Privacy Policy
Effective August 10, 2026
VendiQ is operated by Pivtl LLC, a company registered in Georgia ("VendiQ," "we," "us," or "our"). You can reach us at support@pivtl.io. This Privacy Policy explains what information we collect when you use VendiQ, why we collect it, and who we share it with.
Information we collect
Account information. When you sign up, we collect your email address, password (stored as a salted hash by our authentication provider, never in plain text), business name, phone number, business type (market vendor or appointment-based), whether you operate at multiple locations, and your estimated monthly volume tier.
Business financial data. If you use Backroom, we collect the receipt images you upload or text in, and the line items extracted or entered from them (supplier, amount, cost category). If you use Events Hub, we collect the event/Setup details you enter (name, location, start and end times) and any point-of-sale data you connect (currently Square; Clover and Toast integrations are planned). If you use Go, we collect the content of text messages and photos you send to log expenses, sales, or receipts, and the phone number you send them from.
Payment information. Subscription payments are processed by Stripe. We do not collect or store your full card number — Stripe handles that directly and shares with us only what's needed to manage your subscription (e.g., plan tier, subscription status, last four digits of your card for display purposes).
Usage data. We log how many receipt scans and text messages you send each month (to enforce plan limits) and basic technical information (browser type, device type, general usage analytics) to keep the service running and improve it.
Text messaging (SMS) communications
If you provide a phone number and check the SMS-consent box at signup, you agree to receive text messages from VendiQ related to logging expenses, receipts, and sales (this is a core part of the Go feature, not marketing). Message frequency varies based on how often you text in. Message and data rates may apply. Reply STOP at any time to opt out of text messages, or HELP for help. We are not liable for delayed or undelivered messages caused by your carrier. Carriers are not liable for delayed or undelivered messages.
How we use your information
We use the information above to: provide and operate the service (parsing receipts, matching expenses to events, calculating your profit/loss); process payments and manage your subscription; send you service-related communications (confirmations, receipts, account notices); enforce usage limits tied to your plan; and improve the accuracy of our automated tools.
Who we share information with
We do not sell your personal information. We share it only with the service providers (subprocessors) that help us run VendiQ, each bound by their own data-protection obligations:
- Stripe — payment processing and subscription billing.
- Supabase — our database, authentication, and file storage provider (receipt images are stored in a private, per-account storage bucket).
- Twilio — delivers and receives the text messages and calls used by Go.
- Anthropic — processes receipt images and message text you submit, using AI, to extract line items and classify expenses. We instruct Anthropic's models to treat this content as data to analyze, not as instructions.
- Square (and, as they come online, Clover and Toast) — point-of-sale providers you may optionally connect to import your sales data.
- Vercel — hosts the VendiQ application.
We may also disclose information if required by law or to protect the rights, safety, or property of VendiQ or others.
Data retention
We retain your account and business data for as long as your account is active, so your profit/loss history stays intact. You can delete your account anytime from Settings → Danger zone. Deletion is scheduled for the end of your current billing period, not immediate — you keep full access (and can download a copy of your data) right up until then. After that date, your account and all associated data are permanently erased, except where we are required to retain records (e.g., for tax or legal purposes).
Your rights and choices
You can access and update most of your account information directly in Settings, and download a copy of your business data anytime from there as well. You can opt out of text messages at any time by replying STOP. You can delete your account and data directly from Settings → Danger zone, or — if you're unable to access your account — by emailing support@pivtl.io. If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information we collect and to request its deletion — both options above cover these requests.
Security
We use industry-standard safeguards to protect your data, including encryption in transit, per-account access controls on stored files and database records, and signature verification on inbound webhook traffic (Stripe and Twilio). No method of transmission or storage is 100% secure, but we work to protect your information using commercially reasonable means.
Children's privacy
VendiQ is intended for business owners and operators. It is not directed at, and we do not knowingly collect information from, anyone under 18.
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the app before they take effect.
Contact us
Questions about this policy? Email us at support@pivtl.io.