Vendora Next is a business tool for property-preservation field work. It is used by contractors, technicians and office staff of companies that subscribe to the Vendora Next service. Through the app, an authorised user can view work orders assigned to them, record notes, capture and upload job photographs, record site check-in and check-out events, and prepare invoices.

This policy explains what information the app handles, why, and what choices you have.

• Your Organisation decides what work is assigned to you, what records are kept, and how long they are kept. For the work-order records you create in the app, your Organisation is the data controller and we act as a service provider / data processor on its instructions.

• For the operation, security and support of the Vendora Next app and service itself, we act as controller.

If you want a copy of your data, a correction, or deletion of work records, please contact your Organisation first — see “Your rights and how to exercise them”.

We collect only what the app needs to do its job. We do not ask for information that is unrelated to field operations.

Account and profile information

• Username and password, submitted when you sign in.

• The authentication token issued by our server for your session.

• Your account identifiers and profile details returned by our server: user ID, organisation (tenant) ID, name, email address, group membership and the permissions assigned to your account.

Work-order content you view and create

Depending on the permissions your Organisation grants you, the app displays and lets you submit work-order records held in your Organisation’s account. These records may include property addresses, client and contact details, loan and reference numbers, property access information, schedules and status, job notes and attachments, order line items and invoice amounts.

This content belongs to your Organisation. The app is a window onto it — the app does not create it for its own purposes.

Photographs and camera

• With your permission, the app uses your device camera so you can photograph a property for the work order you are on.

• Photographs you capture are uploaded to your Organisation’s account on our servers and attached to that work order.

• Along with each photograph the app reads and sends photo metadata: capture date and time, the GPS coordinates of the capture, and the device make and model. This metadata is what makes a job photograph verifiable evidence of the work performed.

• If you enable “Save to Camera Roll” in Settings, the app also saves a copy of the photograph to your device’s own photo library. This setting is off unless you turn it on. The app does not read, scan, or upload photographs that already exist in your device library.

Location

• With your permission, the app collects your device’s precise location (GPS), and uses it for two purposes only:

  • 1

    to record where a job photograph was taken;

  • 2

    to record where you were when you check in to, or out of, a property, if your Organisation uses that feature.

• Location is collected only while you are using the app to capture a photo or record a check-in/check-out. The app does not request background location access and does not track your movements when it is closed or idle.

• A photograph will not be uploaded until a location fix is attached to it. If no fix is available at the moment of capture, the photograph is held on your device until one can be obtained.

• Location is never used for advertising, profiling, or any purpose unrelated to documenting field work.

Device and technical information

To operate the service securely and reliably we process basic technical information such as the device model and operating-system version, app version, network connection status, and server-side request and error logs (which include the time of a request and the account that made it). These logs are used for security, troubleshooting and abuse prevention.

Notifications

With your permission, the app posts notifications on your device to show upload progress and to tell you when photographs are still waiting to be uploaded. Notification permission is optional and can be revoked at any time in your device settings.

Information stored on your device

To let you keep working with poor or no connectivity, the app stores the following locally on your device:

• Your session token and organisation ID, in the operating system’s encrypted secure storage (Android Keystore / iOS Keychain).

• A cache of work orders you have opened, your profile and permissions, your recently opened work orders, and app settings such as theme.

• A queue of photographs and other changes that have not yet reached the server.

This local data stays on your device. It is removed when you sign out, when a different user signs in on the same device, and when the app is uninstalled.

We want to be explicit about this:

• We do not sell or rent your personal information to anyone.

• We do not share your information with data brokers, advertisers or ad networks.

• The app contains no advertising, no advertising SDKs, and no cross-app tracking SDKs. It does rely on two outside providers to deliver push notifications and maps; both are named under Sharing and disclosure below, and neither profiles you nor follows you across other companies’ apps.

• We do not use your information to build advertising or marketing profiles.

• We do not collect your contacts, messages, call logs, browsing history, calendar, microphone audio, health data, or financial account credentials.

• We do not track your location in the background.

We use the information described above to:

• authenticate you and keep your session secure;

• show you the work orders and records your permissions allow;

• upload, store and attach your photographs, notes and invoice entries to the correct work order in your Organisation’s account;

• attach verifiable time and place metadata to field work, which is a core requirement of property-preservation reporting;

• deliver work to your Organisation’s back office;

• operate, secure, debug and improve the app and service;

• meet legal, regulatory and contractual obligations.

We do not use your information for automated decision-making that produces legal or similarly significant effects about you.

Where GDPR or UK GDPR applies, we rely on:

• Contract — providing the service to you and your Organisation.

• Legitimate interests — securing the service, preventing abuse, and ensuring field work is accurately documented.

• Consent — device permissions such as camera, location, photo library and notifications. You may withdraw these at any time in your device settings.

• Legal obligation — where retention or disclosure is required by law.

We share information only in these circumstances:

• With your Organisation. Everything you submit through the app goes to your Organisation’s account and is visible to its authorised administrators and office staff, and, where relevant to a job, to its clients.

• With service providers who host and run the service (for example cloud hosting, storage and infrastructure providers). They act on our instructions, under contract, and may not use the data for their own purposes.

• With the providers behind two specific features. Push notifications are delivered by Google Firebase Cloud Messaging, which receives a token identifying this installation of the app on your device. Maps, address lookup and driving directions come from Mapbox, which receives the coordinates or addresses needed to answer each request. Neither receives your work-order photographs or job notes, and neither may use what it receives for advertising.

• For legal reasons — where we are required to by law, court order or valid request from a public authority, or to establish, exercise or defend legal claims, or to protect the rights and safety of any person.

• In a corporate transaction — if the business or the relevant assets are merged, acquired or transferred, information may be transferred as part of it, subject to this policy.

• Work-order records, photographs and job notes are retained in your Organisation’s account for as long as your Organisation requires them, according to its own retention policy and its legal obligations.

• Account and authentication data is retained for as long as your account is active.

• Technical and security logs are kept for a limited period and then deleted or anonymised.

• Data held on your device is removed on sign-out, on sign-in by a different user, or on uninstall.

We take reasonable and appropriate measures to protect your information, including:

• encrypted transport (HTTPS/TLS) for all communication with our servers;

• storage of session credentials in the device’s encrypted secure storage;

• server-side access control — the server enforces your account’s permissions, and permission checks in the app are a convenience layer on top of that;

• immediate invalidation of your local session if the server rejects your token.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

You are in control of every device permission the app uses:

You can grant or revoke each of these at any time in your device’s system settings. You can also sign out at any time from the app’s Settings screen, which clears your session and locally cached data from the device.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. Users in California may also request disclosure of the categories of personal information collected and may opt out of “sale” or “sharing” — we do not sell or share personal information as those terms are defined.

How to make a request

• Because accounts are issued and controlled by your Organisation, please contact your Organisation’s administrator first. They can update or remove your account and your work records directly.

• You may also contact us at [email protected] and we will respond in line with applicable law, and will forward the request to the relevant Organisation where we act only as processor.

We will not discriminate against you for exercising any of these rights.

Our servers and service providers may be located in countries other than yours. Where personal information is transferred internationally, we use appropriate safeguards required by applicable law, such as standard contractual clauses.

Vendora Next is a workplace tool intended solely for adults acting in a professional capacity. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have done so, we will delete it.

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top and post the new version at this address. If the changes are significant, we will provide a more prominent notice. Continued use of the app after an update means you accept the revised policy.

If you have any question about this policy or about how your information is handled, contact us:

We aim to respond to every privacy enquiry within 30 days. A postal address for formal or legal correspondence is available on request by email.