What we collect from operators
When you apply for placements on our operator page, we collect:
- Your name, email address and phone number
- About your vending business: how many machines you operate, your service radius and when you want to place machines
- Whether you ticked the optional box for placement openings and news, with the exact wording and the time
- How you found us: campaign tags (UTM parameters) and ad click IDs from Google or Facebook, if the link you followed had them
- Technical details: the page you applied from, your browser's user-agent string, and a one-way hash of your IP address (we don't keep the address itself; the hash is used only to limit spam)
How we use it
We use the information you provide to:
- Review your application and match you with suitable host locations
- Contact you about your application, and book a call if you choose one
- Send placement openings and news, only if you ticked the optional box
- Understand which ads and pages bring in applications
- Block spam and abuse, and meet our legal obligations
Your consent to email (CASL)
Operators: we reply to your application by email or phone; your application itself covers that reply. Placement openings and VendFynd news are sent only if you tick the optional box on the form.
Hosts: we email you about your request only if you tick the first box on the host form, and tips for hosts and VendFynd news only if you tick the second. If you leave both unticked, we reply by phone.
These boxes are unticked by default, as Canada's Anti-Spam Legislation (CASL) requires. When you tick one, we record the exact wording you agreed to and the date and time.
You can withdraw your consent at any time by:
- Clicking the unsubscribe link in any email we send you
- Emailing us at hello@vendfynd.com with "Unsubscribe" in the subject line
If you ask us for a machine (hosts)
When you use the form on our host page, we collect your answers about the site (business type, approximate staff, units or visitors, hours, after-hours access, space, power, signal, common area and current vending, plus any notes you add), the business or building name, your name, role, email and phone, the site's street address, city and postal code, and whether you ticked either email box. We also keep the page you submitted from, campaign tags and ad click IDs (if the link you followed had them), your browser's user-agent string, and a one-way hash of your IP address, used only to limit spam.
The instant answer you see ("Great fit", "Likely fit" or "We'll check") is worked out automatically from your answers. It only decides what the page tells you next; we look at every request ourselves before we reply.
We use this to assess whether your site suits a vending machine, to match it with an operator, and to contact you about your request. We share your site details and contact information with the operator we propose for your site only with your permission.
The same applies to the Switch for Me form (we also collect your current vending company, the problems you have with it, roughly when your contract ends and how many machines you have) and to the form on a partner's link (vendfynd.com/r/…), which also records which partner sent you.
Staff requests, votes and machine problems
Asking for a machine at work. On our at-work page you pick your workplace (the list comes from the cities' public business-licence data: name, address and city) and choose one of three options. We store the workplace, its address and city, the option you chose, the approximate staff count if you gave one, and anything optional you typed: your name, email, job and notes.
Votes. A vote is counted, never shown with your name. Anyone with the link for a workplace sees only the number of requests. So that each person counts once, your browser keeps a random ID (in local storage, as vf_voter) that is sent with your vote; we store only a one-way hash of it, together with the one-way hash of your IP address we keep for every form, used to limit spam and to cap how many votes one network can add.
A machine took your money. On our refund help page we store the location, what happened and when, the operator named on the machine's sticker, how you know the place, and your name, email or phone only if you give them.
We use these requests to see where staff and visitors want a better machine, and to approach that business. We never tell the business who asked, unless you choose "Send VendFynd my manager's contact" and tick the box that lets us say you asked. We email you only if you tick the email box.
Checking your site
When you use our site check, we store the street address and city you typed (and the province or state, for a site outside Metro Vancouver) (or, if you opened a personal link we sent you, a short code for that link), your answers to the three questions if we asked them, and the result we showed you, with the campaign tags, page and one-way IP hash we keep for every form. If you then ask us to call you, we also store your name, phone or email, and whether you ticked the email box. We use this to follow up only if you ask us to, and to see which sites want a machine. The result itself comes from open data about the address (business type, a staff estimate, the distance to the nearest food as a band, and the business area around it); we never show you anything about another business or its contacts.
If you bring us a site (operator scouts)
When an operator on our roster sends a site through the scouts page, we store their operator code, name, email and phone, the site's name and address, the approximate staff count, how they know the site, whether they want it for themselves or for another operator, their notes, and the contact details they give us for someone at the site (see the next section). Scout credits are recorded only for roster operators and partners, and only after a machine is installed.
If someone gives us your contact (referrals)
Sometimes a person who knows you gives us your contact details: an employee passing on their manager's contact from the at-work page, an operator scout naming their contact at a site, or a partner forwarding your request to us. We store what they gave us: your name, your role, your work phone or email, and the business.
- An employee or scout who gives us your contact must confirm that you know them and are happy to hear from us, and that we may say they asked. We record that confirmation, with its wording and time.
- We contact you once, as a referral, about a vending machine at that business, and we name the person who referred you. Partner forwards are answered as a reply to your own request.
- If you don't reply, or tell us you aren't interested, we don't contact you again about that referral.
- To opt out, reply to our message or email hello@vendfynd.com. We will stop and, if you ask, delete the details we were given.
How we find locations
VendFynd does not buy contact lists. Besides the requests hosts send us, we look for sites that may suit a machine in public business listings (such as Google Maps) and on businesses' own websites. When we email a business we haven't worked with, we use an address the business publishes for business contact, write only about vending at that business, and include a way to unsubscribe.
Sometimes we make a page for one business, at an address like vendfynd.com/for/business-name, and send its link or a QR code by mail. The page shows only the business name, its city and the general area on a map, all from our own research; it is hidden from search engines. When someone opens it, we count the visit against that business, with how it was opened (for example "QR code") and the date, but no IP address and nothing that identifies the person. The four questions on the page stay in your browser unless you choose to book, and then go with the booking. "Not a fit? Tell us and we won't follow up" sends us the business name and the reason you picked. We then stop all follow-up: the business's addresses go on our do-not-contact list, so our email system won't write to them again, and we don't call or mail. The map is drawn from OpenStreetMap, so your browser loads map images from the OpenStreetMap Foundation's servers.
Data sharing
We do not sell your personal information. We share it only with:
- Service providers that run parts of our business for us: Cloudflare (hosts this site, stores form submissions and runs the spam check), Google (Google Analytics and ad measurement), Meta (the Meta Pixel on the host and operator pages), Calendly (if you book a call) and our email provider
- For hosts: the operator we propose for your site, only with your permission
- For operators: the business at a location we propose to you, only with your permission
- Legal authorities, if the law requires it
Some of these providers store or process information outside Canada, including in the United States, where it may be accessible to authorities under local law.
Data retention
We keep what you send through our forms for 12 months from the date you submit it, unless you ask us to delete it sooner or we start working together (then we keep it for as long as we work together). If you gave email consent, the record of that consent is kept with it, so we can show what you agreed to.
Your rights
You have the right to:
- Access the personal information we hold about you
- Ask us to correct inaccurate information
- Ask us to delete your information
- Withdraw consent to receive emails at any time
- Complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada
To use any of these rights, email hello@vendfynd.com. We answer within 30 days.
Cookies, tracking and the spam check
- Google Analytics runs on every page (it loads after the page itself) and sets cookies to count visits and see which pages and ads bring people in.
- Meta Pixel runs only on the host and operator pages, where our forms are, to measure our Facebook and Instagram ads.
- When a form is sent successfully, we tell Google Analytics and the Meta Pixel that a request came in (no answers from the form). Google Analytics also receives your email address and phone number, which Google's tag hashes (scrambles) before sending, so an ad click can be matched to the request.
- Campaign tags and ad click IDs from the link you arrived on are saved in your browser's local storage, so your request is credited to the right ad.
- Partner link cookie (
vf_ref). When you open a partner's link (vendfynd.com/r/…), we set one first-party cookie that holds only that partner's short code. It lasts 30 days, can't be read by scripts on the page, and is used only to credit the partner if you send us a request in that time. We don't use it to track you across other sites. - Vote ID (
vf_voter). On the at-work page, a random ID kept in your browser's local storage so your vote is counted once (see votes). It holds nothing about you. - Site check link (
vf_check_l). If you open a personal site-check link, its code is kept in your browser's session storage until you close the tab, so a refresh shows your result again. It holds nothing about you. - Cloudflare Turnstile checks that a real person is sending our forms. It runs in your browser on the pages with our forms and sends Cloudflare technical signals about your browser and connection; most visitors never see it. It is used only to stop spam, not for advertising.
You can block or delete cookies and local storage in your browser settings, or use Google's Analytics opt-out add-on. The forms still work without cookies; the spam check needs JavaScript.
Security
This site uses encrypted connections (HTTPS). Form submissions are stored in a Cloudflare database that only VendFynd can reach, through a login-protected workspace. We keep a one-way hash of your IP address, never the address itself. No method of transmission over the internet is completely secure.
Contact us
For any privacy question, to see the data we hold about you, or to ask us to delete it, contact:
VendFynd · Mahdi Dialden
23100 Garripie Ave, Richmond, BC V6V 0B9, Canada
Email: hello@vendfynd.com
Phone: (604) 332-8613
Changes to this policy
We may update this policy from time to time. We'll post the new version on this page and change the "Updated" date at the top.