Vendi Legal

Privacy Policy

Effective August 25, 2026

1 · Who Vendi is

Vendi is an AI-assisted work and communication platform for professionals and businesses, operated by Vendi Inc., a company registered in Ontario, Canada. This policy describes how Vendi collects, uses, shares, and protects information. It applies to vendi.so and the authenticated Vendi application.

2 · Scope

This policy covers information Vendi handles when you visit vendi.so, when you create a Vendi account, and when you connect one of the supported integrations: Gmail and Google Calendar (via our authorized provider Nylas), WhatsApp Business (via Meta), and AI Phone (via Twilio). Instagram, Personal WhatsApp, Shopify, Klaviyo, Meta Ads, Gorgias, Telegram, TikTok, and marketing-campaign automation are not supported by current Vendi and are outside the scope of this policy.

3 · Information you provide directly

Account and authentication information, such as your email address and any authentication identifiers or credentials Vendi stores for accounts that use them (for example, a hashed password for email-and-password sign-in); accounts that authenticate through a third-party provider or a magic-link may not have a Vendi-stored password.
Business/professional profile information you provide.
Support communications you send to Vendi.
Content you post inside the Vendi application (notes, tasks, drafts).

4 · Google Workspace and Google User Data

If you connect a Google account through the authorized Nylas connector, Vendi receives a scoped grant that lets Vendi:

Gmail: read messages in your mailbox, send messages you author or approve, and modify labels/read state where required to keep the inbox usable.
Google Calendar: read calendars and availability/free-busy for context. Current Vendi V1 does not create, update, or delete calendar events.

Vendi uses this Google information solely to provide the requesting user's Vendi features, including:

displaying relevant email communication in the Unified Inbox;
understanding communication context;
generating user-facing summaries and reply drafts;
sending replies you authorise;
organising inbox workflow and highlighting commitments;
using calendar availability to inform scheduling context.

Vendi's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Vendi processes Google Workspace user data to provide the requesting customer's Vendi features. Vendi does not sell Google user data, does not use it for advertising, and does not transfer it to data brokers. Vendi does not use Google Workspace user data to develop or improve Vendi's own generalized AI/ML models. Where Vendi uses third-party AI providers to deliver these user-facing features, Vendi transmits only the minimum content required for the requested feature and relies on the provider's applicable API terms.

5 · WhatsApp Business and Meta

When you connect a WhatsApp Business number through Meta's Embedded Signup, Vendi may process:

WhatsApp Business Account identifiers and connected business phone information;
customer/contact identifiers you correspond with (typically phone numbers);
message content, timestamps, and supported attachment/media metadata;
provider message IDs and delivery/read/failed status;
connection metadata supplied through Meta.

Purposes:

displaying WhatsApp conversations in the Unified Inbox;
communication context and AI-assisted summaries/drafts;
sending replies you authorise;
workflow and responsibility tracking (who needs to reply next);
delivery verification and troubleshooting.

Vendi supports WhatsApp Business only, via Meta's official Cloud API. Vendi does not support Personal WhatsApp, does not perform campaign/broadcast automation, does not offer comment-to-DM, and does not integrate Instagram messaging. You remain responsible for lawful communication and for the consent of the recipients you contact.

6 · AI Phone

Where AI Phone is enabled for your account, Vendi may process caller phone information, call metadata (start/end/direction), call transcripts and audio, call outcomes, and AI-generated context (summaries, tasks). You and the business you represent remain responsible for complying with applicable call-recording notice and consent laws in the jurisdictions where calls are made or received.

7 · AI processing

Vendi uses AI systems to provide user-facing features including summarisation, reply drafting, classification, intent/context understanding, extraction of commitments and tasks, and other communication-assistance features that Vendi exposes in the product. AI-generated output is a suggestion and may be inaccurate; you remain responsible for reviewing and authorising any outbound communication or action. Vendi processes connected communication content only to provide these features to the requesting customer.

8 · Connector credentials

To operate a connected integration Vendi stores the OAuth or provider credential the integration requires. Meta WhatsApp Business credentials are stored encrypted at rest with tenant-scoped isolation. Other provider credentials are stored using safeguards appropriate to the credential and the provider.

9 · Technical, security, and log information

Vendi collects operational information necessary to keep the service running and secure, including IP address, browser and device information, session tokens, rate-limit identifiers, and diagnostic logs of application events. These are retained for security, abuse prevention, and troubleshooting.

Vendi shares information with the service providers strictly required to run the service. The current list — with the role each one plays — is published at vendi.so/subprocessors. Vendi does not sell personal information and does not disclose personal information to advertising or credit-scoring providers.

11 · Retention, disconnection, and deletion

You may disconnect supported integrations through the controls Vendi makes available for that integration. Disconnecting stops Vendi from using that connection for new processing. The exact effect varies by provider; some provider or connector records may remain in a disabled or disconnected state for security, operational, or record-keeping purposes. See our Data Deletion Instructions for channel-specific details. You can request deletion of your entire Vendi account by following vendi.so/data-deletion. Some data may be retained where required for security, legal, tax, fraud prevention, or billing. Data that remains inside the third-party service (for example, messages inside your Gmail mailbox or your WhatsApp Cloud API history) must be deleted from that provider directly — Vendi cannot delete it on your behalf.

12 · Cookies and similar technologies

Vendi's public website and application use essential session, preference, and security storage only. Vendi does not deploy third-party advertising or cross-site tracking cookies on vendi.so. Details are at vendi.so/cookies.

13 · Security

Vendi implements administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption of provider credentials at rest and tenant-isolated storage of communications. No system is perfectly secure; if Vendi becomes aware of a confirmed personal-data breach affecting Customer data, Vendi will notify affected customers as described in the DPA.

14 · Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal information Vendi holds about you, and to object to or restrict certain processing. To exercise these rights, contact sales@vendi.so. If a business you interact with uses Vendi, please contact that business directly — Vendi processes their customer data on their behalf.

15 · International processing

Vendi Inc. is registered in Ontario, Canada. Personal information may be processed in Canada, the United States, and other regions where Vendi's service providers or subprocessors operate.

16 · Children

Vendi is a business-to-business service. Vendi is not directed to children under 18 and does not knowingly collect personal information from children under 18. If you believe a child has provided personal information to Vendi, contact sales@vendi.so.

17 · Changes

Vendi may update this policy from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, by notifying account holders in-product.

18 · Contact

Vendi Inc., Ontario, Canada · Contact: sales@vendi.so.