The short version

What we store

• Your sign-in: when you sign in with Google, your Google account’s email address, name and an account id, held by Supabase Auth. This sign-in is shared by the Adelyons apps that use Google sign-in.
• Your operation: its name and settings, its members and their roles, invite codes.
• Your machines and stock: products (names, barcodes, cost, price, case size, shelf life, warehouse counts), locations (name, address, contact, access notes, commission), machines, planograms and routes.
• What happens on the route: visits (what was found, added and pulled, with a reason, and the cash collected), DEX audit files, inventory snapshots and sales from Nayax or from imports, and who recorded each visit and when.
• Connections: a Nayax Lynx token you enter, kept on the server only and never sent to a phone; the hash of each API token you make (the token itself is shown once and not kept).

Who can see it

The members of your operation. Owners and managers see and change everything; drivers see the operation and record visits. Owners remove members at any time. No other operation can see your data.

Services we use

• Supabase (United States) stores the operation and the sign-ins.
• Nayax, only if you connect it: we read your machines, inventory and sales from your Nayax account with the token you gave us.
• Google Play, RevenueCat and Stripe handle purchases. We learn whether Pro is active and the ids that link it to your operation; we never see card details.
• The web app and this site are served from Google Cloud in the United States.

The camera

The camera reads barcodes. Pictures are not taken, stored or sent.

The website and the web app

We keep our own record of how vendingroute.adelyons.com and the web app are used: which pages are opened, how long a page is on screen, how far down it is read, which buttons are pressed, and which features are used, as a name and a count (for example “a visit was saved”), never what the record held. We do this ourselves, on our own server. No advertising network and no analytics company receives any of it, and we do not use it to show you advertising. The Vending Route phone app sends none of this.

• A random identifier: to tell one visit from another, the site stores a random identifier in your browser. It is not your name or your email address and says nothing about you by itself. If you sign in, what that browser did is connected to your account.
• About your browser: the size of your window and screen and your browser’s family (Chrome, Safari, Firefox, Edge), not its full description; the website you came from by its name only, never the full address.
• Links in our email: if you arrived from an email we sent, the link may carry a random identifier for that click, kept in your browser, so we can see that the visit came from that email.
• What is left out: we do not record what you type, the names of your machines, locations, products or people, or anything after the “?” in an address.
• How long: we keep this record for 13 months and then delete it. To have the record of your account’s visits deleted sooner, write to dev@adelyons.com.

Retention

Data is kept while the operation exists. Deleting an operation deletes its products, locations, machines, planograms, routes, visits, DEX reads, snapshots, tokens and members at once, and cancels its web subscription. See Delete your account.

Children

Vending Route is a business tool and is not directed to children under 13. We do not knowingly collect information from them.

Your rights

Export everything as CSV from Settings, delete your account or operation in the app (see Delete your account), or write to dev@adelyons.com. Residents of California, the EEA and the UK may also ask what we hold and have it corrected, exported or deleted at the same address.

Changes & contact

We may update this policy; a material change shows as a new effective date here. Questions or requests: dev@adelyons.com.