Privacy policy

Who we are

VendaHawk is an ecommerce growth agency run by its two founders, Rejwan D. Nirob and Jay Shan. We are the controller of the personal data described here. Contact: hello@vendahawk.com.

What we store and why

• Lead details from the snapshot, contact and onboarding forms: your name, work email, company, store or listing URLs, the platform you sell on, optional revenue band and catalog size, your message, and the page and campaign parameters you arrived with. We use these to deliver what you asked for and to follow up about it.
• Onboarding answers: everything in the onboarding form, including contacts, approvers, catalog and baseline numbers, goals, competitors, brand voice samples, do-not-say lists, claims policy, product fact sources and access status. We use these to write your brand guide, the document our team works from.
• Performance data: numbers from the platforms you grant us delegated access to (for example Seller Central, Seller Hub, Seller Center, Shopify, Merchant Center, Search Console, GA4 and ad platforms), and the results of sampling a fixed panel of buyer prompts across AI engines. We use these to do the work and to report it to you.
• Copy samples and brand assets you share so our output sounds like you.
• Portal account details: email, a hashed password, role and an activity log of approvals and comments.
• Website analytics events (page views, form starts and submissions, clicks on the snapshot button) pushed to a data layer. We do not load third-party analytics scripts on this site today; if we add one we will update this policy.

What we never ask for

Passwords. Access to your platforms is granted by you to a named VendaHawk identity through each platform's delegated-access route, and you can revoke it at any time. We never need billing or bank access.

Subprocessors

We use a small number of providers to run the service. Each processes data only to provide its service to us.

• Neon (database hosting, Postgres): stores leads, onboarding answers, client records, work items, reports and performance data.
• Vercel (hosting and serverless functions): runs the website, the client portal and the admin portal, and handles request logs.
• Google Gemini (AI models): receives the text we send to draft listings, articles, posts, images and reports, including relevant product facts and extracts of your brand guide. We do not send passwords, bank details or customer personal data to the model.
• Resend (transactional email): sends our emails. It receives the recipient address and the message content for sign-in links, portal invitations and account notifications, and for the internal alerts we email ourselves when a form is submitted, which contain the details entered in that form.

Retention

• Leads that do not become clients: 24 months from the last contact, then deleted.
• Onboarding answers and brand guides: for the length of the engagement and 12 months after it ends, so we can answer questions about past work, then deleted.
• Performance data and reports: for the length of the engagement and 12 months after, then deleted or anonymised.
• Activity logs and portal accounts: 12 months after the account is closed.
• You can ask us to delete sooner at any time; see your rights below.

Sharing

We do not sell personal data and we do not share it with anyone except the subprocessors above, a platform when you have asked us to act on your account there, or where the law requires it. Client results are published only with written consent.

Your rights

Wherever you are, you can ask us to tell you what we hold about you, correct it, delete it, export it, or stop using it for marketing. If you are in the EEA, UK or a jurisdiction with similar rights (for example California), those rights are set out in law and we honour them. Email hello@vendahawk.com and we will respond within 30 days. Marketing emails always include an unsubscribe link, and marketing consent is asked for separately from the consent needed to deliver a snapshot.

Cookies

The public website uses no tracking cookies. The client and admin portals use a session cookie needed to keep you signed in. The onboarding form saves your in-progress answers in your own browser (local storage) so you can come back later; nothing is sent to us until you submit.

Security

Data is encrypted in transit and at rest by our hosting providers. Portal passwords are hashed. Access to client data inside VendaHawk is limited to the people doing the work. If we ever have a breach that affects you, we will tell you without undue delay.

Changes

When this policy changes we update the date at the top of the page. Material changes to how we use client data are also announced to active clients by email.