Privacy Policy

Account information. Name, email address, and sign-in identifiers when you create an account, accept an invitation, or sign in with a connected provider such as Google. We use magic-link and OAuth sign-in; we do not store passwords.

Customer Data. Information venues enter or collect through the Service: leads and inquiry-form submissions, contacts and accounts, bookings and events, menus and orders, documents, messages, uploaded files, and related records.

Signature records. When a document is signed electronically we capture the signer’s name, signature, timestamps, IP address, and device/browser details, and compute record fingerprints — this audit trail is part of the signed document.

Payment information. Payments are processed by Stripe. Card details are entered on Stripe-hosted pages and are never stored on our servers; we keep transaction records (amounts, status, and Stripe references).

Usage and log data. Standard technical logs (IP address, browser type, pages requested, timestamps) and records of administrative actions, kept for security, auditing, and support.

• to provide, maintain, and improve the Service;
• to authenticate users and secure accounts and tenant data;
• to process subscriptions and payments and send related notices;
• to send transactional email on behalf of venues (invitations, documents, messages, sign-in links);
• to provide customer support, including support sessions our staff initiate with an audit trail;
• to monitor performance, debug problems, and prevent abuse; and
• to comply with legal obligations.

We do not sell personal information, and we do not use Customer Data for advertising or to train machine-learning models.

We share information only with the service providers that run the platform, each bound to use it solely to provide their service to us:

• Supabase (on Amazon Web Services, United States) — database, authentication, and file storage;
• Vercel — application hosting and delivery;
• Stripe — payment and subscription processing;
• Mailgun — transactional email delivery;
• Google — optional sign-in (OAuth), if you choose it.

Beyond providers, we may disclose information if required by law or legal process, to protect the rights, safety, or security of VenueDrive, our customers, or the public, or as part of a merger, acquisition, or sale of assets (with notice of any material change in practices). Within the Service itself, information is visible according to your organization’s roles and permissions, and pages a venue shares (forms, documents, payment links) are visible to the people the venue shares them with.

We use only essential cookies: session cookies that keep you signed in and remember which organization you are working in, and security cookies for support sessions. We do not use advertising or cross-site tracking cookies.

We retain account information and Customer Data for as long as the organization’s account is active. After termination, data may be exported on request within 30 days and is then deleted from production systems in the ordinary course; residual copies in encrypted backups roll off on the backup schedule. Signed documents and their audit trails are retained with the venue’s records because they evidence executed agreements. We may retain limited records (such as billing history and audit logs) as required for legal, tax, and security purposes.

Customer data is isolated per organization with database-level row security, encrypted in transit (TLS) and at rest, and protected by role-based access controls inside each organization. Administrative and support actions are logged to an immutable audit trail. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as required by law.

You can access and update your account information in the Service, and organization administrators can manage, export, and delete their organization’s records. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing. To exercise them, contact us at support@venuedrive.com. If your data was entered by a venue (for example, you are a venue’s guest), we’ll route your request to that venue or act on their instructions, since they control that data. We do not discriminate against you for exercising privacy rights.

The Service is operated from the United States and information is stored on U.S. servers. If you use the Service from elsewhere, you understand your information is transferred to and processed in the United States, where privacy laws may differ from your jurisdiction’s.

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16; if you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. For material changes we will give notice (for example by email or in-app) before they take effect. The “Last updated” date above reflects the current version.

Questions about privacy or this policy: support@venuedrive.com. See also our Terms of Service.