Privacy Policy

VendInventory is run by VendInventory (Toronto, Ontario, Canada). This page explains what personal information the VendInventory website and its driver app collect, what it is used for, and what choices you have. “We” means VendInventory.

1. Two kinds of information

• Information about our customers. When a business opens an account with us, we hold information about that business and its owner. We decide how that is handled, and this policy describes it.
• Information our customers put into their accounts. A vending operator who uses VendInventory enters information about its own staff, drivers, locations and customers. The operator decides what is entered and why; we keep and process it for the operator. If you are a driver, an employee or a customer of an operator who uses VendInventory and have a question about your information, please ask that operator first.

2. What we collect

• When you register: the name of your company, your name, your email address, your phone number if you give it, your time zone and currency, and your password. The password is stored in a scrambled form that cannot be read back, not even by us.
• Users you add: each person’s name, email address, role, what they may see, and the time they last signed in.
• What you record in the system: products and their costs, locations and their addresses, machines, planograms, trips, visits, counts, cash collected, items written off, mileage, tasks, notes, and the photos and files you attach.
• The location of a driver’s phone, when the operator uses that feature: an operator can have “Live driver location” switched on for its account. The driver app then records where the phone is during a trip only: from the moment the driver enters the start mileage until the moment the end mileage is entered, and only while the app is open on the phone’s screen. The app tells the driver when this is happening, and the phone asks the driver to allow it. The positions are shown to the operator’s owner and administrators, are not used for anything else, and are deleted after 30 days. The times at which a trip’s start and end mileage were entered are kept with the trip.
• Sales from card readers: for each sale, the machine, the time, the amount, the selection, whether it was cash or card and, when the reader sends them, the last four digits of the card. We never receive or store full card numbers.
• Problem reports from a machine’s QR sticker: what the person writes about the problem and, only if they choose to give them, their name and a way to reach them. This goes to the operator of that machine.
• Technical information: a sign-in cookie (see section 3); and, to stop robots from opening accounts, the internet address a registration came from, which we keep only as a scrambled value that cannot be turned back into the address. The company that hosts the website keeps ordinary server logs.

3. Cookies

The website uses one kind of cookie: the cookie that keeps you signed in. It is needed for the service to work. We do not use advertising cookies, tracking cookies or visitor statistics services.

The driver app also keeps a driver’s trips and the work not yet sent in the storage of the phone’s browser, so that it can be used where there is no signal. That information stays on the phone until it is sent to the driver’s own account.

4. What we use it for

• To provide the service: to show each account its own data and to do what its users ask.
• To contact the owner of an account about the account: the trial, payment, changes to the service, and answers to requests.
• To send the alert emails an account has switched on.
• To keep the service safe and working, and to find and fix faults.
• To meet legal obligations.

We do not sell personal information, and we do not use the information in your account for advertising.

5. Who else receives information

• Our hosting company stores the website and its database on its servers.
• Our email provider carries the emails the service sends.
• Map services. When an operator looks up the address of a location, the text of that address is sent to the address-search services of OpenStreetMap (Nominatim) and Komoot (Photon). When a map is shown, the pictures of the map are loaded from OpenStreetMap, which sees the internet address of the device showing the map. A “directions” link opens Google Maps with the address of the location.
• Amazon Web Services. Sales from Nayax card readers are delivered by Nayax to a message queue we rent from Amazon Web Services in the United States (Ohio). A sale waits there until our website has read it, normally about a minute and never longer than 14 days, and is then removed from the queue. Sales from other card readers do not pass through it.
• Card-reader companies send sales to us; we do not send your information to them.
• Authorities, when the law requires it.

6. Where information is kept

Information is kept on the servers of our hosting company. Those servers may be located outside Canada, in which case the information is also subject to the laws of the country where they are.

7. How long we keep it

• We keep the information of an account for as long as the account exists.
• The positions of a driver’s phone (see section 2) are deleted 30 days after they were recorded.
• An account that is paused, because its trial or its paid period has ended, is not deleted: its data is kept so that the owner can continue.
• When the owner asks us to close an account and delete its data, we delete it, except for what the law requires us to keep, such as records of payments.

8. How we protect it

• The website is reached over an encrypted connection.
• Passwords are stored in a scrambled form.
• Each account is kept separate from every other account.
• Inside an account, the owner decides what each user may see.

No system is perfectly safe. If something happens to your information that creates a real risk of serious harm, we will tell the people concerned and the authorities as the law requires.

9. Our own access to accounts

To help a customer who asks, to fix a fault, or to keep the service safe, an administrator of ours can open a customer’s account and see what its users see. Every such visit is recorded.

10. Your choices

• You can see and correct most of your information yourself, in your account.
• You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete your account.
• If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

11. Children

The service is for businesses. It is not meant for children, and we do not knowingly collect information from them.

12. Changes to this policy

When we change this policy, the new version is put on this page with the date it was last updated. If a change is important, we will tell the owners of accounts by email.

13. Contact

For any question about your information or this policy, use the contact address shown at the foot of our home page.