Privacy policy

Who we are

Vaplio provides point of sale, stock, cash and online store software to vape shops, and the vaplio.com website with its shop directory. In this policy "we" means Vaplio and "shops" means the businesses that use Vaplio.

For a shop's own business records (products, sales, stock, cash, staff and its customers' orders) the shop decides what is recorded and why; we store and process those records for the shop to provide the service.

What we collect

Depending on how you use Vaplio:

Shop owners and staff: name, mobile number, email (owners, optional), password (stored only as a secure hash), role and branch access, sign-in times, device type and IP address.
Shop records: products, prices, costs, stock, sales, refunds, cash counts, expenses, suppliers, store settings and plan payments.
Customers ordering from a shop: name, mobile number, delivery address if you choose delivery, order notes, what you ordered and your confirmation that you are 18 or older.
Receipts: a shop can share a receipt link; it shows the items, amounts and payment method, never your mobile number.
Questions to Lio: where a shop uses Lio, the questions its owners and managers ask, Lio's answers, and how many messages each person has used.
Demo requests: your name, shop name, mobile number, city and message.
Your device: a cookie remembering that you confirmed you are 18 or older, a sign-in cookie for shop staff, and your cart, chosen branch and (if you allow it) approximate location kept in your browser. We don't use advertising or third-party tracking cookies.

How we use it

To run the service: record sales and stock, take and track orders, show stores and products, and keep accounts secure.
To pass your order to the shop you ordered from, and let you follow it.
To bill shops for their plan and keep records we are required to keep.
To support shops, investigate problems and keep the service secure, including detecting abuse and checking that records are consistent.
To contact you about a demo you requested.

Lio, the AI assistant

Lio is an optional assistant for shop owners and managers; cashiers can't use it. It is included for every shop; a shop that doesn't want it can ask us to switch it off.

To answer a question, Vaplio sends it to OpenAI, our AI provider, together with the shop records Lio looks up for that question and that the person asking is allowed to see in Vaplio. These can include sales, stock, cash and expense figures, product, branch and supplier names, staff names (for example the cashier on a receipt) and notes written in those records, as well as the first name and role of the person asking and the earlier messages in their chat. Lio doesn't look up customers' contact details, but anything a person types into a question or a note can be sent.

OpenAI uses this information to produce the answer. Under its terms for business (API) customers, OpenAI does not use it to train its models, and it may keep it for up to 30 days to detect and prevent abuse, or longer where the law requires. OpenAI may process it outside Pakistan, including in the United States.

Vaplio keeps a Lio chat so the person can continue it during the day. Seven days after a chat's last message, Vaplio deletes the whole chat: the questions, the answers and everything shown with them. Starting a new chat closes the previous one, which is then deleted on the same schedule. Deleted chats can remain in our encrypted backups for up to 35 days, until those backups are deleted.

To count messages against a plan's limits and to keep track of AI costs, Vaplio keeps a separate usage record for each question: who asked, when, and the cost of answering. It contains no question or answer, and is deleted after 13 months.

Who we share it with

We don't sell personal information. We share it only as needed:

With the shop you order from or work for. Each shop sees its own records and its own customers' orders, not other shops'.
With service providers who host and store data for us, under contracts that require them to protect it and use it only for us.
With OpenAI, only for shops that use Lio, to answer their owners' and managers' questions (see Lio, the AI assistant).
When the law requires it, or to protect people's safety and the security of the service.

How we protect it

Each shop's data is kept separate from other shops' data. Access to our systems and to data is restricted by strict access controls, limited to what each role needs, and recorded in internal audit logs. Passwords are stored as secure hashes, connections are encrypted, and important changes are recorded.

How long we keep it

Shop records are kept while the shop's account exists, including while a plan is paused, so nothing is lost. After an account is closed we keep records only as long as needed for legal, tax and accounting purposes or to resolve disputes, then delete or anonymise them. Demo requests are kept only as long as needed to follow them up. Lio chats are deleted 7 days after their last message, and Lio usage records after 13 months (see Lio, the AI assistant).

Your choices and rights

You can ask to see, correct or delete personal information about you. If your information is part of a shop's records (for example an order you placed), we may pass your request to that shop. You can clear the cookies and data saved in your browser at any time.

Adults only

Vape shops on Vaplio sell nicotine products to adults. The shop directory and store pages are for people aged 18 or over, and we don't knowingly collect information from anyone younger.

Changes

We will update this policy when our practices change and show the date of the latest version at the top. Significant changes will be announced in the app for shops.