Privacy Policy

1. Information We Collect

We collect information you provide during registration, when setting up a storefront, or when interacting on the platform. This includes:

• Account Credentials: Full name, email address, telephone number, location, and securely encrypted password hashes.
• Merchant/Store Information: Business or storefront name, store descriptions, contact numbers, banners, logos, and product inventories (prices, descriptions, stock levels, images).
• Transactional & Usage Details: Favorite items, active shopping carts, storefront views, click-through counters, order history, and user-to-vendor communication logs.
• Technical Metadata: IP addresses, browser type, user-agent information, session cookies, and Firebase Cloud Messaging (FCM) push tokens used for real-time notifications.

2. How We Use Your Information

We process your information for the following purposes:

• Account Management: Set up profiles, authenticate logins, and handle password recovery.
• Marketplace Functionality: Render product listings, manage carts and favorites, process orders, and handle vendor storefronts.
• Buyer–Seller Communication: Enable contact between buyers and sellers through phone, WhatsApp links, direct emails, or on-platform messaging.
• AI-Powered Assistance: Analyze shop metrics and listing text using our integrated AI assistant to provide description improvements and merchant recommendations.
• Notifications & Alerts: Send order updates, platform messages, and account alerts via email and web push services (Firebase Cloud Messaging).
• Platform Security: Monitor system logs, detect fraud, rate-limit suspicious activity, and block malicious file uploads.

3. Information Sharing

We do not sell your personal data. Sharing is limited to the following circumstances:

• Transaction Facilitation: When a buyer proceeds to checkout, their name, phone number, and location are shared with the specific vendor to coordinate delivery and payment.
• Third-Party Infrastructure: We share necessary data with hosting providers, SMTP email services, and Firebase Cloud Messaging (FCM) to route notifications to your browser or device.
• Legal Requirements: We may disclose your information where required by law, a court order, or a legitimate governmental authority.

4. Data Security

We implement appropriate technical and organizational security measures including:

• Password Hashing: Passwords are encrypted using password_hash() with Bcrypt (cost factor 12) before storage.
• Database Protection: All database queries use prepared statements with parameter binding to prevent SQL injection.
• Upload Security: Uploaded images are sanitised, renamed, and stored in directories configured to block PHP script execution.
• Secure Sessions: HTTPOnly and SameSite cookie flags protect against Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks.
• Encrypted Transmission: All data is transmitted over HTTPS/TLS connections.

5. Cookies & Local Storage

• We use session cookies to maintain your authenticated login state across pages.
• Browser local storage is used to save your cart and favorites so they persist between page refreshes.
• We do not place third-party tracking, retargeting, or advertising cookies on your device.

6. Data Retention & Account Deletion

We retain your personal data only for as long as your account is active or as required by law. You may request deletion of your account at any time through the Profile settings. Upon deletion, your profile records, storefront details, and product listings are permanently removed from our active databases.

7. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last updated" date shown at the top. We will notify you of any significant changes via email or platform notification. Continued use of Vendora after an update constitutes acceptance of the revised policy.