Law enforcement guidelines

Who this page is for

This page is for law enforcement agencies, regulators, rights holders and their counsel who need data from Vendlio. It explains what we hold, how to ask for it, and what we will and will not do without a court order. Consumers reporting a bad store should use the abuse report form instead — it is faster.

What Vendlio is

Vendlio is hosted storefront software. Sellers run their own shops on our infrastructure and take payment with their own payment accounts — we do not hold, route or settle seller funds, and we are not a payment institution. That shapes what we can give you: we hold account, listing and order metadata, not banking records. For the flow of money you will need the seller's payment provider.

How to submit a request

Send legal process to [email protected] from an official domain, on agency letterhead, as a PDF attachment. To let us act quickly, include:

• The issuing authority, case or reference number, and the legal basis.
• Named contact with a verifiable official email address and phone number.
• The exact identifiers you are asking about — store subdomain or domain, order reference, account email, or IP address with a timestamp and its timezone.
• The date range you need.
• Whether a non-disclosure obligation applies, and its expiry.

Vague requests ("all data on this user") slow everything down. A request scoped to identifiers and a date range is usually answered within days.

What we require

• Basic subscriber information — account email, registration date, registration IP, store names: valid legal process (subpoena, production order, or equivalent under the requesting country's law).
• Transaction and listing records — orders, products, timestamps: court order or equivalent.
• Stored content — uploaded files, message contents, identity documents: search warrant or equivalent judicial authorisation.

We are established in the European Union. Requests from outside the EU are generally routed through a mutual legal assistance treaty, a European Investigation Order, or another recognised cross-border instrument. We will say so promptly rather than sitting on a request we cannot lawfully answer.

Emergency disclosure

Where we believe in good faith that there is an imminent risk of death or serious physical injury, or an immediate risk to a child, we will disclose the information necessary to prevent that harm without waiting for legal process. Mark the subject line EMERGENCY, describe the nature of the emergency, and identify the people at risk. We record every emergency disclosure and its justification.

Preservation requests

We will preserve account records on request while you obtain legal process. Preservation lasts 90 days and can be extended once on request. Ask at [email protected] with the subject line PRESERVATION and the identifiers to hold. Preservation does not disclose anything — it only stops the normal retention clock.

What we retain, and for how long

• Account records — email, registration date and IP, verification status: for the life of the account.
• Security and administrative audit log — logins, password changes, listing creation and removal, admin actions, with IP and user agent: 400 days.
• Order and invoice records — retained for the statutory bookkeeping period that applies to the seller.
• Seller identity verification — collected once a seller passes a revenue threshold; documents are stored outside the public web root and are never served over HTTP.
• Abuse reports — the report, our triage and the action taken, with timestamps.

Data outside these windows is deleted in the ordinary course of business. A preservation request received before deletion stops that clock; one received after it cannot bring data back.

What we will not do

• Disclose content or subscriber data on an informal request without legal process, outside a genuine emergency.
• Perform open-ended searches across all accounts on speculation.
• Provide banking or card data. We never see it — it belongs to the seller's payment provider.
• Fabricate, alter or backdate records to fit a request.

Notice to users

Our policy is to notify an account holder of a request for their data before we disclose it, so they can seek to protect their interests. We will not notify where notice is prohibited by law or court order, where the account appears compromised, or where notice would create a risk of harm, of evidence destruction, or to a child.

Rights holders

Copyright and trademark complaints go through the abuse report form, which produces a tracked reference and a documented response. State the work infringed, the URL of the infringing listing, and confirm that you are the rights holder or authorised to act. We accept counter-notices from sellers and will tell you when one is filed.

Costs and formal service

We do not charge for responding to properly scoped legal process. For formal service of proceedings, or where a physical address is required, request our registered details at [email protected].

Transparency

Every request we receive is logged with its date, the requesting authority, its legal basis, what we disclosed and when. We publish aggregate figures annually.