Privacy Policy

Last updated: March 2, 2026

Introduction

VendCom (“we,” “us,” or “our”) is operated by Aperna LLC, a company registered in Texas. This Privacy Policy explains how we collect, use, and protect your information when you use our website at vendcom.co and our vending management application (collectively, the “Service”).

Information We Collect

We collect the following types of information:

Account Information

When you create an account, we collect your email address, name, and role within your organization.

Business Data

Data you enter into VendCom, including machines, products, locations, suppliers, inventory levels, purchase orders, restocking events, stocker instructions, and trip schedules.

Telemetry Data

If you connect a telemetry provider (Nayax, Cantaloupe, HaHa, or NAMA VDI), we receive sales transaction data from your payment terminals, including sale amounts, timestamps, and selection codes.

Website Usage Data

We use Plausible Analytics on our marketing website. Plausible is a privacy-friendly analytics service that does not use cookies, does not collect personal information, and does not track users across websites. See the Analytics section below for details.

How We Use Your Information

  • To provide and operate the Service
  • To process and display your business data within the application
  • To send transactional emails (account verification, password resets, service notifications)
  • To provide customer support
  • To improve the Service based on aggregated, anonymized usage patterns

We do not sell your personal information. We do not use your data for advertising. We do not share your business data with other operators or third parties for their own purposes.

Data Security

We take the security of your data seriously and implement the following measures:

  • Your data is stored in a PostgreSQL database hosted by Supabase with encryption at rest
  • All data in transit is encrypted using TLS
  • Row-level security (RLS) isolates each operator's data at the database level — your data is invisible to other operators
  • Access to production systems is restricted and audited

No system is 100% secure. While we work to protect your information, we cannot guarantee absolute security against every possible threat. You are responsible for maintaining the security of your account credentials.

Analytics

We use Plausible Analytics on our marketing website. Plausible is a privacy-friendly analytics tool that:

  • Does not use cookies
  • Does not collect personal information or build user profiles
  • Does not track users across websites
  • Is compliant with GDPR, CCPA, and PECR

Because Plausible does not use cookies, no cookie consent banner is required.

Third-Party Service Providers

We share your information with the following service providers who process data on our behalf. These providers are contractually prohibited from using your data for any purpose other than providing services to VendCom.

  • Supabase — Database hosting and authentication
  • Plausible — Website analytics (cookieless)
  • Stripe — Payment processing (when billing is available)

We do not share your data with advertisers, data brokers, or any third party for their own commercial purposes.

Your Rights

Depending on your location, you may have the following rights regarding your personal information:

  • Right to know — You can request a summary of the personal information we hold about you
  • Right to delete — You can request deletion of your personal information and business data
  • Right to data portability — You can export your data in CSV format from within the application
  • Right to opt out of sale — We do not sell your personal information, so there is nothing to opt out of

To exercise any of these rights, contact us at team@vendcom.co. We will respond within 45 days.

Data Retention

We retain your business data for as long as your account is active. If you delete your account, we will delete your data within 30 days. Some data may be retained in encrypted backups for a limited period as part of our disaster recovery process.

Children's Privacy

VendCom is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via email or a notice within the application. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data, contact us at team@vendcom.co.

Aperna LLC (DBA VendCom)
Texas