Privacy Policy
Last Updated: October 20, 2026
1. General Information
We, MASHED Software Solutions GmbH, take the protection of your personal data seriously. This policy explains what we collect, why, on what legal basis, and who we share it with.
It covers two things: this marketing website (vandowms.eu) and our warehouse management application Vando WMS at app.vandowms.eu. Where a section applies to only one of them, it says so.
2. Data Controller
The controller for the processing described here is:
MASHED Software Solutions GmbH
Kasernstraße 30b, AT-8010 Graz, Austria
Represented by: Manuel Penaloza
Email: contact@vandowms.eu
Phone: +43 681 10526513
3. Data Collection on our Website
Server Logs:
Our hosting provider, Vercel Inc., records technical data when you load a page — IP address, browser and device type, referring page and time of access. We use this to keep the website available and secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website).
Analytics (Google Tag Manager):
We use Google Tag Manager to understand how visitors move through the website, so we can tell which parts explain the product and which do not. This may record page views, clicks and navigation paths. Google Tag Manager and everything loaded through it only run once you have agreed in our cookie banner; without your consent nothing is requested from Google. You can withdraw your consent at any time via "Cookie settings" in the footer. Legal basis: Art. 6(1)(a) GDPR (consent).
Contact and Demo Requests:
If you contact us, request a demo or use our fit check, we process the details you provide — name, email address, company, your message and your answers. We use them only to answer you and, if it goes further, to arrange a demo or an offer. The request is delivered to contact@vandowms.eu through Mailgun Technologies, Inc. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering a contract).
Newsletter:
If you sign up for our newsletter, your email address (and your name, if you provide it) is stored with our newsletter provider Mailjet (Sinch Mailjet SAS, France) so we can send you product news. You can unsubscribe at any time via the link in every newsletter or by writing to us. Legal basis: Art. 6(1)(a) GDPR (consent).
Display Preferences:
Your language, your light/dark choice and whether you have closed the demo banner are stored in your own browser so the website remembers them. They are not sent to us and are not used to identify you.
4. Data Collection in the Application (Vando WMS)
Vando WMS is a tool your company uses to run its warehouse. In most cases your company decides what goes into it and is the controller for that content; we process it on its behalf as a processor.
Account and Authentication:
To give you an account we process your email address, name, the company you belong to, and — if you sign in with a password — a securely hashed version of it. Accounts and application data are stored with Supabase Inc., which provides our database and authentication. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Sign in with Google (optional):
You may sign in with your Google account instead of a password. Google then confirms your identity to us and we receive your email address and basic profile information such as your name. Legal basis: Art. 6(1)(b) GDPR.
Spam and Abuse Protection:
The sign-in and sign-up pages are protected by Google reCAPTCHA v3, which analyses how the page is used in order to tell people from bots. This sends technical data, including your IP address, to Google. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse of accounts).
Warehouse Data You Enter:
The application stores what you and your colleagues put into it or upload — for example products, stock levels, storage locations, orders, suppliers and customers, imported files and the activity history of who changed what and when. Some of this can be personal data, for example contact persons at customers or the names of staff. It is used solely to provide the WMS service to your company. Legal basis: Art. 6(1)(b) GDPR.
Barcode Scanning:
Our application uses your device's camera to scan barcodes. This processing happens locally on your device. No images or video feeds from the camera are transmitted to or stored on our servers.
AI-Assisted Import (CSV/Excel):
If you import products from a CSV or Excel file with AI assistance, the contents of the file — column headings and row values — are transmitted to Anthropic, PBC in the United States so that its model can interpret the columns and map them to Vando WMS. The result is a proposed import that you review; the imported products are stored by us, not by Anthropic. Please do not upload files containing more personal data than your product data genuinely requires. Legal basis: Art. 6(1)(b) GDPR (performance of the contract, at your instruction).
Billing:
For paid plans, payment is handled by Stripe, Inc. Stripe processes the payment details directly; we receive the subscription status, plan and invoice records, not your full card number. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention of accounting records).
Service Emails:
Emails the application sends — for example invitations, sign-up confirmations and password resets — are delivered through Mailgun Technologies, Inc. Legal basis: Art. 6(1)(b) GDPR.
5. Processors
We do not sell personal data. To provide our services, we use the following processors, each under a data processing agreement:
- Vercel Inc. — hosting of the website and the application
- Supabase Inc. — database and authentication for the application
- Google Ireland Ltd. / Google LLC — Tag Manager (only after consent), reCAPTCHA, Google sign-in and Google Workspace for the mailboxes that receive your messages
- Mailgun Technologies, Inc. — delivery of contact requests and service emails
- Sinch Mailjet SAS — newsletter
- Stripe, Inc. — payment processing for paid plans
- Anthropic, PBC — AI processing of files you submit to the AI-assisted import
6. Transfers outside the EEA
Some of our providers are based in, or may process data in, the United States — in particular Vercel, Supabase, Google, Mailgun, Stripe and Anthropic. Where personal data leaves the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses and, where applicable, the provider's certification under the EU–US Data Privacy Framework.
The AI-assisted import in particular sends the contents of your uploaded file to a provider in the United States. If that is not acceptable for a given file, please do not use the AI-assisted import for it.
7. Data Retention
We store personal data only as long as necessary for the purpose it was collected for, or as required by law:
- Account and warehouse data: for as long as the account exists; deleted or returned on request when the account is closed.
- Contact and demo requests: while we are in contact and for up to two years afterwards.
- Newsletter: until you unsubscribe.
- Invoices and accounting records: seven years, as Austrian tax and commercial law requires.
- Server logs: a short period for security and troubleshooting.
8. Your Rights
Under the GDPR, you have the following rights:
- Access: Right to know what data we hold about you.
- Rectification: Right to correct inaccurate data.
- Erasure: Right to have your data deleted.
- Restriction and Portability: Right to restrict processing and to receive your data in a portable format.
- Objection: Right to object to processing based on legitimate interests.
- Withdrawal of Consent:Where processing is based on consent (analytics, newsletter), you can withdraw it at any time with effect for the future — for cookies via "Cookie settings" in the footer.
If the data is stored in your company's Vando WMS account, your company is usually the controller — we will pass your request on to it and support it in answering.
To exercise these rights, contact us at contact@vandowms.eu.
If you believe your data rights have been violated, you may lodge a complaint with the Austrian Data Protection Authority:
Österreichische Datenschutzbehörde (DSB)
Barichgasse 40–42, 1030 Wien, Austria
9. Cookies and Similar Technologies
We use what is strictly necessary to make the website and the application work — for example keeping you signed in, remembering your language and storing your cookie choice (cookie "vando-consent", kept for one year). Analytics are only set after you have consented in the cookie banner. You can change or withdraw your choice at any time via "Cookie settings" in the website footer.
10. Changes to this Policy
We update this policy when our products or our processors change. The date at the top always reflects the current version.