How Vendrix handles your data.
What we collect from the accounts a business connects, how the assistant uses it, who helps us run the service, and how to have it removed.
Last updated October 12, 2026
Who we are
Vendrix is a service for small businesses that sell and talk to customers through WhatsApp, Instagram, Facebook Messenger and similar channels. A business (our customer, "the business") connects its accounts to Vendrix; Vendrix reads the messages and comments those accounts receive, helps the business answer them, and keeps its orders and customer notes in one place.
For the messages and customer details a business brings into Vendrix, the business decides why and how they are used and Vendrix processes them on its behalf. For the business owner's and team members' own account data, Vendrix decides.
What we collect
- Account data: the name and email of the people who sign in, the workspace they belong to, and their role.
- Connection data: when a business connects WhatsApp, Instagram, Facebook or TikTok we receive access tokens, the identifiers and display names of the connected accounts and pages, and the permissions granted.
- Conversation data: the text of messages and public comments the connected accounts receive, the sender's name or handle and, on WhatsApp, phone number, the time of each message, and delivery status. Pictures and voice notes are described or transcribed so they can be understood.
- Customer and order data the business records: names, phone numbers, notes, remembered preferences, orders, payment status, delivery details.
- Usage data: technical logs, errors, and measurements needed to run and secure the service.
How the AI uses it
Vendrix can draft or send replies on behalf of the business. To do that, the text of the conversation and the business's own catalogue and instructions are given to AI language models run by third-party providers acting for us. Each business chooses, per channel, whether replies are sent automatically, drafted for approval, or switched off. The first automated message to someone on Instagram or Messenger says they are chatting with the business's assistant.
Replies to public comments never contain a customer's private details (phone number, order, notes); where a person needs private help the reply invites them to send a direct message. Messages from people who ask for a person are handed to the business's team.
Data we receive from Meta and TikTok
We use Meta's platforms (WhatsApp Business, Instagram and Facebook) only to provide the features a business turned on: receiving and sending messages, reading and answering comments, publishing posts and reading their performance. We use the data only for that business, we do not sell it, and we do not use it for advertising or to build profiles across businesses.
How we protect it
Names, phone numbers, message text and notes are encrypted before they are stored. Each business's data is separated from every other's by the database itself, not only by the application. Access tokens are stored encrypted and never written to logs. Payments are confirmed with the payment provider, never from a customer's browser.
How long we keep it
A business's data is kept while its workspace is active. Operational records (such as finished jobs and delivery attempts) are removed after a retention period. When a business deletes its workspace its data is deleted. A business can erase a single customer's data on request.
Your rights and how to use them
If you wrote to a business that uses Vendrix, the business is the first place to ask to see, correct or delete your data; we help it do so. You can also write to us and we will pass the request on or act on it if we can identify the business.
If you connected an account to Vendrix and want your connection and what we kept about it removed, follow the steps on the data deletion page. Removing Vendrix from your Facebook or Instagram settings does this automatically.
Contact
Write to support@vendrix.net about anything in this policy. We update it when the product changes; the date at the top says when it last did.