Privacy notice
Draft. Pending legal review.
Who this covers
VendoBird is scheduling and booking software used by service businesses. Two different groups of people have data here: the staff of a business that uses VendoBird, and the customers of that business, whose bookings it records.
To confirm: The trading entity, its registered address, and whether it acts as controller or processor for each group above. A business using VendoBird is usually the controller of its own customers’ data.
What is collected
Account and staff: name, email address, phone number, role, and a password held by the authentication provider rather than by us. Staff records may also include a home or current location, skills, working hours and time-off requests, including any document attached to a leave request.
Customers of the business: name, email address, phone number, service addresses, and the bookings, prices and payment status recorded against them. Photographs attached to a job are stored where the business uploads them.
Automatically: ordinary server logs, and session cookies needed to keep someone signed in.
Why
To provide the service: authenticating users, scheduling and dispatching work, taking bookings through a business’s public booking page, pricing and invoicing, and showing the business its own operational and revenue reporting.
To confirm: The lawful basis for each purpose. Consent is not automatically the right basis for running a service someone has asked for, and a notice is not a substitute for choosing and documenting one.
Who it is shared with
These are the processors the application actually sends data to:
- Supabase: authentication, the database, and file storage for job photos and leave documents.
- OpenAI: only for the optional AI features (the daily briefing, pricing suggestions and revenue advice). These run when someone asks for them, and only while a business has AI switched on in Settings. Job titles, staff first names and scheduling figures are sent as part of the request.
- Google Maps and Routes: map display and driving estimates for dispatch. Job locations are sent to generate them.
- Stripe: where a business has connected payments.
- Vercel: hosting, and therefore server logs.
To confirm: Where each processor stores data, whether any data is transferred between countries, and the safeguard relied on if so. Processor agreements should be in place with each.
How long it is kept
To confirm: Retention periods, per record type. Bookings, job photos and leave documents are each likely to differ, and deleted files need a confirmed removal path from storage as well as the database.
Your rights
Under the data protection law where you live you can ask for a copy of your data, ask for it to be corrected or deleted, object to certain processing, and complain to your local data protection authority.
If your data is here because you booked with a business that uses VendoBird, that business is normally the right first point of contact.
To confirm: The address a rights request should be sent to, and who answers it within the statutory month.