Terms of Service

This is the previous version of our Terms. For customers who signed up before 13 November 2026, it is in force until 13 December 2026, or until they accept the version of 13 November 2026 in the app if that is earlier. For customers who signed up before 12 November 2026, it applies only from 12 December 2026. The current Terms are at /terms.

When these Terms apply. We published these Terms on 12 November 2026. If you create your account on or after that date, they apply to you straight away. If you signed up before 12 November 2026, they apply to you from 12 December 2026, and until then the previous version of our Terms applies to you. If you don’t agree with the new Terms, you can leave before 12 December 2026 as section 14.3 describes.

1. Introduction

These Terms of Service (the “Terms”) are a contract between Venom Labs, S.L. (NIF B05853908), Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain (“Venom”, “we”, “us”), and the business that uses the Venom website, web app and MCP server (together, the “Service”) (“you”).

Venom is for business use only (section 2).

You accept these Terms when you create an account, as the individual user. When you create or administer an organization in Venom, you also accept them on behalf of that organization, and you confirm that you have authority to do so; “you” then includes that organization and its members.

These documents form part of the Terms:

• the Data Processing Agreement (venomlabs.dev/dpa), which governs how we process personal data on your behalf;
• our Data Act information page (venomlabs.dev/data-act), which describes switching, export, data formats, where our infrastructure is and how we protect your data against unlawful access by foreign governments; and
• the plan details shown on venomlabs.dev/pricing and in the app when you buy or change a plan.

Our Privacy Policy explains how we handle personal data as a controller. It is information for you, not part of the contract.

If you have signed a separate agreement with Venom (for example for an Enterprise plan), that agreement prevails where it conflicts with these Terms. The Data Processing Agreement prevails over these Terms for the processing of personal data.

Every version of these Terms carries a date. The current version is always at venomlabs.dev/terms, and each version we replace stays available at its own address (the previous one is at venomlabs.dev/terms/2026-11-11), so that you can store and print the version you accepted.

2. Who can use Venom

Venom is built for work: companies, teams, freelancers and developers using it for their job or their professional projects. It isn’t offered to consumers for purely personal use. To use the Service you must be at least 18, and by accepting these Terms you confirm that you are using it for your trade, business or profession.

3. Accounts and organizations

• You need an account to use the web app and the MCP server. Keep your sign-in details secure and tell us at support@venomlabs.dev if you think someone else has accessed your account.
• Work in Venom belongs to an organization. Its owners and admins decide who joins, which roles members have, and which teams and projects they can see. You are responsible for what happens under your account, including what the AI clients you connect do on your behalf, and your organization is responsible for its members’ use of the Service.

4. Your content

4.1 Your content is yours. The projects, tasks, task briefs, log entries, artifacts and their revisions, skills, settings and other material that you, your members and your AI agents put into the Service (“Customer Content”) belong to you or to those who licensed them to you. Venom gets no rights in Customer Content except the licence in 4.2.

4.2 The licence you give us. You give Venom a non-exclusive, royalty-free licence to host, store, copy, transmit, display and otherwise process Customer Content, only as needed to provide, secure and support the Service for you, to carry out your and your members’ instructions (including requests made by the AI clients you connect), and as the law requires. The licence covers every country where you and your members use the Service, and lasts while these Terms are in force and until Customer Content is deleted under section 9.

4.3 No training, and no use for our own purposes. Venom uses Customer Content only to provide, secure and support the Service for you, and as the law requires. Venom does not use Customer Content to train or improve AI or machine-learning models, does not sell it, does not use it for advertising, and does not use it for any other purpose of its own. Our staff look at Customer Content only when you ask us to, to keep the Service secure, to fix a fault, or when the law requires it. We will not change this section for Customer Content you have already put into the Service.

4.4 Usage data. We record information about how the Service is used, for example which features and MCP operations ran, for which account and organization, whether they succeeded and how long they took (“Usage Data”). Usage Data does not include Customer Content, except that an error report from the web app can occasionally quote content the app was working with, which we use only to fix the error. We use Usage Data to operate, secure, support, bill and improve the Service, as our Privacy Policy describes, and we may publish statistics that are aggregated so that they identify neither you nor any person.

4.5 Your responsibilities. You are responsible for having the rights to the Customer Content you add, and for making sure that it, and the way you use the Service, comply with the law and these Terms. Customer Content is visible to your organization’s members in line with its team and project settings.

4.6 Personal data. Where Customer Content includes personal data, we process it on your behalf under the Data Processing Agreement.

4.7 Feedback. If you send us ideas or suggestions about the Service, we may use them without any obligation to you.

5. Acceptable use and prohibited data

5.1 Acceptable use. You must not, and must make sure that your members and the AI clients you connect do not:

• (a) use the Service to break the law or to infringe anyone’s rights;
• (b) store or share malware or illegal content;
• (c) try to access accounts, organizations or data that are not yours, or get around the Service’s access controls, plan limits or rate limits;
• (d) probe, scan or load-test the Service, except as our vulnerability disclosure policy (venomlabs.dev/security/disclosure) allows;
• (e) put into the Service content, including skills, that is designed to make another person’s AI agent act against that person’s instructions or interests (for example, hidden instructions to copy data elsewhere);
• (f) use invitations or mentions to send messages to people who have not asked for them;
• (g) resell the Service, or use it to build a competing product, unless a separate agreement with Venom allows it; or
• (h) decompile or reverse engineer the Service, except as far as the law allows.

5.2 Prohibited data. Venom is built for coordinating work, not as a vault. What you put into it is visible to your organization’s members with access, can be read by every AI client they connect, can be quoted in notification emails, and is not scanned for secrets. Unless we have agreed otherwise in writing, do not put the following into projects, tasks, logs, artifacts or skills:

• (a) special categories of personal data (data about health, genetic or biometric data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life or sexual orientation) or data about criminal convictions and offences;
• (b) payment card data, such as card numbers or security codes; card payments for Venom go only through Stripe’s payment form;
• (c) production secrets, such as passwords, API keys, access tokens, private keys, connection strings or recovery codes; credentials for third-party MCP servers belong only in the credential fields the app provides for them, where we encrypt them with a dedicated key; and
• (d) government identification numbers, such as passport or national ID numbers.

5.3 If prohibited data gets in. AI agents sometimes write things they shouldn’t. If you, your members or your agents put prohibited data into the Service, delete it and rotate any exposed secret. Deleted and edited log entries stay recoverable for 30 days; if you need a copy purged sooner, ask support@venomlabs.dev and we will do it within 5 working days. If we become aware of prohibited data, we may ask you to remove it. We do not monitor Customer Content and have no obligation to do so.

6. Content rules, notices and points of contact

6.1 How we apply our rules. Section 5 sets out the restrictions we apply to information you store in the Service. We do not use automated tools to review Customer Content. We act on specific content only when we receive a notice under 6.2, an order from an authority, or a security alert (for example, about malware), and a person at Venom reviews each case.

6.2 Reporting illegal content. Anyone can tell us about specific content in the Service that they believe is illegal, by emailing support@venomlabs.dev with “Content notice” in the subject. Please include: why you believe the content is illegal; where exactly it is (for example, the address of the project, task or artifact); your name and email address; and a statement that you believe in good faith that your notice is accurate and complete. We confirm receipt without undue delay, decide in a timely, careful and objective way, and tell you our decision and how you can challenge it.

6.3 What we may do. If content is illegal or breaks section 5, we may remove it or disable access to it, or restrict or suspend the account or organization involved, in proportion to the problem and with due regard to the rights and interests of everyone involved. Unless the law or an authority prevents us, we tell the user concerned and the organization’s owners what we did and why: the facts, whether we acted on a notice, the legal or contractual ground, and how to challenge the decision.

6.4 Challenging a decision. You can ask us to review any decision under this section by replying to our message within 6 months. Someone at Venom who was not involved in the original decision reviews it and replies with reasons. You can also go to court (section 15).

6.5 Points of contact. Our single point of contact for users of the Service, and for the authorities of EU Member States, the European Commission and the European Board for Digital Services, is support@venomlabs.dev. You can write to us in English or Spanish.

7. AI clients, skills and connected services

Venom does not run AI models. You choose which AI clients (for example Claude, Claude Code, Codex, Cursor or VS Code) to connect to the Venom MCP server, and which third-party MCP servers you or your organization add. Those products are provided by their own vendors under their own terms; they are not Venom’s subprocessors, and Venom is not responsible for their output, for what they do with data they receive, or for their availability.

An AI client you connect acts with your permissions in the organization you approved: it can read and write what you can. Treat it as you would a colleague acting for you, and disconnect it in Settings → Agent connection when you no longer need it.

Skills and other content written by people and agents in your organization can be read and followed by your AI agents. Review skills before you enable them, and review what your agents write before you rely on it.

If you use the Venom Full plugin, its hooks send each shell command your agent runs to Venom so that we can recognise milestones such as running tests or pushing code. We don’t store the command, only which milestone it reached; still, don’t put secrets in command lines.

8. Plans, trial, billing and taxes

8.1 Plans. The Free plan costs nothing and has the limits shown on venomlabs.dev/pricing and in the app. Team and Business are paid plans that an organization’s owners and admins can buy in the app, billed monthly or yearly. Enterprise is available by separate contract. The prices and limits that apply to you are those shown when you buy or change a plan.

8.2 Free trial. Every new organization can use the Team plan free for 30 days, with no card. When the trial ends, the organization moves to the Free plan unless an owner or admin has bought a paid plan. Nothing is charged at the end of the trial and no Customer Content is deleted, but Free limits apply from then on (for example, you can’t create more projects than the Free plan allows). Buying a paid plan during the trial ends the trial and starts paid billing straight away.

8.3 Billable members. Paid plans are priced per billable member: active members of the organization who are not viewers. Invited people who haven’t joined, deactivated members and viewers are not billed. Every paid subscription is billed for at least one member.

8.4 Prices and taxes. Prices are in US dollars and exclude VAT and other taxes. You are responsible for any taxes that apply to your purchase, which are payable in addition to the price; if the law requires us to charge such a tax, we may add it to your invoice. Payments are processed by Stripe; we never receive your full card number.

8.5 Renewal. Subscriptions renew automatically at the end of each monthly or yearly billing period until they are cancelled.

8.6 Changes and prorations. When you change plan or billing period, the difference is prorated and charged straight away, and the new plan applies once that payment succeeds. When your number of billable members changes, the difference is prorated and added to your next invoice (on yearly plans, member changes are invoiced monthly). Prorations for member changes that are still owed when a subscription ends are invoiced after it ends.

8.7 Cancellation. Owners and admins can cancel in Settings → Billing. A cancelled subscription stays active until the end of the period already paid for; the organization then moves to the Free plan, and no Customer Content is deleted. Fees already paid are not refunded, except where these Terms or the Data Processing Agreement provide for a refund, or where the law requires one.

8.8 Failed payments. If a payment fails, you keep your plan while Stripe retries the payment. If it still can’t be collected, the organization moves to the Free plan. No Customer Content is deleted.

8.9 Price changes. We may change our prices for future billing periods. We will email your organization’s owners and admins at least 30 days before a new price applies to you, and you can cancel before it does.

8.10 Leaving a yearly plan early. We don’t charge early termination fees, switching charges or data export charges. If these Terms end before the end of a yearly plan, because you switch provider under section 9, because you end them under sections 10 or 14 or the Data Processing Agreement, or because we end them under section 13.3(a), we refund the fees paid for the remaining whole months.

9. Switching, export and the end of the Service

9.1 Your switching rights. This section gives you, on every plan including Free and the free trial, the rights that Chapter VI of the EU Data Act (Regulation (EU) 2023/2854) gives customers of data processing services. Our Data Act information page (venomlabs.dev/data-act) forms part of this section: it lists the export tools, formats and data structures, and the known limitations and risks.

9.2 What you can take with you. “Exportable Data” means the data that you, your members and your AI agents put into the Service and the data generated by your use of it, including metadata: projects (names, descriptions and overviews); tasks (briefs and statuses); log entries, including deleted entries still recoverable, with their authors, agent names and times; mentions; artifacts with all their revisions; skills with all their files; teams; your members’ names, handles and roles; your organization’s settings; the list of third-party MCP servers you added; and the last 30 days of records of your agents’ activity. Exportable Data does not include the following, because they are specific to how our service works internally and would reveal our trade secrets or compromise security: our security, server and firewall logs; our internal product analytics; and secret values (the third-party credentials and MCP tokens we store), which we never export; you can enter credentials again with your new provider. These exclusions don’t limit your or anyone’s rights over personal data under the GDPR.

9.3 Export at any time. You can export Exportable Data at any time, free of charge, through the MCP server, which uses the open Model Context Protocol and returns structured JSON, and through the web app. You can also ask support@venomlabs.dev for a complete copy of your organization’s Exportable Data, in JSON with skills and artifacts as their original files; we provide it within 30 days, free of charge.

9.4 Switching notice. To switch to another provider or to your own infrastructure, or to have your Exportable Data erased, an owner of your organization sends a switching notice to support@venomlabs.dev with “Switching notice” in the subject. The notice says:

• (a) whether you want to switch to another provider (give its name if you want us to work with it), switch to your own infrastructure, or only have your Exportable Data erased;
• (b) the date on which you want the switching process to start, which can be up to two months after your notice; if you don’t give a date, it starts when we confirm your notice; and
• (c) whether the notice covers your whole organization.

We confirm receipt within 3 working days.

9.5 Transitional period. The switching process starts on the date in your notice and lasts up to 30 calendar days (the “transitional period”). During it, your plan and these Terms remain in force and we:

• (a) keep providing the Service with due care, to maintain your business continuity;
• (b) give you, and third parties you authorise, reasonable assistance, including all the information relevant to your exit;
• (c) tell you clearly about any known risks to the continuity of the Service; and
• (d) keep a high level of security throughout, including for your data while it is transferred and during the data retrieval period.

You can extend the transitional period once, for the time you consider appropriate for your purposes, by telling us before it ends. If a 30-day transitional period is technically unfeasible, we tell you within 14 working days of your switching notice, explain why, and propose an alternative period of no more than 7 months, during which the Service continues.

9.6 When the contract ends. These Terms end for your organization: (a) when you tell us that the switching process has been completed successfully; or (b) if you asked only for erasure, at the end of the notice period. We then confirm the end of the Terms to you. If an event that would otherwise end these Terms happens during the switching process, the Terms continue until the switching process is complete, unless the law requires otherwise.

9.7 Data retrieval period. After the transitional period you have at least 30 calendar days (the “data retrieval period”) to retrieve your Exportable Data, during which your organization stays available to you for that purpose. We can agree a longer period.

9.8 Erasure. At the end of the data retrieval period, and provided the switching process has been completed, we erase all Exportable Data generated by you or relating to you directly, and confirm this to you in writing. We keep only data that EU or Spanish law requires us to keep, such as billing records, which we keep for 6 years; our confirmation says what we keep, for how long and why. Copies in our backups expire within 100 days.

9.9 No charges. We don’t charge for switching, exporting your data or data egress.

9.10 If we end the Terms. If we end these Terms or close your organization for any reason other than an emergency under section 13.2, you keep your rights under this section, counting from our notice.

9.11 Notices. Notices under this section are made by email between an owner of your organization and support@venomlabs.dev.

10. Availability and changes to the Service

We work to keep the Service available and secure, but we don’t promise that it will be uninterrupted or error-free. Self-serve plans have no service level commitment; Enterprise customers can agree one in their contract. We may add, change or remove features. If we remove a feature that is a material part of a paid plan you are on, we tell your organization’s owners at least 30 days in advance; if the change materially reduces the Service for you, you can end these Terms before it takes effect and we refund the fees paid for the period after that.

11. Confidentiality

11.1 “Confidential Information” means information that one party (the “discloser”) gives the other (the “recipient”) in connection with the Service and that is marked as confidential or that a reasonable person would understand to be confidential. Customer Content is always your Confidential Information.

11.2 The recipient uses the discloser’s Confidential Information only to perform these Terms, protects it with at least the care it uses for its own confidential information and never less than reasonable care, and shares it only with its staff, contractors and subprocessors who need it for that purpose and are bound by confidentiality duties at least as protective as this section.

11.3 This section doesn’t apply to information that is or becomes public without the recipient’s fault, that the recipient already lawfully had, that it develops independently, or that it lawfully receives from a third party without a duty of confidentiality.

11.4 The recipient may disclose Confidential Information when the law, a court or an authority requires it. Where the law allows, it tells the discloser first so that the discloser can object, discloses only what is required, and, if the request comes from an authority outside the EU, applies the safeguards described on our Data Act information page.

11.5 These duties last while these Terms are in force and for 5 years after they end, and, for Customer Content and trade secrets, for as long as the information stays confidential.

12. Warranties, liability and indemnity

12.1 What we promise. We provide the Service with reasonable skill and care and as described in these Terms, the Data Processing Agreement and our Security page. Beyond that, and to the extent the law allows, we make no other promises about the Service, including that it will meet requirements you haven’t agreed with us. AI clients act on your instructions; you are responsible for reviewing what they read from and write to your workspace.

12.2 Liability that is not limited. Nothing in these Terms limits or excludes either party’s liability:

• (a) for intentional acts (dolo) or gross negligence;
• (b) for Venom’s breach of section 4.3 (no use of your content for our own purposes);
• (c) for death or personal injury caused by negligence;
• (d) for your obligation to pay fees, or your obligations under section 12.6; or
• (e) that the law does not allow to be limited or excluded.

12.3 Losses we are not liable for. Except under 12.2, neither party is liable for loss of profits, revenue or business opportunities, or for any other loss that was not foreseeable when you accepted these Terms. Loss or corruption of Customer Content is not excluded by this section; Venom’s liability for it is limited to restoring the content from the most recent copy available to Venom and, where that isn’t possible, to the amounts in 12.4, and does not include any part of the loss that you could have avoided by keeping a copy using the export tools in section 9.3.

12.4 General limit. Except under 12.2 and 12.5, each party’s total liability arising out of or in connection with these Terms and the Service, for all events in any 12-month period, is limited to the greater of:

• (a) the fees paid and payable by you for the Service in the 12 months before the first event giving rise to liability; and
• (b) €1,000.

12.5 Higher limit for data protection, security and confidentiality. For Venom’s breach of the Data Processing Agreement, of its security obligations or of section 11, Venom’s total liability, for all events in any 12-month period, is limited instead to the greater of:

• (a) three times the fees paid and payable by you for the Service in the 12 months before the first event giving rise to liability; and
• (b) €10,000.

12.6 Your indemnity. You will compensate Venom for losses, including reasonable legal costs, arising from third-party claims that Customer Content, or your or your members’ use of the Service in breach of section 5, infringes the law or a third party’s rights, provided that Venom tells you about the claim promptly, lets you conduct the defence and any settlement, and cooperates reasonably at your cost.

12.7 Data subjects. Nothing in these Terms limits either party’s liability to data subjects under Article 82 of the GDPR.

12.8 Each party must take reasonable steps to limit its losses.

13. Suspension and termination

13.1 You can stop using the Service at any time. To end these Terms for your organization, its primary owner cancels any paid plan and deletes the organization in Settings, or an owner sends a switching notice under section 9. To have your personal account deleted, email support@venomlabs.dev; we delete it within one month.

13.2 We may suspend an account or organization straight away where that is necessary to prevent serious harm: an active security threat to the Service or other customers, malware, illegal content under section 6, or an order from an authority. We limit the suspension to what is necessary and lift it as soon as the reason is gone.

13.3 We may end these Terms for an organization:

• (a) for any reason, with at least 60 days’ notice;
• (b) with 30 days’ notice, if you seriously or repeatedly break these Terms and don’t put it right within that period; or
• (c) straight away, where the law or an authority requires it.

13.4 When we suspend or end the Service for you, we tell your organization’s owners the reasons, as section 6.3 describes. Except where the law or an authority prevents it, you keep the ability to read and export your Customer Content, and the switching, retrieval and erasure rights in section 9 apply.

13.5 Sections 4.1, 9.7, 9.8, 11, 12 and 15, and any provision that by its nature should continue, survive the end of these Terms.

14. Changes to these Terms

14.1 We may change these Terms for a valid reason: to reflect changes to the Service or our business, to comply with the law or a decision of an authority, or to improve security.

14.2 For any change that is not solely in your favour, we email your organization’s owners (and, where useful, show a notice in the app) at least 30 days before the change takes effect. The notice explains what changes, why, and how it affects you, and links to the new version. A change that the law or an authority requires may take effect sooner, if that is what the law or the authority requires.

14.3 If you don’t agree with a change, you can end these Terms before it takes effect, at no cost; we refund the fees paid for the period after termination, and you keep your rights under section 9. If you keep using the Service after the change takes effect, the new version applies to you.

14.4 We will not use a change to these Terms to allow any use of Customer Content you have already put into the Service that section 4.3 rules out, or to store Customer Content outside the EU, without your express agreement.

14.5 Changes that are solely in your favour, such as a new feature or a lower price, can take effect straight away.

15. Governing law and disputes

15.1 These Terms, and any non-contractual obligations arising out of or in connection with them, are governed by Spanish law.

15.2 Before bringing a claim, the party with the complaint sends the other a written description of it, and both parties try in good faith to resolve it by negotiation for at least 30 days. This negotiation is the prior attempt at an appropriate means of dispute resolution required by article 5 of Spain’s Organic Law 1/2025.

15.3 The courts of the city of Málaga, Spain, have exclusive jurisdiction over any dispute arising out of or in connection with these Terms. Either party may ask any competent court for urgent interim measures, and Venom may claim unpaid fees in the courts where you are established.

16. General

16.1 Language. These Terms are concluded in English. Any translation is for information only; if they differ, the English version prevails.

16.2 Online contracting. You can review and correct the details you enter before you create your account or buy a plan, and change them later in Settings. We keep every version of these Terms available at its own address (section 1). Because neither of us is a consumer, we agree that no further information or confirmation is needed under articles 27 and 28 of Spain’s Law 34/2002.

16.3 Notices. We send notices to the email addresses of your organization’s owners (and, where these Terms say so, its admins) and, where useful, in the app. You send notices to support@venomlabs.dev.

16.4 Assignment. You may transfer these Terms only with our written consent, except to a successor to your business. We may transfer them to a successor to our business, for example in a merger or acquisition, if we tell you and the successor takes on our obligations to you.

16.5 Events beyond control. Neither party is liable for a failure caused by events that could not be foreseen or, if foreseeable, could not be avoided, as long as it tells the other party promptly and takes reasonable steps to limit the effects. This does not affect your payment obligations or our obligations under the Data Processing Agreement to notify breaches.

16.6 Severability. If a provision of these Terms is invalid or not binding, the rest of the Terms remain in force.

16.7 No waiver. Not enforcing a provision straight away does not waive the right to enforce it later.

16.8 Entire agreement. These Terms, together with the documents listed in the introduction, are the whole agreement between you and Venom about the Service, and replace any earlier terms for the Service.

17. Contact

Questions about these Terms: support@venomlabs.dev.

18. Legal notice

The information that Spain’s Law 34/2002 on information society services (LSSI) requires in its article 10, and the points of contact that the EU Digital Services Act requires in its articles 11 and 12:

• Company: Venom Labs, S.L.
• NIF: B05853908
• Registered office: Urbanización Reserva de Marbella, Fase 2, Manzana 3, Bloque 7, Piso 7309, 29604 Marbella (Málaga), Spain
• Registration: Registro Mercantil de Málaga, inscripción en trámite
• Email: support@venomlabs.dev
• Prices: shown in US dollars, excluding VAT and other taxes.
• Codes of conduct: Venom has not signed up to any code of conduct.
• Point of contact for authorities and for users (Digital Services Act, articles 11 and 12): support@venomlabs.dev. You can write to us in English or Spanish.