Venduli Privacy Policy
Operator and contact
Venduli is operated by ARA Management Group. For privacy requests or security concerns, contact [email protected] or use our privacy request form. Store merchants operate their own storefronts and are responsible for their own customer communications and privacy notices.
Information we process
We process merchant and customer account details, store configuration, product and order information, shipping addresses where provided, support and privacy requests, authentication records, and security logs. When a merchant authorizes TikTok Shop, we store authorization tokens and seller identifiers for that merchant’s store. TikTok product and order synchronization is not enabled yet. We do not store raw payment card numbers or CVV.
Why we process it
We use information to provide stores, authenticate users, manage enabled commerce and shipping features, support merchants, respond to requests, prevent abuse, and meet applicable obligations. We do not sell customer personal data. TikTok information is used only for authorized integration functions, not unrelated advertising or model training.
Providers and locations
Services may involve Microsoft Azure hosting and databases, Cloudflare delivery and asset storage, Stripe payments, authorized shipping carriers, and TikTok Shop. The application is hosted in Azure Central US, United States. Cloudflare and other providers may process traffic or service data in additional countries according to their services and configurations; a complete location inventory is still being verified. We do not represent that every category is stored exclusively in the United States.
Cookies and marketing
Session cookies support sign-in and account security. Storefront features may use browser storage for preferences, favorites, carts, and popup display frequency. Merchants must disclose any additional analytics or marketing integrations they enable. Creating an account does not itself authorize promotional email or SMS.
Retention and deletion
We retain data for the service purpose and applicable obligations. Our contract-end deletion procedure targets removal from active systems within 30 days of a verified instruction, subject to documented obligations or holds. Backup expiration and deletion must be verified against provider settings. Our app does not yet automatically erase all orders, carrier records, third-party data, and backups. Customer self-service export and deletion cover their registered account profile and sessions; order records are handled through a separate verified request.
Your requests
Use the request form for access, correction, deletion, or questions. We verify identity proportionately and coordinate with the relevant merchant. We do not release records solely because someone supplies an email address. We target acknowledgment within five business days and response within 30 days, subject to applicable requirements. Requests are saved for owner review; the form does not automatically email a confirmation.
Security and accountability
We use store-scoped access checks, password hashing, encrypted integration-token storage, HTTPS, and required authenticator verification for management access. These measures reduce risk but do not guarantee against every incident. No independent ISO, SOC 2, or ePrivacy certification is claimed, and no formal Data Protection Officer has been designated.
Updates
This policy is version 1.0, effective October 11, 2026. We review it quarterly and after material service changes. The next scheduled review is January 11, 2027. Material revisions will be published with their effective date.