Privacy Notice

1. Who we are

Veniufy operates a venue-booking platform serving Florida and Puerto Rico. This notice covers the website, the booking flow, and the owner dashboard.

Two kinds of people use the platform, and the distinction matters throughout this notice. Venue owners subscribe to list and manage a venue. Renters book a venue for an event. A venue owner is an independent business; they are responsible for their own venue, their own policies, and their own conduct toward renters.

2. What we collect, and why

We collect the following, and nothing beyond it:

• 2.1 Account details — email address, name, chosen language, and a password stored only as a bcrypt hash. If you sign in with Google we store the Google account identifier and the profile name and picture Google returns. We never receive your Google password.
• 2.2 Booking details — the venue, date, time, guest count, event type, and any notes you write. For bookings made through a shared link we also store the contact name, email, and phone you enter.
• 2.3 Agreement records — when you sign a contract we record the signature you draw or type, the exact text you agreed to, the time, your browser's user-agent string, and a one-way hash of your IP address. This is the evidence that makes the signature meaningful; it is retained for the life of the agreement and cannot be altered afterwards.
• 2.4 Payment records — the amount, currency, status, and the identifiers Stripe gives us. We never receive your card number, CVC, or bank details. Those go from your browser directly to Stripe.
• 2.5 Photos and video you upload of a venue, and any caption you give them.
• 2.6 Technical logs — one record per request containing a request identifier, your account identifier if signed in, and one-way hashes of your IP address and session identifier. Request bodies are never logged, so what you type into a form does not reach our logs.

3. What we do not do

These are commitments, not aspirations:

• 3.1 We do not sell personal information, and we do not share it with anyone for advertising or marketing purposes.
• 3.2 We do not use tracking or advertising cookies. The only cookie we set is the one that keeps you signed in.
• 3.3 We do not build advertising profiles, and we do not enrich your record with data bought from third parties.
• 3.4 We do not read your booking notes or messages for any purpose other than operating the service and responding to a support request or a legal obligation.

4. Who else processes your information

We use a small number of service providers. Each receives only what it needs to do its job, and none is permitted to use your information for its own purposes:

• 4.1 Stripe — payment processing and payouts. Stripe receives your payment details directly and acts as an independent controller for them under its own privacy policy.
• 4.2 Mailgun — sending transactional email such as verification codes, booking confirmations, and contract links.
• 4.3 Amazon Web Services — hosting, the database, and storage of uploaded photos and executed contract documents.
• 4.4 Cloudflare — serving the website and filtering malicious traffic.

5. What venue owners can see

When you book a venue, that venue's owner receives your name, email, phone if you provided one, and the details of your booking. They need this to host your event. They do not receive your payment details, your password, or any information about bookings you have made at other venues.

A venue owner is an independent business and is responsible for how they handle information you give them directly.

6. How long we keep it

Account and booking records are kept while your account is open and afterwards only for as long as we need them for tax, accounting, and dispute-resolution purposes.

Signed contracts, the evidence attached to them, and financial records are kept for the life of the agreement and any period a claim could still be brought. These records are deliberately immutable — a signed agreement that could be edited afterwards would be worthless to either party.

Technical logs are rotated and deleted on a rolling basis and are not retained long-term.

7. How we protect it

Traffic to the site is encrypted in transit. Passwords are stored only as bcrypt hashes and cannot be read by us or recovered. Executed contracts and signature images are held in private storage that is not reachable from the public web and can only be retrieved by the parties to the agreement. IP addresses and session identifiers in our logs are one-way hashed rather than stored in the clear.

No system is perfectly secure. If a breach affects your personal information we will tell you and the relevant authorities without undue delay, and we will tell you what actually happened rather than the least alarming version of it.

8. Your choices and rights

You may ask us to do any of the following, and we will not charge you or make it difficult:

• 8.1 Get a copy of the personal information we hold about you.
• 8.2 Correct anything that is wrong — most of it you can edit yourself in your account.
• 8.3 Delete your account and the personal information attached to it. Records we are legally required to keep — signed agreements, payment and tax records — will be retained, and we will tell you exactly what was kept and why.
• 8.4 Stop receiving non-essential email. Transactional messages such as verification codes and booking confirmations are part of the service and cannot be switched off while your account is open.

Write to [email protected], or use the contact form at /contact. We aim to respond within 30 days.

9. Children

The platform is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, tell us and we will delete it.

10. Changes to this notice

This notice is versioned. When we change it we publish a new version number and effective date. For a change that materially affects your rights we will notify account holders by email before it takes effect, rather than relying on you to notice.