Privacy Policy

1. Introduction

CereLume Technologies ("VendoNow", "we", "our", or "us") operates the VendoNow platform, including the VendoNow website (vendonow.com), the Vendo Customer mobile application, the Vendo Business mobile application, the Vendo Delivery mobile application, and the VendoNow Admin web application (collectively, the "Platform" or "Services").

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Platform. By using the Platform, you consent to the data practices described in this policy.

This Privacy Policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

2. Our Role in Data Processing

VendoNow operates in two distinct capacities with respect to personal data:

• As a Data Controller (Data Fiduciary): For data we collect directly from Platform users — including business owners, end customers, and delivery partners — for account registration, authentication, Platform operation, and our own business purposes.
• As a Data Processor: For end-customer data that Businesses collect, store, and manage through the Platform. In this context, the Business is the Data Controller (Data Fiduciary) and VendoNow processes such data solely on the Business's instructions to provide the Platform services. Businesses are responsible for obtaining appropriate consent from their end customers and complying with applicable data protection laws.

3. Information We Collect

3.1 Information You Provide Directly

Business Owners and Team Members:

• Full name, email address, and phone number
• Business name, type, address, and description
• Tax identification numbers (GSTIN, PAN)
• Business logo and payment QR code images
• Team member details (name, phone, email, role)
• Delivery partner details (name, phone, vehicle information)
• Product catalog, pricing, and inventory data
• Delivery time slot configurations
• Bank account or UPI details (for payment settlement)

End Customers:

• Full name, email address, and phone number
• Delivery address(es) including building/society details
• Subscription preferences, product selections, and quantities
• Order history and delivery instructions
• Security deposit information
• Payment information (processed through third-party payment providers)
• Communication history with the Platform and with Businesses

Delivery Partners:

• Full name, email address, and phone number
• Vehicle type and details
• Assigned delivery areas and routes
• Delivery completion records and timestamps
• Location data at the time of marking a delivery as completed (collected with app-based permission)

3.2 Information Collected Automatically

• Device information (type, operating system, app version, unique device identifiers)
• IP address and approximate location derived from IP
• App usage patterns, feature interactions, and navigation data
• Order, delivery, and transaction event data (timestamps, status changes)
• Error logs and crash reports (via Sentry for mobile apps)
• Push notification token (for Firebase Cloud Messaging)
• Website cookies and similar tracking technologies (see Section 9)

4. How We Use Your Information

We use the collected information to:

• Create, maintain, and authenticate user accounts across all Platform applications.
• Provide core Platform services: subscription management, delivery scheduling and tracking, invoicing, payment processing, inventory management, point-of-sale operations, purchase management, gate code management, and reporting.
• Enable Businesses to manage their customers, products, deliveries, payments, and team members.
• Enable End Customers to discover products, manage subscriptions, place one-time orders, receive deliveries, and view order history.
• Enable Delivery Partners to receive and manage delivery assignments, record delivery completion (including location verification), and track their delivery history.
• Send push notifications and alerts related to orders, deliveries, payments, reminders, and Platform updates.
• Process payments through integrated third-party payment providers.
• Detect, prevent, and investigate fraud, unauthorized access, and abuse of the Platform.
• Generate aggregated, anonymized analytics to improve the Platform and for business intelligence.
• Communicate with users for customer support, dispute resolution, and Platform-related announcements.
• Comply with legal obligations, enforce our Terms of Use, and respond to lawful requests from authorities.

5. Information Sharing and Disclosure

We may share your information in the following circumstances:

• Between Platform Users (as part of Service operation): End customer delivery details (name, address, phone) are shared with the Business they subscribe to and with the Delivery Partner assigned to their delivery. Business information is visible to their end customers. Delivery Partner details are visible to Businesses that engage them.
• Payment Service Providers: Payment information is shared with third-party payment processors to facilitate transactions. We do not store complete credit/debit card or UPI credentials on our servers.
• Service Providers: We engage third-party service providers for cloud hosting, database services, analytics, error monitoring, push notifications, and customer communication. These providers process data only on our instructions and are bound by confidentiality obligations.
• Legal Compliance: We may disclose information to government authorities, law enforcement agencies, or courts as required by applicable law, court order, or legal process.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. Users will be notified of any such change in ownership or control.

We do not sell your personal information to third parties. We do not use your personal data for advertising or marketing purposes unrelated to the Platform, unless you have explicitly opted in.

6. Location Data

The Vendo Delivery app collects precise location data from delivery partners' devices when a delivery is marked as completed. This data is recorded for delivery verification and record-keeping purposes. Location access is requested via standard mobile operating system permissions and is required for the delivery partner to use the app. Location data is shared with the relevant Business for delivery tracking purposes and is stored as part of the delivery record.

End customers and business users may optionally grant location permissions for address auto-fill or delivery address selection. This is not required for Platform use.

7. Data Security

We implement reasonable and appropriate security measures to protect your personal data, including:

• Encryption of data in transit using TLS/SSL.
• Encryption of sensitive data at rest.
• OTP-based authentication for all user types.
• JWT-based session management with token expiry.
• Role-based access controls and audit logging.
• Regular security reviews and updates.
• Limited employee access to personal data on a need-to-know basis.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

8. Data Retention

We retain personal data for as long as necessary to provide our Services and fulfill the purposes described in this Privacy Policy, or as required by applicable law. Specific retention periods:

• Account data: Retained while your account is active. Upon account deletion, personal data is deleted or anonymized within 30 days, except as noted below.
• Transaction and financial records: Retained for up to 7 years as required by Indian tax and accounting laws.
• Delivery records: Retained as part of transaction history for the duration of the Business's account.
• Anonymized/aggregated data: May be retained indefinitely for analytics and Platform improvement.

9. Cookies and Tracking Technologies

Our website (vendonow.com) and admin web application use cookies and similar tracking technologies to:

• Maintain user sessions and authentication state.
• Remember user preferences and settings.
• Analyze Platform usage and performance (via Google Analytics, where enabled).
• Ensure Platform security and prevent abuse.

You can control cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Platform.

10. Your Rights

Under applicable data protection laws, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data (Right to be Forgotten), subject to legal retention requirements.
• Data Portability: Request your data in a structured, commonly used, machine-readable format.
• Withdraw Consent: Withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Grievance: File a complaint with the Grievance Officer or the Data Protection Board of India.

To exercise any of these rights, please contact us at privacy@vendonow.com. We will respond to your request within the timeframe prescribed by applicable law. We may need to verify your identity before processing your request.

11. Children's Privacy

Our Platform is not intended for use by children under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information. If you believe a child has provided us with personal data, please contact us immediately.

12. Data Transfers

Your personal data is primarily stored and processed on servers located in India. Some service providers may process data in other jurisdictions. In such cases, we ensure appropriate safeguards are in place in compliance with applicable data protection laws.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, any grievances, complaints, or questions regarding this Privacy Policy or our data practices may be directed to our Grievance Officer:

Complaints will be acknowledged within 24 hours and resolved within 30 days of receipt.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify users of material changes by posting the updated policy on this page, updating the "Last updated" date, and, where appropriate, through in-app notifications or email. Continued use of the Platform after changes become effective constitutes acceptance of the revised policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: