Effective 2026-08-21

Privacy Policy

Venuo ("we", "us") operates a space-booking platform for offices, sports venues and studios. This Privacy Policy explains how we collect, use and share personal data about you when you visit our website or use our services, in compliance with the EU General Data Protection Regulation (GDPR).

Data controller

Venuo is operated by Ewa Kucharska, a sole trader (jednoosobowa działalność gospodarcza) registered in Poland, who is the controller of personal data processed through our platform and this website. You can reach us at [email protected].

What data we collect

Account data

Name, email, password hash, role within a workspace, profile photo (optional), phone (optional), and authentication metadata (IP address of sign-ins, device, timestamps).

Booking data

Spaces you book, dates and times, booking notes, attendee information, and any special requirements you provide.

Technical data

Browser type and version, device identifiers, log data (request path, referrer, user-agent), error traces. We use this data to operate, secure and improve the service.

Waiting-list data

If you join our pre-launch waiting list, we store the email address you submit and the interface language at the time of submission. We process this on the basis of your consent (Art. 6(1)(a)), for the sole purpose of notifying you when Venuo becomes available. We do not use it for any other marketing and do not share it. You can be removed at any time — see "How long we keep data" below.

Cookies and analytics

Google Analytics and Microsoft Clarity load only after you choose "Accept analytics". We remember your choice for up to 180 days in local storage (venuo-consent-v3); a strictly necessary venuo-analytics-denied cookie can also remember a refusal. A per-tab review marker may ask you to confirm your choice again when a page is restored from browser history, so a missed withdrawal cannot silently restart analytics. These choice records are not used for analytics.

If you accept analytics, the following tools run:

For Clarity data, Venuo and Microsoft act as independent controllers. Microsoft may use personal data as described in the Microsoft Clarity Terms and the Microsoft Privacy Statement, including to provide and improve its services and for profiling related to advertising. Venuo sends Clarity an explicit denial for advertising storage, does not show ads, and does not sell personal data.

Until you accept, or if you choose "Necessary only", neither Google Analytics nor Microsoft Clarity loads. We do not send cookieless analytics signals to these tools before consent.

The same optional analytics choice covers campaign and referrer attribution. After acceptance, we store this information in session storage (venuo-attrib) for the browser tab and pass it to Venuo signup links to understand how visitors reach signup. Refusal or withdrawal clears this stored attribution and removes parameters added by this feature from signup links.

You can change your decision at any time via "Cookie settings" on every page. Withdrawal disables analytics and reloads the page without these tools; it also removes their accessible first-party cookies on this site. A request already in flight may finish. This does not erase previously collected provider data or cookies on other domains. If your browser prevents us from remembering your decision, the consent bar explains this and analytics remains off in that document. Open tabs are notified via browser storage events and, where available, a broadcast channel. If both notification methods are unavailable, we ask you to close other Venuo tabs.

The Venuo app (app.venuo.co) uses only strictly necessary cookies and local storage for authentication and session management — no analytics cookies, no advertising cookies.

Legal basis for processing

• Contract (Art. 6(1)(b)) — to provide the booking platform you signed up for.
• Legitimate interest (Art. 6(1)(f)) — to secure our service, prevent fraud and improve product quality.
• Consent (Art. 6(1)(a)) — for optional marketing communications and analytics cookies (see "Cookies and analytics").
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting and law-enforcement obligations.

How long we keep data

• Active accounts: for the lifetime of your account.
• Deleted accounts: profile data is removed from our live systems within 30 days of your deletion request (grace period during which you may cancel). Copies may remain in backups until those backups expire (see "Backups" below). Booking records may be retained in anonymised form for legitimate interest (analytics) and legal obligations (invoicing).
• Backups: we make a daily backup of the production database and file storage for disaster recovery. Backup copies are kept for up to 30 days on GitHub and for up to 365 days in Cloudflare R2 storage (EU jurisdiction), and are then deleted automatically. Data deleted from our live systems can remain in these backups until they expire.
• Audit logs: retained for 24 months for security-incident investigation.
• Invitations: pending invitations expire after 7 days; terminal-state records purged after 30 days.
• Waiting list: kept until launch and removed within 30 days of launch, or sooner on request via [email protected].

Your rights

Under GDPR you have the right to:

• Access (Art. 15) — obtain a copy of your personal data. In the app: Settings → Privacy → "Download my data".
• Rectification (Art. 16) — correct inaccurate data from your profile page.
• Erasure / "right to be forgotten" (Art. 17) — delete your account via Settings → Privacy → "Delete my account". Deletion from our live systems is finalised 30 days after your request; backup copies expire as described in "How long we keep data".
• Restriction (Art. 18) — email [email protected].
• Portability (Art. 20) — export your data in a machine-readable JSON format.
• Objection (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent (Art. 7(3)) — as easily as you gave it: analytics cookies via "Cookie settings" on this website; marketing email via the unsubscribe link in any message.
• Lodge a complaint — with your national supervisory authority (in Poland: UODO, uodo.gov.pl; in Ireland: Data Protection Commission, dataprotection.ie).

Who we share data with

We use the following service providers and analytics recipients. Except where described otherwise, service providers act as processors under Art. 28 GDPR data-processing agreements:

• Supabase — database, authentication and file storage; hosted in the EU (Ireland region).
• Cloudflare, Inc. — content delivery, hosting and DDoS protection; backup storage (Cloudflare R2, EU jurisdiction).
• GitHub, Inc. — runs our automated backup jobs and stores database backups for up to 30 days.
• Resend, Inc. — transactional email delivery.
• Stripe, Inc. — payment processing (via Stripe Payments Europe, Ltd.). We never see or store your card number.
• Functional Software, Inc. (Sentry) — application error monitoring.
• Google LLC — website traffic analytics (Google Analytics 4), only after your consent.
• Microsoft — website usage analytics (Microsoft Clarity), only after your consent. Microsoft and Venuo act as independent controllers for Clarity data; see the Microsoft links in "Cookies and analytics" above.

A full, versioned provider and recipient list is available on request at [email protected].

International transfers

Your data is primarily stored in the EU (Supabase, eu-west-1). Some providers or recipients listed above are US companies, or transfer data to the US; transfers rely on the EU-US Data Privacy Framework (Commission adequacy decision (EU) 2023/1795 under Art. 45 GDPR) and, where applicable, Standard Contractual Clauses (Art. 46 GDPR) with supplementary safeguards.

Security

We use industry-standard measures: TLS in transit, encryption at rest, Row-Level Security for tenant isolation, password hashing (bcrypt), JWT with short expiry, and audit logging of security-sensitive changes.

Changes to this policy

We will notify you of material changes via email and in-app banner at least 30 days before they take effect. You may withdraw consent to the new version by deleting your account.

Contact

Questions? Email [email protected].