Last Updated: August 28, 2026
This Privacy Policy describes how Vendios ("we," "us," or "our") collects, uses, and handles information in connection with our CRM application and website. We are committed to transparency and to protecting the privacy of those who interact with our Service.
When you create an account, we collect information necessary to establish and manage your account, which may include company name, business email address, and billing contact information. We do not collect or store payment card data directly. Payment processing is handled by a third-party payment processor subject to its own security and compliance standards.
We may collect limited technical and usage data about how you interact with the Service, such as feature usage patterns, error logs, and session metadata. This information is used to improve the Service and diagnose issues. It does not include the contents of your NetSuite records.
If you contact us via email or a contact form, we retain that correspondence to respond to your inquiry and for our records.
Because Vendios operates within your NetSuite environment and does not host your business data on our servers:
We use the information we collect for the following purposes:
Vendios uses third-party AI services to power analysis and recommendation features. When you use these features, relevant data from your NetSuite session may be transmitted to AI providers for processing.
Your data is never used to train, fine-tune, or otherwise improve AI or machine learning models, by us or by our AI providers. Data sent to AI services is used solely for real-time inference to generate the requested output, after which it is not retained by the AI provider for training purposes. We have contractual agreements with our AI providers to enforce this requirement.
We select AI providers that maintain enterprise-grade security, SOC 2 compliance, and clear data processing terms consistent with this policy. The AI gateway we route through and the model providers available behind it are named in Section 5 below. Only the provider you select in your Vendios configuration receives your data.
We do not sell your information. We may share information in the following limited circumstances:
A subprocessor is a third party that processes information on our behalf in order to deliver the Service. We identify each one by its legal entity name in the tables below, and refer to them by their common names elsewhere in this Policy. Some are engaged for every account. Others are engaged only when you use the feature they support, or only when you connect your own account or API key with that provider.
Engaged for every account.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, edge request handling, and delivery of application configuration and integration services | United States |
| Maxio LLC | Subscription billing, invoicing, and payment processing, including its underlying payment gateway. Card data is tokenized in your browser and is not stored by Vendios. | United States |
Engaged only when you use the feature they support.
| Provider | Purpose | Location |
|---|---|---|
| Twilio Inc. | SMS messaging and voice calling | United States |
| OpenRouter, Inc. | AI gateway. Routes AI requests to the model provider you select in your configuration. | United States |
| Crustdata Technologies Inc. | Company and contact data enrichment | United States |
AI requests are routed through OpenRouter to the model provider selected in your Vendios configuration. Only the selected provider receives your data. No other provider in this list receives it.
| Provider | Models | Location |
|---|---|---|
| Google LLC | Gemini | United States |
| OpenAI OpCo, LLC | GPT | United States |
| Anthropic PBC | Claude | United States |
| SpaceXAI LLC | Grok | United States |
Model providers may retain request data for a short period for abuse monitoring, security, and legal compliance under their own terms. That is separate from training, and it is not training. We disable routing to any provider endpoint that trains on request data, for both paid and free models, and we do not route to endpoints that publish prompts or completions to public datasets.
Vendios also supports Oracle NetSuite's built-in AI as a provider option. If you select it, AI processing is performed by Oracle within your own NetSuite account under your existing agreement with Oracle, and none of the providers above is involved.
If you would prefer AI processing to run under your own agreement with a model provider rather than ours, you can add your own API key for that provider in your Vendios configuration. Requests are then billed to your account with that provider and governed by your agreement with them rather than by ours. Your data still reaches the same model provider through the same routing layer. What changes is whose contract applies to it. See Section 5.4.
The following are used only if you choose to connect them, using your own account and your own credentials. Vendios does not contract with these providers on your behalf, does not pay for your use of them, and does not meter it. Your agreement with each provider governs that processing and any fees it charges. We name them here so that your record of where your data goes is complete.
| Provider | Purpose | Engaged when |
|---|---|---|
| ZenLeads, Inc. d/b/a Apollo.io | Company and contact data enrichment, used in place of our default enrichment provider | You add your own Apollo API key |
| Google LLC | Calendar synchronization | You connect your own Google account |
| Microsoft Corporation | Calendar synchronization | You connect your own Microsoft 365 account |
| AI providers | AI processing on your own account rather than ours, for any of the model providers listed in Section 5.3 | You add your own API key for that provider |
Every provider named above maintains its own privacy policy, linked here for convenience. These documents belong to those providers, not to us. Each provider may change its policy at any time, without notice to us, and we do not control the content of the linked pages.
We will update this section when we add, replace, or remove a subprocessor, and we will update the "Last Updated" date at the top of this Policy. Where a change materially affects how your information is processed, we will also provide notice through the Service or by email.
If Vendios is used to facilitate SMS or other messaging communications, the following applies:
We retain Beta signup information and other collected data only as long as necessary to fulfill the purposes described in this Policy, or as required by law. If you wish to have your company's information removed from our records, you may contact us at the address below, and we will honor your request within a reasonable timeframe.
We implement commercially reasonable administrative, technical, and physical safeguards to protect the information we hold. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and you use the Service at your own risk.
The Service is not directed to individuals under the age of 18. We do not knowingly collect information from minors. If we become aware that we have inadvertently received information from a minor, we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date and, where appropriate, by providing notice through the Service or via email. Your continued use of the Service after changes are posted constitutes your acceptance of the revised Policy.
Depending on your jurisdiction, you may have certain rights regarding your information, including the right to access, correct, or request deletion of data we hold about your company. To exercise these rights, please contact us using the information below.
If you are located in the EEA or the UK, the General Data Protection Regulation gives you the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. For the account, billing, and support information we collect directly, Vendios acts as a controller. For any personal data processed inside your own NetSuite environment, you remain the controller and Vendios acts as a processor on your instructions. If you require a data processing agreement, contact us at [email protected]. You also have the right to lodge a complaint with your local supervisory authority.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect and how we use it, to request its deletion or correction, and to opt out of the sale or sharing of personal information. Vendios does not sell or share personal information as those terms are defined by the CCPA, and we do not offer financial incentives in exchange for personal information. We will not discriminate against you for exercising these rights. To make a request, contact us at [email protected].
If you have questions or concerns about this Privacy Policy, please contact us at:
Vendios
Email: [email protected]
Website: www.vendios.com