Privacy policy
This explains what personal data RapidVend handles, why, for how long, who else sees it and what your rights are. It applies to store owners who use RapidVend (“you”) and, where said, to the people who buy from or visit their stores in Second Life (“customers”).
Who is responsible
For the data of store owners, the controller is RapidVend; write to voidlinux Resident (an IM in Second Life). For the data of a store's customers, the controller is that store's owner, and RapidVend only processes it for them under the data processing terms.
What we handle about store owners
| Data | Why | Legal basis |
|---|---|---|
| Your Second Life name and avatar key (UUID) | Your account: signing in, sending you sign-in codes and notices by IM | Contract (art. 6.1.b GDPR) |
| Your RapidVend password, kept only as a salted hash (PBKDF2) we cannot reverse | Signing in without a code | Contract |
| Your store's settings, products and the names of the Second Life accounts you give your bot and your packaging | Running your store | Contract |
| Your bot account's password, kept as the login hash Second Life's own viewers send and, encrypted (AES-256-GCM) with a key that never leaves our server, as typed; your packaging account's password (only where unpacker runs are on), encrypted the same way | Logging those accounts in for you; the bot's encrypted password signs in to the Marketplace website, as your Store Manager, to read your orders | Contract |
| IMs you send RapidVend's own bot (your name, avatar key, the text up to 1,024 characters and when), kept only on our server for 30 days, at most the latest 500 of everyone's; a message that is only a sign-in code is never kept | RapidVend's administrators read and answer them as support | Legitimate interest in giving support (art. 6.1.f) |
| Your plan, trial, L$ payments to RapidVend (amount, date, transaction ID) | Billing | Contract; legal obligations on accounting records (art. 6.1.c) |
| Technical logs of your store's bot (events such as sign-ins, deliveries and errors, with the names of avatars involved; never the text of IMs or chat) | Keeping the service working and giving you support | Legitimate interest in running a reliable service (art. 6.1.f) |
| Product details you ask the instructions writer to use (product name, contents, permissions, scripts, your notes, your store's name, and the support contact and group you set) | Writing your product instructions with AI | Contract |
| Web server access log (time, your IP address, the address asked for and your browser's name; never cookies or sign-in tickets) and, in the portal's own log, sign-in events with your avatar name | Security and keeping the service working | Legitimate interest in running a secure service (art. 6.1.f) |
| Which owners and which bot and packaging account names already had a free trial (your avatar key and those account names) | Stopping repeat free trials | Legitimate interest in preventing abuse (art. 6.1.f) |
What stores handle about their customers
On each owner's behalf, their store keeps the customers' avatar keys and names, purchases and deliveries, redelivery requests, visits to the owner's land (first and last time seen), wishlists, store credit, gift cards, L$ received and Marketplace orders. The store owner decides this and answers for it; RapidVend acts as their processor. A store owner can forget a customer from their dashboard (their purchases and deliveries, visits, wishlist and name are deleted; the L$ payments received, vendor sale records, store credit, gift cards and Marketplace orders stay in the owner's records for their accounts), and we help owners answer their customers' requests.
Who else receives data
- Linden Lab (Second Life): the bots act inside Second Life, so what they do passes through Linden Lab under its own privacy policy, as an independent controller.
- OpenAI: only the product details above, when you use the instructions writer; we send no customer records, though a script you ask it to read may contain names or keys you put in it. OpenAI may process it in the United States (OpenAI's privacy policy); transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
- RapidVend's own monitoring: the web server's access log and the warnings and errors from the stores' and the portal's logs (which can hold avatar names) are copied to a security-monitoring system run by RapidVend's operator.
- Google (Google Drive): our backups. Every copy is encrypted on our server before it is sent, with a key Google never gets, so Google cannot read them.
- Authorities, when the law requires it.
We do not sell data, show ads or use trackers or analytics. The fonts of this site are served by us, so no font service sees your visit.
How long
- Your account and store data: while your store exists. If you stop paying, your store is limited or suspended, but nothing is deleted. A new store whose set-up is not finished within a day is deleted after two warnings by IM.
- When a store is removed (you ask us, or it was never set up), its database and logs are deleted from our server at once and its encrypted backup copies right after (by hand within 30 days if the automatic deletion fails). Payment records of RapidVend plans stay, as accounting law requires, and so does the record that the owner and its bot and packaging accounts had a free trial, so it cannot be claimed again.
- IMs to RapidVend's bot: 30 days, and no more than the latest 500.
- Backups rotate: the newest 3 copies, one a day for 7 days and one a week for 4 weeks.
- Logs are kept up to about 20 MB per store, and 50 MB for the portal's own log; older lines are overwritten. The web server's access log is kept up to 60 MB (the current file and 5 older ones of 10 MB), and an older file is deleted after 90 days at most.
- Payment records: as long as accounting and tax law requires.
Security
Passwords are hashed or encrypted as described above; backups are encrypted; access to the server is restricted to RapidVend's administrators, who open a store's dashboard only to give that store support, and every such opening is logged.
Found a security problem in RapidVend? Please tell us privately, not in public: send a direct message to RapidVend's staff on Discord, with what you found and how to repeat it.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to get it in a portable format, by writing to voidlinux Resident (an IM in Second Life). If you think we handled your data wrongly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos. Customers of a store should first write to that store's owner.
Age
RapidVend is for people aged 18 or over.
Terms of service
The service
RapidVend runs a bot for your Second Life store: it delivers and redelivers your products, prepares them for the Marketplace, writes product instructions with AI, and the other features shown in your dashboard. One store per Second Life account. By signing in you accept these terms.
Your accounts and Second Life's rules
- Your store's bot needs a Second Life account you create for it and that only RapidVend uses.
- You follow Linden Lab's Terms of Service, Community Standards and Marketplace policies when you sell with RapidVend; you are responsible for your products and for what your store does with your customers' data.
- Linden Lab's terms restrict giving your own account's access to others. A packaging account is optional; if you give us one, you do it at your own decision and risk, and we use it only for the work you set up in your dashboard.
Plans and payment
- Normal: L$1,050 a month. Premium: L$1,699 a month. A store gets 7 days of Premium free once its set-up is finished, with nothing to pay up front. The trial is once per person: a store whose owner, bot account or packaging account already had one starts paying when its set-up is finished. Prices are in Linden Dollars, paid in Second Life to RapidVend's bot or through the autopay terminal.
- RapidVend's bot only takes payments from a store's owner, from 3 days before their next month is due, and only what is due. Anything else (from someone without a store, too early, or more than is due) is sent straight back.
- You can change plan whenever you like, and it changes at once. The time you have paid ahead keeps its value in L$ on the new plan: the days are worth what you paid for them, so a dearer plan gives fewer days and a cheaper one more. After that, each month costs the new plan's price.
- We remind you by IM in Second Life 3 days before each month is due (unless your balance covers it) and whenever a payment is late.
- If a payment is late, your store keeps working for 7 days. After that it is limited: sealing, new products and instructions pause, while your vendors keep selling and delivering. After 30 days it is suspended: your vendors close, your dashboard asks for the payment, and 3 days later your bot goes offline once the deliveries it has in hand are done (a vendor unpacker opened later is delivered by your vault, if you have one, or once you pay). Paying what is due lifts it at once. To reopen a suspended store you pay the month before the suspension and a new month, which starts the day you pay: the time it was suspended is never charged. Not paying never deletes your store, products or data.
- Linden Dollars are governed by Linden Lab's terms. Payments are not refunded, except where the law gives you that right. If you are a consumer in the European Union, you can withdraw within 14 days of signing up; by using the service during that time you ask us to start it, and a withdrawal then only refunds the unused part.
Availability and liability
We work to keep RapidVend running, but it depends on Second Life, which we do not control, and it can stop for maintenance or failures. As far as the law allows, we are not liable for indirect losses or lost sales, and our liability is limited to what you paid us in the last 12 months. Nothing here limits liability that cannot be limited by law, or your rights as a consumer.
Ending
You can stop at any time and ask us to remove your store. We may suspend a store that breaks these terms or Linden Lab's, telling you why.
Changes and law
We tell you by IM or in your dashboard before changing these terms in a way that matters to you. These terms are governed by Spanish law; if you are a consumer, you may also use the courts and the mandatory protections of the country where you live.
Data processing terms
These terms are part of the terms of service. For the personal data of your store's customers, you are the controller and RapidVend is your processor (art. 28 GDPR).
- Subject and duration
- Running your store's bot, for as long as your store exists.
- Data
- Customers' avatar keys and names, purchases, deliveries, redelivery requests, visits, wishlists, store credit, gift cards, L$ received and Marketplace orders.
- Data subjects
- Your customers and the visitors of your land in Second Life.
RapidVend:
- processes this data only to run your store as you set it up in your dashboard (your documented instructions), unless the law requires otherwise, in which case we tell you first where we may;
- makes sure everyone who can reach the data is bound to confidentiality;
- keeps the security measures described in the privacy policy;
- uses as sub-processor Google (encrypted backups, which Google cannot read); you authorise it, and we tell you before adding or replacing one so you can object;
- helps you answer your customers' requests and meet your own obligations on security, breach notices and impact assessments;
- tells you without undue delay of any personal data breach affecting your store;
- deletes the data, backups included, when your store is removed (backups by hand within 30 days if the automatic deletion fails), unless the law requires keeping it;
- gives you the information needed to show these terms are met, and allows reasonable audits.