Privacy Policy

This policy explains what personal data Venom collects when you use the Venom website, web app, and MCP server (together, the “Service”), how we use it, who processes it for us, how long we keep it, and the choices you have. The Service is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS] (“Venom”, “we”, “us”).

Who is responsible for your data

Venom is built for organizations. When your organization uses Venom, it decides what work is stored in its workspace, and Venom processes that content on its behalf. For your account details, billing, and the operation of the Service, Venom is responsible for your data.

What we collect

Account information

• Your name, email address, whether your email is verified, and an optional avatar.
• Your sign-in credentials, managed by Amazon Cognito. If you sign in with Google, we receive your name and email address from Google. We never see your Google password.
• Your organizations, teams, roles, and the handle you use in each organization, including handles on other services that your organization links to you (for example, a GitHub username).

Workspace content

The projects, tasks, task briefs, log entries, artifacts, skills, and settings that you, your teammates, and your AI agents create in Venom. Earlier revisions of artifacts are kept so you can go back to them.

Connections and credentials

• When you connect an AI client (for example Claude, Claude Code, Cursor, or VS Code) to the Venom MCP server, we store the access and refresh tokens we issue to it. We store them only as one-way SHA-256 hashes, so they can’t be read back. We also store the name the client reports for itself, which labels the entries it writes.
• When your organization adds third-party MCP servers to Venom, we store their API keys, and your personal sign-in tokens for them, encrypted with AWS Key Management Service.

Activity records

For each operation an agent performs through the MCP server, we record which operation ran, which client ran it, who it ran for, whether it succeeded, and how long it took. These records don’t include the content that was read or written.

Billing information

If your organization subscribes to a paid plan, Stripe processes the payment. We receive and store the subscription status and the Stripe customer and subscription identifiers. We never receive your full card number.

Email

We send invitations, account verification, password resets, and notifications (for example, when someone mentions you) from our own domain through Amazon SES. If you email us, we keep that correspondence to answer you.

Cookies and browser storage

The marketing website sets no cookies and uses no analytics or advertising trackers. The web app uses your browser’s local and session storage only to keep you signed in, remember the organization you selected, and keep interface preferences such as expanded sections. We don’t use third-party analytics, advertising or tracking technologies.

How we use your data

• To provide the Service: sign you in, show and store your organization’s work, and answer requests from the AI clients you connect.
• To check, on every request, that you’re a member of the organization and have permission for what is asked.
• To send the emails described above.
• To bill paid plans.
• To keep the Service secure and reliable, and to investigate abuse, errors, and outages.
• To respond to support requests.

We do not sell your personal data. We don’t use your workspace content for advertising, and we don’t use it to train AI models.

[LEGAL BASES FOR PROCESSING (e.g. contract, legitimate interests) — confirm with counsel]

AI clients and connectors

Venom does not run AI models. When you connect an AI client such as Claude to Venom, that client reads and writes your workspace through the Venom MCP server, only as you or your agent request it, and only within the organization you approved when you connected. Whatever the client receives from Venom is then handled under its provider’s own terms and privacy policy. For Claude, that is Anthropic’s. Venom does not read your conversations with the AI client. Venom receives only the tool requests the client sends.

When your organization connects third-party MCP servers through Venom, Venom forwards your agent’s requests to those servers with the stored credentials. Those services handle the data under their own privacy policies.

Where your data is stored and how it is protected

The Service runs on Amazon Web Services in the EU (Ireland, eu-west-1). All traffic to the Service is encrypted with HTTPS. Third-party credentials are encrypted with AWS Key Management Service, and the tokens we issue are stored only as hashes. Access to organization data is checked against your live membership on every request.

Who we share data with

We share personal data only with the service providers that help us run Venom, and only as far as they need it to do that work:

• Amazon Web Services: hosting, databases, file storage, sign-in (Amazon Cognito), email delivery (Amazon SES), and encryption keys. EU (Ireland).
• Stripe: payment processing for paid plans.
• Google: optional “Sign in with Google”, and Google Workspace for our own support email.

Your workspace content is visible to the members of your organization, in line with its team and project settings. We may also disclose data when the law requires it, or to protect the rights and safety of our users and of Venom. If Venom is involved in a merger or acquisition, data may transfer to the successor under this policy.

[INTERNATIONAL TRANSFERS (e.g. Stripe and Google outside the EU) AND SAFEGUARDS SUCH AS STANDARD CONTRACTUAL CLAUSES — confirm]

How long we keep data

• Account and workspace data: for as long as your account or organization exists.
• Deleted or replaced log entries: recoverable for 30 days, then removed.
• Artifact revisions: kept for the lifetime of the organization.
• MCP access tokens expire after 1 hour, and refresh tokens after 30 days of non-use.
• Activity records: [RETENTION PERIOD].
• After you delete your account or organization: [DELETION AND BACKUP PERIOD].
• Billing records: as long as tax and accounting law requires.

Your rights and choices

You can view and update your profile in the web app. You can disconnect an AI client or a third-party MCP server at any time. Depending on where you live, you may also have the right to access, correct, export, or delete your personal data, to object to or restrict how we use it, and to complain to your data protection authority. To make a request, email support@venomlabs.dev. If your data is part of an organization’s workspace, we may refer the request to that organization’s owners.

Children

Venom is a workplace tool and is not directed to children. We don’t knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

If we change this policy, we’ll update the date above. If a change is significant, we’ll notify account owners by email or in the app before it takes effect.

Contact

Questions or requests about privacy: support@venomlabs.dev.
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]