Privacy Policy

VenueDB (“we,” “us”) provides software that helps event venues manage leads, events, clients, contracts, payments and day-of event details. This policy explains what information we collect through our website and application, why, who we share it with, and the choices you have.

Two roles. For information about the people who use VenueDB (your account, sign-in, billing and how you use the product), we decide how the information is used. For information a venue enters about its own clients, guests, vendors and events, the venue decides how it is used and we process it on the venue’s behalf. If you are a venue’s client or guest and have a question about your information, please contact the venue first; we will help the venue respond.

Account and team information. Name, email address, a salted hash of your password (we never store the password itself), phone number, job title, profile photo, time zone, email signature, display preferences, and whether you agreed to our terms and whether you want product updates (the box is ticked by default when you sign up; you can untick it, and change your mind later). If you turn on two-step verification we store an encrypted authenticator secret and hashed backup codes.

Sign in with Google. If you choose “Continue with Google,” Google gives us your name, email address, profile picture and whether your email is verified. We do not receive your Google password.

Venue and business details. Venue names and addresses, rooms and spaces, branding, tax settings, team members and their roles, and the plan you subscribe to.

Venue content. Everything your team puts into VenueDB to run your business, which can include: clients, organizations and contacts (names, emails, phone numbers, notes); leads and inquiries; events, bookings and schedules; vendors and staff assignments; event orders (BEOs), quotes, contracts, invoices and payment records; documents and files you upload; tasks; and a log of emails to and from clients. When a client signs a contract through the portal, we record the signer’s name, email, the signature they provide, and the time.

Client and vendor portals. Clients and vendors who open a link from a venue can view the items the venue shares with them, sign documents, answer questionnaires, upload files and (where the venue has enabled it) pay invoices. They do not need a VenueDB account. Clients open a private link from the venue, enter their email address, and type a one-time code we email to it; only addresses the venue has on file for that client or event can sign in. Clients can also send files to the venue, which we store with the event. We keep the email address they signed in with, the time, and the browser details of the session, and hashed copies of the codes until they expire.

Services you connect. Only if you choose to connect them:

• Gmail or another email account (SMTP/IMAP). We store the access credentials in encrypted form so VenueDB can send email as you. To show replies in the client’s timeline, we read incoming and sent messages in the connected mailbox; we keep only messages that are part of a conversation that started in VenueDB, and skip everything else.
• Google Calendar. We can list your calendars, create calendars of our own, and add and update events that VenueDB created. We do not read or change other events.
• Stripe. Connecting Stripe lets your clients pay you. We store your connected account’s identifier and status.
• Webhooks and API keys. If you create them, VenueDB sends the data you select to the addresses you choose, and we store a hash of each API key.

Payments. Subscription billing and client payments are processed by Stripe. Card details go directly to Stripe and never touch our servers. We keep identifiers and status (customer, subscription, plan, invoice and payment status) and the amounts.

Support. Messages and attachments you send through in-app support chat or email. When you start a chat we also capture technical context to help us fix problems: browser and operating system, screen and window size, the page you were on, your plan, and the version of the app you were using.

Product updates sign-up. If you enter your email on our homepage, we store it to send you product updates.

Technical and security information. Your IP address and browser details when you sign in or use the service, the times you were last active, which actions were taken in an account and by whom (an audit log), server error logs with sensitive values removed, logs of failed API requests, and delivery records for emails the system sends. We use short-lived counters keyed to IP address and email address to limit repeated sign-in and sign-up attempts. If you choose to trust a device for two-step verification, we keep a hash of its token, its browser type, IP address and last-used time until it expires or you remove it.

VenueDB uses cookies only to sign you in and keep the service secure. We do not use analytics, advertising or tracking cookies, and we do not load third-party tracking scripts. Because these cookies are strictly necessary for the service you asked for, we do not show a cookie banner. If we ever add anything optional, we will update this page and ask for your consent first.

The events calendar also remembers a display preference (such as whether a side panel is open) in your browser’s local storage. It stays on your device and is never sent to us. Theme and layout choices you make in My Account are saved to your account. Fonts are bundled with the app, so loading them does not contact any other company.

• Provide, operate and maintain VenueDB, including sending the emails, invoices, documents and notifications you ask it to send
• Sign you in, verify your email, and keep accounts and data secure (including detecting and blocking abuse)
• Process subscription payments and send billing and account notices
• Answer support requests and investigate problems
• Send product updates to people who have not opted out (you can untick the box at signup or unsubscribe at any time)
• Monitor, debug and improve the reliability and performance of the service
• Meet legal, tax and accounting obligations

We do not sell personal information, and we do not use it for advertising.

Within a venue. People on a venue’s team can see the venue’s data according to the roles the venue gives them.

Service providers. We use companies that help us run VenueDB, and they may process information only to provide their service to us:

• Stripe — subscription billing and payments
• Google — “Continue with Google” sign-in, and Gmail and Calendar if you connect them
• Supabase — database hosting
• Upstash (Redis) — short-lived data such as background jobs and rate-limit counters
• Resend — delivery of system emails (verification, password reset, notifications)
• Cloudflare Turnstile — bot protection on sign-up, sign-in after repeated failures, and password reset; it checks that a visitor is human and receives the visitor’s IP address and browser details for that
• Our file storage and application hosting providers

The full, current list is on our subprocessors page. Business customers can also review our Data Processing Agreement. We do not use personal information, including the content venues enter, to train AI or machine-learning models.

At your direction. If you connect an integration, create a webhook, or send an email or document to a client, the relevant information goes where you tell it to.

VenueDB staff. Our staff do not browse customer data. To help with a support request, a staff member may open your account in a read-only support session; each session requires a written reason and is logged.

Legal and safety. We may disclose information if required by law or to protect the rights, safety or property of VenueDB, our users or others, and as part of a merger, acquisition or sale of assets (with notice to you if your information becomes subject to a different policy).

We keep account and venue data while the account is active. You can download a copy of your personal account data and ask us to delete your account from My Account → Data & Privacy. When a venue’s account is closed, access is blocked right away and the venue’s data is permanently deleted after a 30-day grace period, except for records we must keep for legal, tax or accounting reasons (for example, billing records). Copies in backups are removed as the backups expire on our providers’ normal schedules. Logs kept for security and troubleshooting are retained only as long as needed for those purposes.

We protect information with measures that include:

• Encryption in transit (HTTPS) and salted password hashing
• Encryption of especially sensitive secrets, such as authenticator secrets and the credentials for connected email accounts
• Optional two-step verification for every user
• Role-based access, so team members see only what their role allows
• Audit logs of important actions, and separate, strongly protected sign-in (with mandatory two-step verification) for VenueDB staff
• Limits on repeated sign-in attempts, and automatic sign-out of inactive sessions

No system is perfectly secure, and we cannot guarantee absolute security. Please use a strong, unique password and turn on two-step verification.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain uses, and to opt out of marketing. To exercise a right:

• Update your profile and download or delete your account data in My Account.
• Unsubscribe from product emails with the link in any of them, or email us. Clients who receive automatic reminder emails from a venue can unsubscribe with the link at the bottom of each one.
• Disconnect Google, email or Stripe connections at any time from your settings, and revoke access from your Google account.
• For anything else, email privacy@venuedb.app. We may need to verify your identity, and we will not treat you differently for exercising your rights.

If you are in the EU, UK or a similar jurisdiction, you may also complain to your local data protection authority.

VenueDB and our service providers may process and store information in the United States and other countries where they operate. Where the law requires it, we use appropriate safeguards for transfers.

VenueDB is a business tool and is not directed at, or intended for use by, children under 16. We do not knowingly collect information from them.

We may update this policy from time to time. If we make material changes, we will post the new version here with a new “last updated” date and, where appropriate, notify account owners by email or in the app.

Questions about this policy or your data: privacy@venuedb.app.