Skip to main content
Company

Privacy Policy

Version 2026-10-13. Effective 13 October 2026.

Introduction

Elevantiq GmbH, trading as Vendure ("Vendure", "we", "us"), protects your personal data. This Privacy Policy explains what personal data we collect, where it comes from, why we use it, and what rights you have. It covers our website, Vendure Console, our support and our online forms.

It does not cover personal data our customers store in their own Vendure applications. Our customers control that data. If we access it to give support, or host it once Vendure Cloud launches, we act on our customer's behalf under a data processing agreement.

Data controller

Elevantiq GmbH, trading as Vendure
Registered office: Pass-Thurn-Straße 23, 6372 Oberndorf in Tirol, Austria
Office: Stiftgasse 15–17/1/3, 1070 Vienna, Austria
Email: contact@vendure.io
Privacy and data protection requests: legal@vendure.io

What we collect and why

Contact forms and enquiries

When you use a form on our website we collect your name, email address, company name, your message, and any other details the form asks for. We use them to answer your enquiry, provide support and handle your business request. The legal basis is taking steps at your request before a contract (Article 6(1)(b) GDPR), and our legitimate interest in answering business enquiries (Article 6(1)(f) GDPR). We send you marketing emails only if you separately sign up for them.

Business contacts and prospects

We may obtain business contact details, such as your name, job title, company and business email address, from professional networks and sales tools such as LinkedIn Sales Navigator, and from your company's website. We use them to find companies that may need Vendure and to contact them about it. The legal basis is our legitimate interest in business development (Article 6(1)(f) GDPR). We send marketing emails only where the law allows it. You can object at any time, and we then stop contacting you.

Calls and meetings

We hold calls with customers, prospects and partners on Google Meet. We may record or transcribe a call, and summarise it with Gemini in Google Workspace, to keep accurate notes. We tell participants at the start of the call and record only if they agree. If anyone declines, we don't record. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time during or after the call.

Vendure Console accounts

When you create an account in Vendure Console we collect your name, work email address and sign-in details, the name of your company and Projects, and a logo if you upload one. If a colleague invites you, we get your name and email address from them. Your name and email address are needed for an account. When a member leaves a Customer Account, we keep their name and email address with the records of their actions. We use this data to provide your account and the services your company buys, and to send service messages such as trial reminders, invoices, payment notices, licence and security notices, release notes for the plugins in your Plan, and changes to our terms. You can switch off release notes in Vendure Console. The legal basis is the performance of our contract where you are the customer yourself, for example as a sole trader (Article 6(1)(b) GDPR). Otherwise it is our legitimate interest in providing the service your employer buys (Article 6(1)(f) GDPR).

Billing and payment

When your company buys a subscription we collect:

  • its legal name, billing address and country;
  • its VAT or tax identification number, if it gives one;
  • an invoice email address;
  • an optional purchase order number; and
  • the names and email addresses of its Billing Admins.

Our payment processor, Stripe, collects and stores card details. We never see your full card number. We receive the card brand, the last four digits, the expiry date and the issuing country, so we can show them to you and keep tax evidence. We use this data to charge for subscriptions, issue invoices, send billing notices and keep accounting records. The legal basis is the performance of our contract (Article 6(1)(b) GDPR) and our legal obligations under tax and commercial law (Article 6(1)(c) GDPR).

We need the legal name, address and country, and a payment method, to sell a subscription. Without them we cannot conclude the contract.

Tax evidence and proof of acceptance

To determine where a customer is located for VAT, the law requires us to keep evidence. When you accept our terms and when you confirm that your company buys as a business, we record:

  • the IP address you used;
  • the country that IP address belongs to, which we look up on our own servers using the DB-IP Lite database, so the IP address is not sent to anyone else; and
  • the country that issued the card used for the first payment, which we receive from Stripe.

We use these records as VAT location evidence. The legal basis is our legal obligation (Article 6(1)(c) GDPR, together with Article 369k of Council Directive 2006/112/EC for sales under the EU One-Stop-Shop). We also use them as proof of which version of our terms your company accepted. The legal basis for that is our legitimate interest in being able to prove our contracts (Article 6(1)(f) GDPR).

VAT number checks

When you enter an EU VAT number, we check it with the European Commission's VIES service. The legal basis is our legal obligation to apply the correct VAT treatment (Article 6(1)(c) GDPR).

Sanctions screening

We may check the names of our customers' companies and contacts against sanctions lists, using OpenSanctions.

  • EU and UN sanctions lists. EU sanctions law prohibits us from doing business with listed persons, so the legal basis is our legal obligation (Article 6(1)(c) GDPR).
  • UK and US sanctions lists. The legal basis is our legitimate interest in meeting the requirements of our payment and banking partners (Article 6(1)(f) GDPR).

A person reviews every possible match before we take any action.

Licence checks

If you use the Vendure Commercial Plugins, your server contacts Vendure when it starts and then about once an hour. The checks authenticate with your environment credential and a rotating licence token, and contain no database content, customer data or order data. When you ask to downgrade, the check also sends which plugins are configured and aggregated counts, to confirm the downgrade is safe. About once a day, your installations may also report the installed versions of Node.js, Vendure Core and Vendure Platform. We record the time and result of each check, the IP address it came from and the forwarding headers, the user agent, the version of the licence check and a request identifier. We use this to validate licences, enforce deployment limits and detect misuse. The legal basis is our legitimate interest in enforcing our licences (Article 6(1)(f) GDPR).

When you create a development credential with the Vendure CLI, we label it with the name of the computer it was created on, so you can tell your credentials apart in the Console. A computer name can contain a person's name.

Package downloads. When your build or your developers install Commercial Plugins from our package registry, we record the package and version, the access token and Project used, the result, the IP address and forwarding headers, and the user agent. We use this to give access only to licensed Projects, to show you when a token was last used, and to detect misuse. The legal basis is our legitimate interest in enforcing our licences (Article 6(1)(f) GDPR).

In development, staging and test environments, the Commercial Plugins may also send a usage report about once a day: ranges for the orders placed in the last 7 and 30 days and for the customers who ordered in the last 30 days, the codes of the payment methods used, whether known payment integrations run in live or test mode, and basic system information such as the cloud provider, whether it runs in a container and the NODE_ENV setting. The report contains no customer data, order data, amounts or names. We use it to detect production use of a non-production licence and to tell the customer about it. VENDURE_DISABLE_TELEMETRY switches off neither this report nor the version report. The legal basis is our legitimate interest in enforcing our licences (Article 6(1)(f) GDPR).

Vendure Core telemetry

Vendure Core, our open-source framework, sends usage statistics to Vendure about once a day: a random installation ID, software versions, basic system information, the database type, the names of installed plugins, and ranges of entity, order and customer counts. It contains no personal data from your shop, but the request reaches us from your server's IP address. You can switch it off with the environment variable VENDURE_DISABLE_TELEMETRY=true. The legal basis is our legitimate interest in understanding how Vendure is used (Article 6(1)(f) GDPR).

Support requests

When you contact support, we process your name, email address, the content of your request and any files you send. We use them to answer your request. The legal basis is the performance of our contract where you are the customer yourself (Article 6(1)(b) GDPR), and otherwise our legitimate interest in supporting our customers (Article 6(1)(f) GDPR). To solve a problem, our support team may access your Vendure Console account. Every such access is logged, and the log names the team member. If your request gives us access to personal data of your own customers or users, we process that data on your company's behalf under our Terms of Service.

Server logs and error monitoring

Our websites, documentation, package registry and Vendure Console record technical logs, including IP addresses, browser details and the pages or API calls requested. We use Sentry, in its EU region, to report errors. An error report contains the error, the page and browser details. On Vendure Console it is stripped of request details, user details and email addresses before it leaves our systems. On our websites we also measure page performance for a sample of visits. We use these logs and error reports to run, secure and fix our services. The legal basis is our legitimate interest in operating secure and reliable services (Article 6(1)(f) GDPR).

With your consent, Sentry on our websites and documentation also keeps a replay of the moments before an error, so we can see what went wrong. Text is masked and images and media are blocked. The legal basis for replays is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021).

Website analytics and visitor identification

Our website and documentation use two analytics services:

  • Plausible, a cookieless analytics service hosted in the EU, for overall visitor numbers. It briefly processes your IP address and browser details to count visits, and doesn't track individuals.
  • PostHog, in its EU region, to understand how visitors use our pages. Until you accept marketing cookies, PostHog stores nothing on your device and counts visits using a short-lived identifier that changes daily. If you accept marketing cookies, PostHog sets a cookie so it can recognise you across visits and across our sites, records clicks and page interactions, and may record your session on our pages.

The legal basis for Plausible, and for PostHog without cookies, is our legitimate interest in understanding how our website is used (Article 6(1)(f) GDPR). For PostHog with cookies and session recording, it is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021). Vendure Console uses only cookies and browser storage that are strictly necessary to provide it, for example to keep you signed in, continue a signup and remember your view settings. With your consent, it also uses PostHog cookies, as our website does.

With your consent, we also use Dealfront (Leadfeeder) to identify the organisations that visit our website, so we can understand interest in our products and plan our sales outreach. It sets a first-party cookie (_lfa) in your browser, which lasts one year, and uses your IP address to find the company a visit belongs to. It aims to identify companies, not individuals, although for very small companies the two can coincide. We don't use it for advertising. The legal basis is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021).

When you first visit the site, a cookie banner asks for your consent:

  • If you decline, the Dealfront tracker never loads and no _lfa cookie is set.
  • If you accept, the tracker loads and the _lfa cookie is stored.
  • The same choice controls PostHog's cookies and session recording, and Sentry's error replays.

You can change or withdraw your consent at any time with the "Cookie settings" link in the website footer. Withdrawing consent stops the tracker from loading on later visits.

Product analytics in Vendure Console

We use PostHog, in its EU region, to understand how customers use Vendure Console. It records the pages you visit, the buttons you click and the signup and checkout steps you complete. Once you sign in, these events are linked to your Console user ID, together with your Plan, commitment and billing country. We don't send your name, email address or company to PostHog. Our servers may also send PostHog billing events for the same user ID, such as a trial starting, converting or being cancelled, or a Plan change. Until you accept cookies, PostHog stores nothing on your device. With your consent, PostHog also records your sessions in Vendure Console. Form entries and sensitive details, such as billing details and VAT numbers, are masked. Recording stops when you decline or withdraw consent, which you can do at any time in Vendure Console. The legal basis is our legitimate interest in understanding and improving how customers use Vendure Console (Article 6(1)(f) GDPR). For cookies and session recordings, it is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021).

Customer lists

We may name our customers and show their logos on our website and in marketing materials, as our Terms of Service allow. Where a customer is a sole trader, their name is personal data. The legal basis is our legitimate interest in showing who uses Vendure (Article 6(1)(f) GDPR). Customers can ask us to stop at any time.

Documentation and MCP interactions

When you search or send page feedback on the Vendure documentation website, or an AI assistant uses the public Vendure documentation MCP server, we may store:

  • the search query;
  • the ranked result paths and the selected result;
  • the page URL;
  • whether the request succeeded; and
  • any feedback you send.

For MCP requests we may also store the assistant's explanation of why it made the request. We use these records to measure adoption, and to find gaps in the documentation, product problems and recurring difficulties developers run into. The legal basis is our legitimate interest in improving our documentation and product (Article 6(1)(f) GDPR).

The MCP tools tell assistants not to include secrets, personal information, customer identifiers or proprietary source code. We also remove common credential formats before storage and discard URL query parameters. We do not store IP addresses, MCP authorisation tokens, complete conversations or retrieved documentation content in this store.

Marketing emails

If you sign up for our newsletter or product updates, we send them with Loops. You confirm your sign-up by email, and you can unsubscribe with the link in every email. The legal basis is your consent (Article 6(1)(a) GDPR). Service messages about your account are not marketing. You receive them as long as you have an account.

Who we share data with

We use these service providers. They process personal data on our instructions, under contracts that meet GDPR standards.

Stripe processes payments for us. For payment processing, fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy.

We also share data with authorities where the law requires it, for example tax records with the tax office, and with our tax advisors and auditors, who are bound by professional secrecy.

Transfers outside the EEA

Some providers are based in the United States or the United Kingdom, or process data there.

  • United Kingdom (Northflank): the European Commission's adequacy decision for the UK.
  • United States (including Stripe, WorkOS, Loops, Vercel, Sentry, Google, Amazon Web Services, Linear, Slack, Anthropic and OpenAI): the EU-US Data Privacy Framework where the provider is certified under it, and otherwise the European Commission's standard contractual clauses.

Dealfront, OpenSanctions and Twenty process data in the EU. You can ask us for a copy of the safeguards at legal@vendure.io.

How long we keep data

We keep personal data only as long as we need it for the purpose we collected it for, and then delete or anonymise it. In particular:

  • Enquiries and support requests: as long as needed to deal with them, and afterwards for as long as a related claim could still be brought against us.
  • Business contacts and prospects: as long as there is a realistic prospect of doing business, unless you become a customer.
  • Call recordings and transcripts: as long as we need them for what the call was about, for example an open support request, an enquiry or a deal, and then we delete them. Summaries are kept as long as the related enquiry, deal or customer relationship.
  • Console accounts: as long as the account exists. You can ask us to close your account. We handle the request manually, without undue delay, and delete or anonymise account data except the billing, tax and audit records we must keep.
  • Records of actions in Vendure Console, such as who changed a Subscription, issued a credential or accepted our terms: up to 10 years from the end of the year of the action, to prove our contracts and investigate misuse.
  • Invoices and accounting records: 7 years (§ 132 BAO). Records of sales under the EU One-Stop-Shop: 10 years (Article 369k of Directive 2006/112/EC).
  • Tax evidence: 10 years from the end of the year of the sale (Article 369k of Directive 2006/112/EC and § 132 BAO).
  • Proof of acceptance of our terms: up to 10 years from the end of the year of acceptance.
  • Sanctions screening records: as long as needed to show that we met our sanctions obligations.
  • Licence check records: the IP address, forwarding headers and user agent for 12 months. The rest of the record, which contains no personal data beyond your environment credential, up to 10 years.
  • Package download records: 7 days, and in our server logs for the short period described below.
  • Usage reports from non-production environments: the latest report, and earlier reports for up to 90 days.
  • Version reports: the latest report for each installation, until the installation is removed.
  • Server logs and error reports: for a short period needed to run and secure our services.
  • Vendure Core telemetry: as long as we need it to understand how Vendure is used.
  • Website and Console analytics: Plausible keeps no personal data. PostHog keeps session recordings for 30 days, and event data as long as we need it to understand how our website and Vendure Console are used. Its cookie lasts one year.
  • Documentation search and MCP records: up to 90 days. Feedback you send: up to two years.
  • Marketing emails: until you unsubscribe.

Automated decisions

We do not make decisions about you based solely on automated processing. Signup checks, such as the country of your billing address or a VAT number check, only decide which tax applies or whether a self-serve plan is available in your country. We don't block anyone automatically on the basis of their IP address or a sanctions list. A person reviews every possible sanctions match.

Your rights

You have the right to:

  • access your data;
  • have it corrected or deleted;
  • restrict its processing;
  • withdraw consent at any time, without affecting processing before the withdrawal; and
  • receive your data in a portable format.

To exercise them, email legal@vendure.io. Some data, such as invoices and tax evidence, we must keep by law even if you ask us to delete it. We tell you when that is the case.

Your right to object

Where we process your data on the basis of our legitimate interests (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

You can object to direct marketing at any time, without giving reasons. We then stop using your data for marketing.

To object, email legal@vendure.io.

Data security

We protect personal data with appropriate technical and organisational measures against unauthorised access, change, disclosure or destruction.

Children

Our services are for businesses. We don't knowingly collect data from children under 16.

Data protection officer

We have not appointed a data protection officer, because the law doesn't require one for our processing. For any data protection question, email legal@vendure.io.

Complaints

You can complain to the supervisory authority if you think we have breached your data protection rights:

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna, Austria
dsb.gv.at

You can also complain to the supervisory authority in the EU or EEA country where you live or work.

If you are outside the European Union

We apply this Privacy Policy, and the rights in it, to everyone whose data we process, wherever they are.

  • United Kingdom. You can also complain to the Information Commissioner's Office (ico.org.uk). For transfers from the UK we use the UK International Data Transfer Addendum or the UK-US data bridge.
  • Switzerland. You can also complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
  • United States. We don't sell personal data or share it for cross-context behavioural advertising.
  • Canada. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
  • Australia. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Our contact for data protection, including as the person in charge of the protection of personal information under Québec law and as data protection contact under the Brazilian LGPD and the Singapore PDPA, is our managing director, reachable at legal@vendure.io.

Changes to this Privacy Policy

We update this Privacy Policy when our processing changes, and post every change on this page with a new date.