Privacy Policy
Last updated: July 2026
Vendly (vendly.com.mx) is a marketplace that helps you sell used items straight to your WhatsApp groups. This policy explains exactly what data we collect, why we specifically need it, who we share it with, and how you can exercise your rights over it — grounded in what the app actually does today, not generic boilerplate.
What we collect, and why
Account (email, password, name)
To create your account, verify your identity on login, and personalize your dashboard. Your password is handled securely by our auth provider (Supabase) — we never see it in plain text.
Public profile (username, bio, location, avatar, cover photo)
To build your public seller storefront — the page buyers see when you share your link.
Phone number
Only shown publicly if you explicitly turn it on (a consent toggle in your settings). We use it so buyers can reach you outside WhatsApp if you choose to allow that.
WhatsApp connection (QR-linked session)
We store the session credentials (not a WhatsApp password — this type of link doesn't use one) needed to keep the connection alive, post your listings to your groups, and relay buyer messages back to you. These credentials are stored encrypted and isolated per account.
Listing content (photos, title, description, price, status)
This is the content you choose to publish; it's shown on your storefront and shared to your WhatsApp groups when you trigger that.
Buyer replies and reservation (apartado) requests
To notify you when someone wants to reserve or buy an item. If you turn on optional AI-assisted reply detection, the text of that reply may be sent to Anthropic (a language-model provider) solely to classify whether it expresses buying interest — it's not used for advertising, and we don't share your whole account.
Language cookie (vendly.locale)
Remembers which language to show you based on your country or preference. It's not used for tracking or advertising.
Session cookies (authentication)
Keep you securely logged in while you use the dashboard.
Transactional email
We use Resend to send account confirmations, password resets, and replies if you contact support.
Who we share data with
We do not sell your personal data. We share it only with the providers that make the service work: Supabase (database, auth, storage), Resend (transactional email delivery), Anthropic (only if you enable automatic reply classification, and only the message text), and WhatsApp/Meta, since the connection runs through your own linked WhatsApp Web session and is also subject to WhatsApp's own terms.
Your rights
As a user in Mexico, you have the right to Access, Rectify, Cancel, or Object to the use of your personal data under the LFPDPPP. To exercise these rights, email soporte@vendly.com.mx. You can request full deletion of your account and data at any time.
How long we keep your data
For as long as your account is active. If you request account deletion, we delete or anonymize your personal data, including WhatsApp session credentials, unless the law requires us to keep a record longer.
Security
All communication is encrypted in transit (HTTPS). Access to your data is restricted by database-level security rules (Row Level Security), and each account's WhatsApp credentials are isolated from every other account.
Children
Vendly is not directed at anyone under 18, and we do not knowingly collect data from minors.
Changes to this policy
If we make a meaningful change to how we use your data, we'll reflect it on this same page along with an updated date.
Contact
Questions about your data? Email soporte@vendly.com.mx.