Privacy policy — found from the homepage — Vendure

Cited by

Facts read from this source

• Entity Report an error

  “Elevantiq GmbH, trading as Vendure”

• Registered office Report an error

  “Registered office: Pass-Thurn-Straße 23, 6372 Oberndorf in Tirol, Austria”

• Privacy contact Report an error

  “Privacy and data protection requests: legal@vendure.io”

• Terms version Report an error

  “Version 2026-10-20, effective 20 October 2026.”

• DPA on hosting Report an error

  “If we access it to give support, or host it once Vendure Cloud launches, we act on our customer's behalf under a data processing agreement.”

• Stripe Report an error

  “Our payment processor, Stripe, collects and stores card details. We never see your full card number.”

• List Report an error

  “WorkOS: sign-in and identity management for Vendure Console and our portals, including sign-in and invitation emails.”

• List Report an error

  “Amazon Web Services (Amazon SES): sending account and billing emails from Vendure Console, from its Frankfurt region.”

• List Report an error

  “Vercel: hosting for our websites, portals and the Vendure Console interface (Vendure Console and its admin interface in Frankfurt).”

• List Report an error

  “Northflank: hosting for our application infrastructure, APIs and databases, in Frankfurt.”

• List Report an error

  “Twenty: customer relationship management, enquiries and related communication, hosted in the EU.”

• List Report an error

  “Loops: newsletter and marketing emails.”

• List Report an error

  “Google Workspace: email, documents, collaboration, video calls on Google Meet, and call recordings, transcripts and summaries with Gemini.”

• List Report an error

  “Anthropic (Claude) and OpenAI (Codex): AI assistants our team uses to work on support requests, under business terms that don't allow training on our data.”

• List Report an error

  “Sentry: error monitoring for our websites and Vendure Console, hosted in its EU region.”

• List Report an error

  “PostHog: website, documentation and Vendure Console analytics, hosted in its EU region.”

• List Report an error

  “Plausible: cookieless website analytics, hosted in the EU.”

• List Report an error

  “Dealfront (Leadfeeder): company identification for website visits, only with your consent.”

• List Report an error

  “OpenSanctions: sanctions list screening.”

• List Report an error

  “Linear: issue tracking, including support requests.”

• List Report an error

  “Slack: internal communication, including about support requests.”

• Transfers Report an error

  “United States (including Stripe, WorkOS, Loops, Vercel, Sentry, Google, Amazon Web Services, Linear, Slack, Anthropic and OpenAI): the EU-US Data Privacy Framework where the provider is certified under it, and otherwise the European Commission's standard contractual clauses.”

• UK transfer Report an error

  “United Kingdom (Northflank): the European Commission's adequacy decision for the UK.”

• VAT evidence Report an error

  “To determine where a customer is located for VAT, the law requires us to keep evidence.”

• Vies checks Report an error

  “When you enter an EU VAT number, we check it with the European Commission's VIES service.”

• Sanctions screening Report an error

  “We may check the names of our customers' companies and contacts against sanctions lists, using OpenSanctions.”

• No automated decisions Report an error

  “We do not make decisions about you based solely on automated processing.”

• Children Report an error

  “Our services are for businesses. We don't knowingly collect data from children under 16.”

• Retention records Report an error

  “Records of actions in Vendure Console, such as who changed a Subscription, issued a credential or accepted our terms: up to 10 years from the end of the year of the action, to prove our contracts and investigate misuse.”

• Retention invoices Report an error

  “Invoices and accounting records: 7 years (§ 132 BAO). Records of sales under the EU One-Stop-Shop: 10 years (Article 369k of Directive 2006/112/EC).”

• Retention tax evidence Report an error

  “Tax evidence: 10 years from the end of the year of the sale (Article 369k of Directive 2006/112/EC and § 132 BAO).”

• Retention licence checks Report an error

  “Licence check records: the IP address, forwarding headers and user agent for 12 months. The rest of the record, which contains no personal data beyond your environment credential, up to 10 years.”

• Retention posthog Report an error

  “PostHog keeps session recordings for 30 days, and event data as long as we need it to understand how our website and Vendure Console are used. Its cookie lasts one year.”

• Retention package downloads Report an error

  “Package download records: 7 days, and in our server logs for the short period described below.”

• Telemetry optout Report an error

  “You can switch telemetry off with the environment variable VENDURE_DISABLE_TELEMETRY=true, whether or not the installation is linked.”

• Framework telemetry Report an error

  “Vendure Framework, our open-source framework, sends usage statistics to Vendure about once a day: a random installation ID, software versions, basic system information, the database type, the names of installed plugins, and ranges of entity, order and customer counts.”

• Licence check not telemetry Report an error

  “VENDURE_DISABLE_TELEMETRY does not switch these off.”

• Rights Report an error

  “access your data; have it corrected or deleted; restrict its processing; withdraw consent at any time, without affecting processing before the withdrawal; and receive your data in a portable format.”

• Complaint authority Report an error

  “Austrian Data Protection Authority (Datenschutzbehörde)”

• Qu bec contact Report an error

  “Our contact for data protection, including as the person in charge of the protection of personal information under Québec law and as data protection contact under the Brazilian LGPD and the Singapore PDPA, is our managing director, reachable at legal@vendure.io.”

• No data sale US Report an error

  “United States. We don't sell personal data or share it for cross-context behavioural advertising.”

• Support access logged Report an error

  “our support team may access your Vendure Console account. Every such access is logged, and the log names the team member.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The B2B Seller Tax & German legal correctness
• The B2B Seller European sovereignty
• The Data Protection Officer Tax & German legal correctness
• The Data Protection Officer Data ownership & exit
• The Data Protection Officer European sovereignty
• The Developer Tax & German legal correctness
• The Developer Data ownership & exit
• The Developer European sovereignty
• The Merchant Tax & German legal correctness
• The Merchant European sovereignty
• The Operations Lead European sovereignty
• The Skeptic European sovereignty