Privacy Policy

Last updated: 2026-10-30

VendorBot ("we") runs VendorBot, a service that lets shops answer customers and take orders on Telegram, Instagram, Facebook and WhatsApp. This page explains what data we handle and why. We follow the principles of Ghana's Data Protection Act, 2012 (Act 843).

What we collect

• Shop owners: Telegram ID and name, shop details, products, order history, subscription payments, and the access tokens needed to connect your channels (stored encrypted).
• Shops that accept crypto: the wallet addresses they choose to publish to buyers (public by nature) and our approval decision.
• Customers of a shop: the name your chat app shows, your messages to the shop, orders, and the phone number and delivery location you send to place an order. If you order on a shop's web page we also receive the name, phone, address and note you type, and the country your browser or phone number suggests (used only for the shop's statistics).
• Photos and voice notes a customer sends to a shop that uses our Pro plan are processed by an AI service (Google Gemini) only to read or transcribe them. We keep the resulting text, not the file.

Why we use it

To run the shop's bot, process orders and payments, send order updates, remember returning customers, and keep the service secure. We do not sell personal data.

Who receives it

• The shop you order from (it is the owner of your order details).
• Paystack, which processes card and Mobile Money payments. We never see your card number.
• Meta (Instagram, Facebook, WhatsApp) and Telegram, which carry the messages.
• AI providers (such as Google Gemini, Groq, Anthropic) that help write replies. Phone numbers, emails and names are removed from text sent to free AI providers where possible.
• Our hosting provider (Railway).

How long we keep it

Security log: to prevent fraud and abuse we keep a log of sign-ups, sign-ins (IP address and device type), payout and crypto-wallet changes and account deletions. It does not contain customer messages, passwords or keys, and it is kept for up to 18 months even after an account is deleted.

Order and customer records stay while the shop's account exists. Shops can delete customers at any time, and any customer can ask to be forgotten (see below).

Security

Connections use HTTPS; channel tokens are encrypted at rest; dashboard sign-in uses one-time links confirmed on Telegram; payment and webhook callbacks are signature-checked. No system is perfectly secure; tell us promptly if you suspect a problem.

Your rights

You may ask to see, correct or delete your data. Customers can send delete my data to the shop's chat at any time. See how to delete your data. Questions: the platform owner (message the bot).