Privacy Policy

This policy explains what personal data Venom collects when you use the Venom website, web app, and MCP server (together, the “Service”), how we use it, who processes it for us, how long we keep it, and the choices you have. The Service is operated by Venom Labs, S.L. (NIF B05853908), Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain (“Venom”, “we”, “us”).

The short version

• Who: Venom Labs, S.L., Marbella (Spain), support@venomlabs.dev. For your organization’s workspace content, your organization decides and we act on its behalf (Data Processing Agreement).
• What and why: your account details to provide the Service (contract); usage analytics and security logs to keep Venom secure and improve it (legitimate interests); billing records because the law requires them.
• Who else: our service providers (Amazon Web Services, Stripe, Google, Cloudflare, PostHog, Attio, and Slack), some of which may process data outside the EU under the safeguards described below. We don’t sell personal data, and we don’t use your workspace content to train AI models.
• Your rights: access, correction, deletion, portability, restriction, and objection, by email to support@venomlabs.dev, and a complaint to the AEPD.

Who is responsible for your data

Venom is built for organizations. When your organization uses Venom, it decides what work is stored in its workspace. For that content, your organization is the controller and Venom is its processor: we process the content on its behalf, under our Data Processing Agreement. For your account details, billing, and the operation of the Service, Venom Labs, S.L. is the controller of your data.

What we collect

Account information

• Your name, email address, whether your email is verified, and an optional avatar.
• Your sign-in credentials, managed by Amazon Cognito. If you sign in with Google, we receive your name and email address from Google. We never see your Google password.
• Your organizations, teams, roles, and the handle you use in each organization, including handles on other services that your organization links to you (for example, a GitHub username).

Workspace content

The projects, tasks, task briefs, log entries, artifacts, skills, and settings that you, your teammates, and your AI agents create in Venom. Earlier revisions of artifacts are kept so you can go back to them.

Connections and credentials

• When you connect an AI client (for example Claude, Claude Code, Cursor, or VS Code) to the Venom MCP server, we store the access and refresh tokens we issue to it. We store them only as one-way SHA-256 hashes, so they can’t be read back. We also store the name the client reports for itself, which labels the entries it writes.
• When your organization adds third-party MCP servers to Venom, we store their API keys, and your personal sign-in tokens for them, encrypted with AWS Key Management Service.

Terms acceptance

When you accept our Terms of Service and Data Processing Agreement (at sign-up, when you create an organization, or when we ask you to accept a new version), we record which document and version you accepted, for which organization, and when. We don’t record your IP address or browser.

Activity records

For each operation an agent performs through the MCP server, we record which operation ran, which client ran it, who it ran for, whether it succeeded, and how long it took. These records don’t include the content that was read or written. The same details also go to our product analytics, described below.

Billing information

If your organization subscribes to a paid plan, Stripe processes the payment. When someone sets up billing, we give Stripe your organization’s name, the email address of the person who sets up billing, and your billing name, address, and tax ID, which Stripe stores for invoices and tax. We receive and store the subscription status and the Stripe customer and subscription identifiers. We never receive your full card number. Stripe also uses payment data for its own fraud-prevention and legal purposes, as an independent controller, under its own privacy policy.

Contact sales form

If you use the contact sales form on our website, we receive your name, work email, company, team size, and message, and record them in our customer relationship manager (Attio) so we can reply.

New sign-ups

When you create an account, our team gets a message in our internal Slack with your name, email address, whether you signed in with Google or email, the organizations you were invited to, and a link to your account ID in our product analytics. When you create an organization, a message names it and you. We also record the same details, your email’s company domain, and the date you signed up in our customer relationship manager (Attio). We use this to welcome new users, offer help, and follow up about Venom. It never includes your workspace content.

Email

We send invitations, account verification, password resets, and notifications (for example, when someone mentions you) from our own domain through Amazon SES. Mention notifications include the task’s title and a short excerpt of the entry, so they can contain workspace content. If you email us, we keep that correspondence to answer you.

Product analytics

We use PostHog to understand how people find and use Venom, so we can improve it. PostHog receives:

• From our website: the pages you visit, the links and buttons you click, which form fields you use (never what you type), the page that sent you to us, campaign tags in the link you followed (such as utm_source; ad click IDs are masked), and your browser, operating system, device type, screen size, language, and time zone. The website runs PostHog in cookieless mode: nothing is stored on your device. To count visits, PostHog’s servers turn your IP address, browser, and our domain into a one-way hash with a random value that changes every day, so visits on different days can’t be linked. PostHog doesn’t store your IP address or look up your location.
• From the web app: the pages you open and the elements you click, with the same browser details. These events aren’t linked to you: not to your account, your organization, your name, or your email address, even when you’re signed in. The web app runs PostHog in cookieless mode, like the website, so nothing is stored on your device and visits on different days can’t be linked. The text and attributes of what you click are masked, so we see that you clicked, not what the element said, and email addresses, invitation links, and sign-in codes in page addresses are masked before they leave your browser. PostHog doesn’t store your IP address or look up your location.
• Error reports from the web app: when something goes wrong in the app, what went wrong, where in our code, and on which page. Like the events above, they aren’t linked to your account or organization. An error message can occasionally quote data the app was working with.
• From our servers: that you signed up (and whether you were invited and have verified your email), joined or created an organization (with the organization’s name), connected an AI client (with the client’s name), and each operation an agent performed through the MCP server (which operation ran, which client ran it, whether it succeeded, and how long it took). These are linked to your account ID and your organization, not to your name or email address. Events from the website and the web app aren’t linked to them.

Apart from what an error message may quote, analytics never include your name, your email address, your workspace content, what you type into forms, or what AI clients read or write. We don’t use them for advertising, and session recording is off.

Cookies and browser storage

The website sets no cookies and stores nothing in your browser, for analytics or anything else. The web app sets a cookie that keeps you signed in, and uses your browser’s local and session storage to keep you signed in, remember the organization you selected, and keep interface preferences, the projects and tasks you opened recently, your organizations’ names, and unsaved drafts. On the billing page, Stripe’s payment form sets its own cookies to prevent fraud. These are needed for the app and payments to work. The web app’s analytics, like the website’s, run in cookieless mode and store nothing in your browser. We don’t use advertising or cross-site tracking cookies.

Where your data comes from, and what you must give us

Most data comes from you. Some comes from others: your organization’s owners and admins (your email address when they invite you, your role and teams, and handles on other services they link to you), your teammates and AI agents (when they mention you in their work), Google (your name and email address, if you sign in with Google), and Stripe (whether a payment succeeded).

You need to give us your name and email address to create an account; without them we can’t provide the Service. Everything else is optional.

How we use your data

• To provide the Service: sign you in, show and store your organization’s work, and answer requests from the AI clients you connect.
• To check, on every request, that you’re a member of the organization and have permission for what is asked.
• To send the emails described above.
• To bill paid plans.
• To keep the Service secure and reliable, and to investigate abuse, errors, and outages.
• To respond to support requests.
• To understand how the website and the Service are used, and to improve them (product analytics).
• To welcome new users, offer help, and follow up with them about Venom.

We do not sell your personal data. We don’t use your workspace content for advertising, and we don’t use it to train AI models.

Legal bases

Under the EU General Data Protection Regulation (GDPR), we rely on these legal bases:

• Contract (Art. 6(1)(b)): to provide your account, your organization’s workspace, the MCP server, the emails the Service sends, and paid plans.
• Legitimate interests (Art. 6(1)(f)): to keep the Service secure, prevent abuse, fix errors, measure how the website and the Service are used and improve them, answer sales and support requests, welcome new users and follow up with them, and keep proof of the terms you agreed to. You can object to this processing at any time by emailing support@venomlabs.dev.
• Legal obligation (Art. 6(1)(c)): to keep tax and accounting records and to answer lawful requests from authorities.

AI clients and connectors

Venom does not run AI models. When you connect an AI client such as Claude to Venom, that client reads and writes your workspace through the Venom MCP server, only as you or your agent request it, and only within the organization you approved when you connected. Whatever the client receives from Venom is then handled under its provider’s own terms and privacy policy. For Claude, that is Anthropic’s. Venom does not read your conversations with the AI client. Venom receives only the tool requests the client sends.

If you install the Venom Full plugin, its hooks send each shell command your agent runs to Venom so we can recognise milestones such as tests or a push. We don’t store the command, only which milestone it reached and when, for one day.

When your organization connects third-party MCP servers through Venom, Venom forwards your agent’s requests to those servers with the stored credentials. Those services handle the data under their own privacy policies.

Where your data is stored and how it is protected

The Service runs on Amazon Web Services in the EU (Ireland, eu-west-1). All traffic to the Service is encrypted with HTTPS. Third-party credentials are encrypted with AWS Key Management Service, and the tokens we issue are stored only as hashes. Access to organization data is checked against your live membership on every request.

Who we share data with

We share personal data only with the service providers that help us run Venom, and only as far as they need it to do that work:

• Amazon Web Services: hosting, databases, file storage, sign-in (Amazon Cognito), email delivery (Amazon SES), and encryption keys. EU (Ireland).
• Stripe: payment processing for paid plans.
• Google: optional “Sign in with Google”, and Google Workspace for our own support email.
• Attio: customer relationship management for contact sales requests and new sign-ups.
• Slack: our team’s internal messaging, where we get a message for each new sign-up and organization.
• Cloudflare: Turnstile, which checks that an email sign-up comes from a person and not a bot. It receives technical details of your browser and connection, such as your IP address, from the sign-up page.
• PostHog: product analytics for the website, the web app, and our servers, as described above. PostHog’s EU cloud (Frankfurt, Germany).

Your workspace content is visible to the members of your organization, in line with its team and project settings. We may also disclose data when the law requires it, or to protect the rights and safety of our users and of Venom. If Venom is involved in a merger or acquisition, data may transfer to the successor under this policy.

International transfers

Your account and workspace data is stored in the EU (Ireland), and our analytics data in PostHog’s EU cloud (Germany). Some providers may access or process data outside the European Economic Area:

• Stripe, Google, Cloudflare, PostHog, and Slack (US companies): the EU–US Data Privacy Framework, where the provider is certified, and otherwise the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), which are part of each provider’s data processing terms.
• Attio (UK): the European Commission’s adequacy decision for the United Kingdom, and the Standard Contractual Clauses for any onward transfer outside the UK.

You can ask us for a copy of these safeguards at support@venomlabs.dev.

How long we keep data

• Account data (your name, email address, and profile): while your account exists. To delete your account, email us. We delete it within one month, and copies in our backups expire within a further 35 days.
• Workspace content (projects, tasks, log entries, artifacts, skills, and settings): while the organization exists. Artifact revisions are kept for the lifetime of the organization.
• Records of the Terms and Data Processing Agreement versions you accepted: while your account exists and for 5 years after it is deleted, to show what was agreed if there is a dispute.
• Deleted or replaced log entries: recoverable for 30 days, then removed. Backup copies expire within a further 35 days.
• When an owner deletes an organization, deletion of its workspace content, teams, members’ roles, and the third-party API keys stored for it starts straight away and normally completes within minutes. Members’ personal sign-ins to third-party MCP servers made through the organization are deleted when they disconnect them, or on request to support. Copies in our backups and earlier file versions are removed within 100 days. The organization’s billing records stay with Stripe and in our accounting records for as long as tax and accounting law requires (see below).
• MCP access tokens expire after 1 hour, and refresh tokens after 30 days without use.
• Activity records: 30 days.
• Sign-up messages in our Slack and sign-up records in Attio: while your account exists. We delete them when we delete your account.
• Server and security logs (IP addresses, the addresses of pages and API calls, and error details): 90 days for application logs and 30 days for firewall logs.
• Product analytics events: 1 year, then PostHog deletes them. The analytics profile linked to your account is deleted when your account is deleted.
• Contact sales requests: up to 2 years after our last exchange with you, unless you become a customer.
• Support emails: up to 3 years after the request is closed, so we can deal with follow-ups and claims.
• Billing and tax records: 6 years, as Spanish commercial law requires (Código de Comercio, art. 30).
• Where we must keep data to deal with possible legal claims, we keep it blocked, away from normal use, and only for as long as those claims can be brought.

Your rights and choices

You can view and update your profile in the web app, and disconnect an AI client (Settings → Agent connection) or a third-party MCP server at any time.

You have the right to access your personal data, to correct it, to have it deleted, to receive it in a portable format, to restrict how we use it, and to object to processing based on our legitimate interests, including product analytics. To use these rights, email support@venomlabs.dev from the address on your account. We answer within one month. If a request is complex, we may extend that by up to two further months, and we’ll tell you why. If we need to confirm who you are, we’ll ask only for what we need.

If your data is part of an organization’s workspace, that organization decides what happens to it. We’ll pass your request to its owners and help them answer it.

You can also complain to a data protection authority, either the one where you live or work, or our lead authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Children

Venom is a service for businesses and is not directed to children. You must be 18 or older to use it, and we don’t knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

If we change this policy, we’ll update the date above. If a change is significant, we’ll notify you by email or in the app before it takes effect.

Contact

Questions or requests about privacy: support@venomlabs.dev.
Venom Labs, S.L., NIF B05853908, Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain. Registro Mercantil de Málaga, inscripción en trámite.