1. Overview & Scope
VendyPal, Inc. (“VendyPal,” “we,” “our,” or “us”) provides an enterprise field operations platform, mobile driver application, and inventory intelligence software for vending machine operators and unattended retail fleets. This Privacy Policy discloses our data collection, usage, and retention practices across our web platform and our native mobile applications for iOS (Apple App Store) and Android (Google Play Store).
2. Mobile Device Permissions & Hardware Access
In accordance with Apple App Store Review Guideline 5.1.1 and Google Play Developer Policies, VendyPal only requests device hardware access strictly necessary for field operations:
Used solely to scan product UPC barcodes on warehouse and van shelves, read machine asset QR codes, and document before/after restock checkpoints or broken machine hardware.
Used exclusively when a field driver or technician presses the record button to dictate maintenance observations. Voice memos are transcribed into text tickets; audio is not used for surveillance.
Used while the app is in foreground to verify arrival at scheduled route stops, identify the closest vending machine digital twin, and calculate route sequence progress. Location tracking stops when the app is closed.
Used solely when the user manually selects and uploads existing facility photos, receipts, or maintenance tickets from their device gallery.
3. Machine Telematics & DEX Telemetry
VendyPal processes EVA-DTS telemetry records delivered via card reader gateways (such as Nayax and Cantaloupe). Telemetry contains motor vend counters, cash tube balances, and cashless settlement totals. All machine sales and inventory data remain the sole proprietary property of the customer tenant.
4. Data Storage & Security
All customer data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. We utilize enterprise-grade sub-processors including Supabase (PostgreSQL), Cloudflare, and Vercel for isolated cloud infrastructure. Media uploads are stored in private storage buckets accessible only via time-limited signed URLs.
5. Your Rights & Account Deletion
Under CCPA/CPRA, GDPR, and Apple App Store Guideline 5.1.1(v), you have the right to access, export, or permanently delete your account and personal data. To initiate account deletion, visit our Data Deletion Request Page or email privacy@vendypal.com.
6. Contact Information
For questions regarding this policy or our data practices:
VendyPal, Inc.
Email: privacy@vendypal.com
Support: vendypal.com/support