Privacy Policy
Version 1.3 — Effective 4 August 2026 · Last reviewed: 4 August 2026
1. Who We Are
VendoAU ("we", "us", "our") is an online classifieds marketplace operated from Australia. Registered to: Ganesh Sivakumar, ABN 31 770 293 133.
Privacy contact: privacy@vendoau.com.au
2. What Personal Information We Collect
We collect the following personal information:
Permissions the VendoAU app asks for
The Android app asks your permission for three things: camera, microphone and notifications. Each is requested only at the moment you use the feature that needs it, and you can refuse or revoke any of them in your device settings — the rest of the app keeps working. It also holds a few permissions Android grants automatically and never prompts about, because they are not privacy-sensitive: network status, keeping the screen awake, receiving push messages, and using your device's fingerprint or face unlock if you switch that on. The app does not request location, contacts, storage, photo-library, SMS, call-log or phone access. Nothing is collected while the app is in the background.
3. How We Use Your Information
We use your personal information to:
- Operate and improve the Platform;
- Verify your identity and age;
- Process payments via Stripe;
- Send transactional emails (account, listings, security);
- Send marketing emails (only if you opted in);
- Detect and prevent fraud and abuse;
- Comply with legal obligations under Australian law;
- Respond to support requests and complaints;
- Improve our services through analytics.
4. Who We Share Your Information With
We share your information with the following trusted service providers:
🔒 We NEVER sell your personal information to third parties.
5. Data Retention
We retain your personal information for the following periods:
| Data type | Retention period | Reason |
|---|---|---|
| Account data (name, email, phone) | While account is active | Service operation |
| Listing details & photos | 30 days after the listing is removed | Dispute resolution |
| Messages (declined chat requests) | 7 days | Nothing to keep |
| Messages (completed deals) | Hidden at 90 days, deleted at 120 | Buyer protection |
| Signed-in sessions | 30 days after last activity | Account security |
| Financial records & sale agreements | 7 years | Corporations Act / ATO |
| Security logs (low/medium) | 1 year | Platform security |
| Security logs (high/critical) | Indefinitely | Fraud prevention |
| Banned user records (fraud, child safety) | Indefinitely | Online Safety Act 2021 |
Some information does not yet have a fixed deletion date. We keep it only while your account is open, and it is removed when you delete your account (see Section 6):
- Government ID images and verification records;
- Bank and PayID payout details;
- Trade licence and accreditation documents;
- Résumés and job application attachments;
- Handover and delivery confirmations recorded against a SafePay transaction;
- Sign-in history and technical error logs.
If you want any of these removed sooner, email privacy@vendoau.com.au and we will delete them unless we are legally required to keep them.
6. Your Privacy Rights
Under the Australian Privacy Act 1988, you have the right to:
- Access your personal information — available in your dashboard;
- Correct inaccurate personal information — update via Settings or contact us;
- Delete your personal information — use the account deletion feature in Privacy & Data settings (subject to legal retention requirements);
What deleting your account actually does
Your account is permanently disabled and every personal detail on it — name, email, phone, address, date of birth — is erased. Records we must keep by law remain attached to an anonymous account that can no longer be used.
Your government ID images, bank and PayID details, trade licence documents and résumés are deleted. Your listings and their photos are removed — where a listing is attached to a completed sale we must keep, the listing is emptied of your details instead.
Payment records and sale agreements are kept for 7 years as Australian tax law requires, and fraud, safety and ban records are kept under the Online Safety Act 2021.
Two kinds of file are kept rather than deleted, because they are part of a transaction record that is not yours alone: photos taken as proof of a SafePay handover, which are also the other party's evidence that the handover happened, and videos recorded as proof on a deal, which are held by our video host (Cloudflare Stream). Neither is removed when you delete your account.
- Download a copy of your data — available from Privacy & Data settings;
- Opt out of marketing emails — unsubscribe link in every marketing email, or via Settings;
- Complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
To exercise any of these rights, visit your Privacy & Data page or contact: privacy@vendoau.com.au
8. Security
We take reasonable steps to protect your personal information from misuse, loss, and unauthorised access. Security measures include:
- HTTPS encryption for all data in transit;
- Bcrypt password hashing (passwords are never stored in plain text);
- Row-level security on all database tables;
- IP blocking and rate limiting to prevent brute force attacks;
- Regular security monitoring and audit logging.
9. Cross-Border Data Transfers
Some of our service providers (Supabase, Stripe, Vercel, Cloudflare) may store data in data centres outside Australia. We only use providers with adequate data protection standards consistent with the Australian Privacy Principles.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email at least 14 days before taking effect. Continued use of the Platform constitutes acceptance.
11. Contact for Privacy Matters
Privacy enquiries: privacy@vendoau.com.au
General support: support@vendoau.com.au
OAIC (external complaint): oaic.gov.au