Privacy policy

What VendorDeck collects when you install and use it, what we use it for, who receives it and how long we keep it.

Last updated: 19 October 2026

VendorDeck is a Shopify app that gives each brand a store sells its own page, plus an A-Z brand directory. This policy explains what VendorDeck collects when a merchant installs and uses it, what we use it for, who receives it and how long we keep it.

VendorDeck is provided by Iosif Chatzimichail, trading as Reach, in Kos, Greece (“we”, “us”). For any question about this policy or your data, email support@vendordeck.app.

What VendorDeck collects

From your store, through Shopify

When you install VendorDeck, Shopify gives it access to the parts of your store you approve on the install screen. VendorDeck stores:

• Your store’s identity: its myshopify.com address and Shopify’s ID for it, and the access token VendorDeck uses to work with your store, encrypted in our database. VendorDeck doesn’t read your store’s contact details, such as your name, email address, phone number or address.
• Brands: the vendor names on your products and how many products each one has. These become your brands.
• Pages: the addresses and IDs of the brand and directory pages VendorDeck creates in your store.
• Your theme: its name, whether its page templates contain VendorDeck’s blocks, and whether VendorDeck’s blocks and app embeds are turned on. VendorDeck only reads your theme and never changes it.
• Images: the addresses of the logos and banners you upload through VendorDeck. The images themselves go to your store’s Content > Files.
• Your plan: which VendorDeck plan you chose. Shopify bills the plans and tells us which one you’re on.

VendorDeck also reads data from your store that it keeps for an hour at most, in a cache, or not at all: the titles, prices and images of the products on brand pages, your store’s languages for translations, and the brand pages’ existing content when it updates them.

VendorDeck has no access to your customers, orders or payments.

What you enter in VendorDeck

Each brand’s display name, descriptions, logo, banner, website, page title and meta description, its translations, which brands are featured or hidden, and your settings, such as colors, fonts, page addresses and your default AI writing tone.

AI-generated text

VendorDeck only uses AI when you click Generate (or Try again) for a brand or start a bulk generation, or, if you turn on Write content for new brands in Settings > AI content, when a new brand is added. It then sends one of the providers that run the AI models, Anthropic or, when Anthropic can’t answer, Groq:

• for descriptions: the brand’s name, its number of products and up to five of its product titles;
• for the page title and meta description: the brand’s name and the first 500 characters of its description.

It sends nothing about your store or your customers. VendorDeck keeps the text that comes back, and a record of each generation (what was sent, the result, the provider and model that wrote it, and the date), which it uses to count your generations each month.

When you use VendorDeck in your Shopify admin

• Session: while you use VendorDeck, our server keeps a session record with your IP address and browser details. VendorDeck finds it from the session token Shopify gives it, so it sets no cookies and stores nothing in your browser’s local storage.
• Fonts: the font previews under Settings > Appearance load the Google fonts you look at from Google Fonts. Google receives your IP address when your browser loads them (Google’s privacy policy).
• Logs: our servers log requests, with the IP address that made them, and errors, to keep VendorDeck running and secure.

VendorDeck uses no analytics, advertising or tracking cookies, and no tracking scripts.

From your store’s visitors

VendorDeck’s blocks show brand data on your storefront. The brand directory and the brand pages’ texts come from data VendorDeck keeps in your store for its blocks; the other blocks and the brand pages’ products load it from VendorDeck through Shopify’s app proxy, which tells VendorDeck which store the request is for. VendorDeck uses a visitor’s IP address only to limit how many requests one address can make per minute, and it stores nothing about your visitors: no cookies, no local storage, no tracking.

If you pick a Google font under Settings > Appearance and turn on the Brand page styles app embed, your visitors’ browsers load that font from Google Fonts, and Google receives their IP address. With the default fonts, nothing is loaded from Google.

Requests about your customers

VendorDeck stores no customer data, so when Shopify passes on a customer’s request to see or erase their data, VendorDeck has nothing to return or delete. We log that the request arrived with the customer’s Shopify ID, but not their name or email address. Shopify’s request contains the customer’s email address and phone number; our job queue holds it for up to an hour after handling it, or for up to seven days if handling it fails.

How we use it

• to run VendorDeck for you: import your brands, create and update your brand and directory pages, show the blocks on your storefront and generate text when you ask;
• to count your AI generations against your plan;
• to answer you when you contact us;
• to keep VendorDeck secure and fix problems.

We don’t sell your data, use it for advertising or use it to train AI models. Under the GDPR, we process it to provide VendorDeck to you (performance of a contract) and, for security, logs and fonts, for our legitimate interest in running a secure and working app.

Who receives it

• Shopify, which runs your store and the app proxy, and bills your plan.
• Anthropic, PBC in the United States, which generates AI text from the data described above, only when you ask for it (Anthropic’s privacy policy).
• Groq, Inc. in the United States, which generates that AI text instead when Anthropic can’t answer (Groq’s privacy policy).
• Google, which serves the fonts described above.
• Cloudflare, Inc., whose network carries every request to VendorDeck’s servers, from your Shopify admin and from Shopify’s app proxy and notifications, with the IP address that sent it (Cloudflare’s privacy policy).
• Hetzner Online GmbH, which hosts VendorDeck’s servers, database and backups in Germany (Hetzner’s privacy policy).
• Apple, whose iCloud Mail handles our support email (Apple’s privacy policy).
• Public authorities, when the law requires it.

When personal data leaves the European Economic Area, for example to Anthropic, Groq, Google, Cloudflare or Apple in the United States, the transfer relies on the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

• While VendorDeck is installed: as long as you use it. Deleting a brand in VendorDeck deletes its texts and AI generations.
• After you uninstall: we keep your data for 48 hours, so reinstalling within that time brings everything back. Then we permanently delete everything we stored for your store: your brands with their texts, AI generations, settings, sync history, template checks and sessions.
• In your store: the directory and brand pages stay there with their titles, page titles and meta descriptions, as they’re part of your store, and so do the logos and banners in Content > Files. Delete them in your Shopify admin if you don’t need them. The brand texts and image links VendorDeck kept on the pages for its blocks, the brand directory’s list of brands, and your Appearance settings belong to the app, and Shopify deletes them some time after you uninstall.
• Sessions: deleted after 2 hours without activity.
• Server logs: 14 days.
• Backups: our servers are backed up daily and each backup is kept for 7 days, so anything we delete is gone from the backups 7 days later.
• Support emails: as long as needed to help you, and no longer than 12 months after the conversation ends.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable format. Email support@vendordeck.app and we answer within one month. You can change most of what VendorDeck stores in VendorDeck itself, and uninstalling deletes it after 48 hours.

You can also complain to a data protection authority, such as the one where you live or ours, the Hellenic Data Protection Authority (www.dpa.gr).

Changes to this policy

When we change this policy, we update it here and change the date at the top. If a change affects how we use your data, we tell you in VendorDeck or by email before it takes effect.

Contact

Iosif Chatzimichail (Reach), Kos, Greece. Email: support@vendordeck.app