after they are recorded.

6. Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erasure (“right to be forgotten”), where applicable;
• restrict or object to processing, including processing based on legitimate interests;
• data portability;
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with a supervisory authority.

If you are an end user of one of our customers’ chat widgets, please direct requests to that customer first — they control your data. We will assist them in fulfilling your request.

7. Security

We use encryption in transit, hashed passwords, role-based access controls, rate limiting, and abuse detection to protect data. No system is perfectly secure; we will notify you and the relevant authorities of a personal data breach where required by law.

8. Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

9. Changes

We will update this policy as the Service evolves and note the date of the latest revision above. For material changes we will notify registered users by email or in-app notice.

10. Contact

For privacy questions or to exercise your rights, contact contact@vendigo.live.