1. Data controller and contact
VENDO LLC, at 10 Rue D'Espagne, Cite Chebaw, Oued Ellil, Manouba 2021, Tunisia, controls the personal data described here. Privacy requests may be sent to vendo88@proton.me.
2. Data we process
- Account and contact data: email, phone, authentication identifiers, language, city, and security events.
- Marketplace data: profiles, business details, listings, photos, favorites, searches, messages, reports, reviews, and notifications.
- Verification data: submitted identity or business evidence, review status, reviewer notes, hashes, and audit records.
- Technical data: IP-derived security identifiers, device/browser information, cookies, request logs, error and performance data.
3. Purposes and legal grounds
- Provide accounts, listings, search, messaging, moderation, and requested marketplace services.
- Protect users, prevent fraud and abuse, enforce policies, and secure the service.
- Comply with legal duties and respond to valid authority or rights requests.
- Improve reliability and usability using necessary operational data; optional analytics require an appropriate consent or other lawful basis before activation.
4. Public data and recipients
Only approved public profile, store, listing, review, and trust fields are displayed publicly. Email, private phone fields, tax identifiers, verification documents, and internal moderation data are not public by default.
Service providers process data only to operate VENDO, including Supabase for database/authentication, Cloudflare for delivery and R2 storage, Typesense for search, and Upstash for rate limiting. Data may also be disclosed when required by law, to protect rights and safety, or during a properly controlled business transfer.
5. Retention
- Active account and marketplace content: while the account is active or the content is required to provide the service.
- Read notifications and resolved operational records: routinely expired according to the documented retention job.
- Fraud, moderation, security, and audit evidence: pseudonymized where possible and retained only as long as necessary, normally no more than 24 months unless law or an active case requires longer.
- User-initiated deletion: account identity, listings, messages, search records, and owned uploads are deleted; legally necessary operational evidence is detached from the account identifier.
6. Your choices and rights
The profile page lets you correct data, download a portable JSON copy, and permanently delete the account after password confirmation. You may also ask vendo88@proton.me for access, correction, deletion, restriction, or objection where applicable. VENDO may verify identity and may retain information required for legal claims, safety, or fraud prevention.
7. Security, transfers, and children
VENDO uses access controls, row-level database policies, encryption in transit, private evidence storage, staff MFA, rate limits, and audit logging. No system is risk-free; suspected incidents should be reported immediately.
Providers may process data outside Tunisia under contractual and technical safeguards appropriate to the service and applicable law. VENDO is for adults and is not directed to children under 18.