Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Venom Labs, S.L. (NIF B05853908), Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain (“Venom”, “we”, “us”), and the organization that uses the Venom website, web app, and MCP server (the “Service”) under our Terms of Service (“Customer”, “you”). It forms part of the Terms and sets out how Venom processes personal data on Customer’s behalf, as Article 28 of the EU General Data Protection Regulation (“GDPR”) requires.

Customer accepts this DPA by accepting the Terms and using the Service. No signature is needed. If you’d like a copy signed by both parties, email support@venomlabs.dev with your organization’s legal name and address. If Customer has signed a separate agreement with Venom that includes data processing terms, those terms take precedence where they conflict with this DPA.

1. Roles and scope

• Customer is the controller of the personal data in its workspace (“Customer Personal Data”), and Venom processes it as Customer’s processor. Where Customer is itself a processor for another controller, Venom is its subprocessor, and Customer passes on that controller’s instructions.
• Customer Personal Data is the personal data in what Customer, its members, and the AI clients they connect put into the Service: projects, tasks, task briefs, log entries, artifacts, skills, and settings; the organization’s teams and its members’ roles and handles; and the credentials Customer stores for third-party MCP servers.
• Venom is a separate controller, not a processor, for each user’s account and sign-in, for billing, product analytics, security and abuse prevention, and sales and support requests, and for its own legal obligations. Our Privacy Policy covers that processing; this DPA does not.

2. Subject matter, duration, nature, and purpose

• Subject matter: providing the Service to Customer under the Terms.
• Duration: for as long as Customer uses the Service, and then until Customer Personal Data is deleted under section 11.
• Nature: hosting and storing Customer Personal Data; organizing and showing it in the web app; reading and writing it through the MCP server for the AI clients that Customer’s members connect; forwarding agents’ requests, with the stored credentials, to the third-party MCP servers Customer adds; sending the Service’s emails, such as invitations and mention notifications; keeping backups; and securing the Service.
• Purpose: only to provide, secure, and support the Service for Customer. Venom does not run AI models. It does not use Customer Personal Data to train AI models or for advertising, and does not sell it.

3. Data subjects and categories of data

Data subjects

• Customer’s members and the people it invites, such as employees and contractors.
• People whom Customer’s members or AI clients mention or describe in Customer’s content, such as colleagues, customers, or users of Customer’s own products.

Categories of personal data

• Names, email addresses, roles, team memberships, and handles, including handles on other services that Customer links to a member (for example, a GitHub username).
• Who wrote each log entry, and with which AI client.
• Any other personal data that Customer chooses to put in its projects, tasks, logs, artifacts, and skills.
• Credentials for third-party MCP servers, stored encrypted.

Special categories

The Service is not designed for special categories of personal data (GDPR Article 9) or data about criminal convictions and offences (Article 10). Customer should not put such data into the Service unless it has a lawful basis for it and has assessed that the measures in section 7 are appropriate.

4. Customer’s instructions

• Venom processes Customer Personal Data only on Customer’s documented instructions. The Terms, this DPA, and Customer’s use and configuration of the Service, including the actions of its members and the AI clients they connect, are those instructions. Further instructions must be in writing and consistent with the Terms.
• If EU or Member State law requires Venom to process Customer Personal Data in another way, Venom tells Customer before doing so, unless that law prohibits it.
• Venom tells Customer promptly if it believes an instruction breaks the GDPR or other EU or Member State data protection law.
• Customer is responsible for having a lawful basis for the processing, for the instructions it gives, and for the personal data it puts into the Service.

5. Venom’s obligations

• Confidentiality. Venom gives access to Customer Personal Data only to staff who need it to run and support the Service and who are bound by confidentiality.
• Security. Venom protects Customer Personal Data with the measures in section 7.
• Assistance. Taking into account the nature of the processing and the information available to it, Venom helps Customer meet its obligations under GDPR Articles 32 to 36: security, breach notification, data protection impact assessments, and prior consultation.
• Records. Venom keeps the record of processing activities that GDPR Article 30(2) requires.
• Requests from authorities. If a public authority asks Venom for Customer Personal Data, Venom refers it to Customer where the law allows, tells Customer unless the law prohibits it, and discloses only what the law requires.

6. Subprocessors

Customer gives Venom general authorization to engage subprocessors. Venom uses these service providers. Some receive no workspace content; they are listed so that this list matches our Privacy Policy.

• Amazon Web Services: Hosting, databases, file storage, sign-in (Amazon Cognito), email delivery (Amazon SES), and encryption keys. EU (Ireland, eu-west-1).
• Stripe: Payment processing for paid plans. Receives billing contacts and payment details, not workspace content. May process data outside the EEA, including in the US.
• Google: Optional “Sign in with Google”, and Google Workspace for our support email, which holds what you send to support. May process data outside the EEA, including in the US.
• PostHog: Product analytics for the website, the web app, and our servers. Receives usage events linked to account and organization IDs, not workspace content. EU (Frankfurt, Germany). PostHog staff may access it from the US.
• Cloudflare: DNS for venomlabs.dev, and Turnstile, which checks that email sign-ups come from a person. Traffic to the Service does not pass through Cloudflare. May process data outside the EEA, including in the US.
• Attio: Customer relationship management. Receives only what people send through our contact sales form, never workspace content. May process data outside the EEA, including in the US.

• AI clients and third-party MCP servers that Customer’s members choose to connect are not Venom’s subprocessors. Customer engages them directly, under their providers’ own terms, and Venom passes data to them on Customer’s instructions.
• Venom has a written contract with each subprocessor that imposes data protection obligations no less protective than this DPA, as far as they apply to the service it provides. Venom remains responsible to Customer for its subprocessors’ performance of those obligations.
• Changes. Venom updates this list, and emails Customer’s owners, at least 30 days before a new subprocessor starts processing Customer Personal Data. Customer can object in writing within that period on reasonable data protection grounds, and the parties will discuss the objection in good faith. If they can’t resolve it, Customer may cancel its subscription and stop using the Service, as the Terms allow.

7. Security measures

Venom maintains the technical and organizational measures below, described in more detail on our Security page. Venom may change them over time, but won’t reduce the overall level of protection.

• Location. The Service runs on Amazon Web Services in the EU (Ireland, eu-west-1). Our AWS organization policy blocks the use of other AWS regions for these services.
• Encryption in transit. Connections to the Service use HTTPS with TLS 1.2 or 1.3, and plain HTTP requests are redirected to HTTPS. Traffic between our own services stays inside our AWS virtual private network.
• Encryption at rest. Stored files are encrypted in Amazon S3 with AES-256, and our databases are encrypted at rest with keys managed by AWS. Credentials for third-party MCP servers are encrypted with a dedicated AWS Key Management Service key that rotates automatically; only the service that stores a credential can encrypt it, and only the service that uses it can decrypt it. The MCP access and refresh tokens we issue are stored only as one-way SHA-256 hashes.
• Access control. Sign-in is handled by Amazon Cognito, with passwords of at least 12 characters that include upper-case and lower-case letters and a number, or with Google. Every request is checked against the user’s live membership and role in the organization before data is read or written. AI clients connect with OAuth 2.1 and PKCE, to one organization per connection. Access tokens last 1 hour; refresh tokens are replaced each time they are used and expire after 30 days without use.
• Network. Only the web app and the MCP server accept traffic from the internet, through our load balancer. The services that hold account and project data accept connections only from our own services.
• Staff access to production. Production runs in its own AWS account, separate from development. People sign in through AWS single sign-on with time-limited sessions, and the root user is blocked. AWS CloudTrail records administrative activity to a separate security account, with log file validation, and keeps it for 400 days.
• Change management. Changes are made through pull requests that run our automated checks. Deployments run through GitHub Actions with short-lived AWS credentials, not stored access keys, and production deploys are started by hand from the main branch.
• Resilience. In production, the project and task database has point-in-time recovery, and the account and project databases are protected against accidental deletion. Earlier versions of stored files are kept for 90 days.
• Certifications. Venom does not yet hold a SOC 2 report or ISO 27001 certification.

8. International transfers

• Venom stores Customer Personal Data in the EU (Ireland). The subprocessors in section 6 that may process data outside the European Economic Area are marked there.
• Venom transfers Customer Personal Data outside the EEA only with a safeguard that Chapter V of the GDPR recognizes: an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for certified providers, or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”), Module 3 (processor to processor), in Venom’s contracts with its subprocessors.
• Where a transfer between Customer and Venom needs a safeguard, the SCCs apply with the module that matches the parties’ roles, and are incorporated into this DPA by reference. For the SCCs, sections 2, 3, 6, and 7 complete the annexes; Clause 9 follows Option 2 (general authorization) with the notice in section 6; the optional Clause 7 and the option in Clause 11 do not apply; and Clauses 17 and 18 choose Spanish law and the courts of Spain.
• Customer can ask for a copy of these safeguards at support@venomlabs.dev.

9. Data subjects’ rights

• Customer’s owners and admins can view, correct, and remove much of Customer Personal Data in the web app, for example by editing or deleting log entries, changing or removing members, and deleting the organization.
• Where those features aren’t enough, Venom helps Customer, on request to support and taking into account the nature of the processing, to answer requests from data subjects who exercise their rights under the GDPR.
• If a data subject contacts Venom directly about Customer Personal Data, Venom refers them to Customer and tells Customer. Venom does not answer the request itself unless Customer asks it to or the law requires it.

10. Personal data breaches

• Venom notifies Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Venom sends the notice by email to Customer’s owners.
• The notice describes, as far as Venom knows them: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and a contact for more information. Information that isn’t available at first follows as soon as it is.
• Venom takes reasonable steps to contain and investigate the breach and to reduce its effects, and helps Customer meet its own notification obligations. Notifying a breach is not an admission of fault.

11. Deletion and return at the end of the Service

• Customer Personal Data stays in the Service until an owner deletes the organization. Ending a paid plan doesn’t delete it: the organization moves to the Free plan, as the Terms describe.
• Until then, Customer can retrieve its content through the web app and the MCP server. If Customer needs help to get a copy before deleting the organization, it can ask support.
• When an owner deletes the organization, Venom deletes its workspace content and members straight away, and removes copies in backups and earlier file versions within 90 days. Venom keeps only what EU or Member State law requires it to keep, and protects that under this DPA for as long as it does.

12. Audits

• Venom makes available to Customer the information needed to demonstrate compliance with GDPR Article 28: this DPA, our Security page, and written answers to Customer’s reasonable security and data protection questions.
• If that isn’t enough, or a supervisory authority requires it, Customer may audit Venom’s compliance, including by inspection, itself or through an independent auditor who is bound by confidentiality and is not a competitor of Venom. Customer gives at least 30 days’ written notice, audits no more than once in any 12 months unless a personal data breach or an authority requires it, avoids unreasonable disruption to the Service and access to other customers’ data, and bears its own costs.

13. Liability

Each party’s liability under this DPA is subject to the Terms’ limitation of liability, to the extent the law allows. Nothing in this DPA limits either party’s liability to data subjects under GDPR Article 82, under the SCCs where they apply, or where the law does not allow it to be limited.

14. Precedence, changes, and governing law

• Where this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. Where the SCCs apply and conflict with this DPA, the SCCs prevail.
• Venom may update this DPA, for example to follow new legal requirements or changes to the Service, and will update the date above. If a change is significant, Venom notifies Customer’s owners by email or in the app before it takes effect.
• This DPA is governed by the same law, and subject to the same courts, as the Terms, except where the SCCs or data protection law require otherwise.

15. Contact

Questions about this DPA, requests for a signed copy, and notices under it: support@venomlabs.dev.
Venom Labs, S.L., NIF B05853908, Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain. Registro Mercantil de Málaga, inscripción en trámite.