To clarify - staff can access and read messages when it is necessary to do so during an investigation of scamming or abuse or order issues. Even deleted messages. If you want your message only to be read by the vendor, you will need to encrypt it specifically to their PGP key.