Privacy Policy

1. Who we are and who this covers

Venuely is operated by [LEGAL_ENTITY_NAME], registered at [LEGAL_ENTITY_ADDRESS]. For anything in this policy, write to support@venuely.mena-x.com.

This policy covers two different groups. The first is venue staff who hold a Venuely account. The second is the venue's own clients and their guests, whose details a venue enters into Venuely.

2. Controller and processor

For account and billing data belonging to venue staff, we are the controller. We decide what we collect and why.

For everything a venue records about its clients and their guests, the venue is the controller and we are the processor. We hold and process that data on the venue's instructions, to run the service. We do not use it for our own purposes.

If you are the client or guest of a venue and want your data corrected or removed, contact the venue directly. If you contact us instead, we will pass your request to the venue and tell you we have done so.

3. What we collect

Account data, which you give us when you sign up:

• your name, email address and preferred language
• your password, which we store only as a hash and never in readable form
• whether your email address has been verified
• your Google account identifier, name and email address, but only if you choose to sign in with Google

3.1 Venue and business data

What you set up in the dashboard: venue name, address, phone numbers, logo and photographs, packages, prices, settings, and the content of your public page.

3.2 Your clients' and guests' data

This is data you enter, not data we collect from those people directly. It typically includes:

• names, phone numbers and email addresses of clients
• event dates, event types and the notes you record about a booking
• guest lists, invitation recipients and RSVP responses
• payments, security deposits, refunds, invoices and outstanding balances
• supplier and expense records connected to an event

3.3 Technical data

We keep a session cookie named venuely_session so you stay signed in, and your language choice. When someone opens a digital invitation, their browser stores a randomly generated identifier locally for about 30 days so the same visitor is not counted twice. That identifier is not linked to a name.

Our servers keep operational logs. We do not run advertising trackers or third party analytics on Venuely.

4. Why we use it

We use personal data to:

• give you access to your account and keep it secure
• run the features you use: reservations, invoices, deposits, inventory, invitations and reports
• send transactional email such as address verification, password resets and reminders
• take and record subscription payments, and issue refunds
• keep backups so data can be restored after a failure
• detect and prevent abuse of the service
• meet obligations that the law puts on us, including tax record keeping

5. Legal basis

We process account and billing data because we need it to provide the service you asked for and to meet our legal obligations. We process other data on the venue's instructions as its processor. Where the law requires consent, we ask for it and you can withdraw it.

Where it applies to us, we look to Egypt's Personal Data Protection Law No. 151 of 2020. This paragraph in particular should be checked by a lawyer.

6. Where your data is stored

Venuely runs on a server we operate on Oracle Cloud Infrastructure, in Oracle's Jeddah region in Saudi Arabia. The database is PostgreSQL, running on that server and managed by us rather than by a cloud database provider. Files you upload, including photographs and documents, are stored in object storage on the same server.

Backups of the database run every night. The dump is encrypted with AES-256 as it is produced, so an unencrypted copy is never written to disk, and each encrypted backup is kept for 14 days and then deleted. Those backups currently sit on the same server as the live data. A copy to separate off-site storage is configured but not yet switched on, so at the moment we do not hold an off-site copy.

This means personal data collected in Egypt is stored in Saudi Arabia. Egypt and Saudi Arabia each have their own data protection law, and this transfer is not covered by any European adequacy arrangement, so it stands on its own footing. If you are a venue, you need to be comfortable with that transfer, your own clients should be told about it where the law requires, and a lawyer should confirm what the transfer needs in order to be lawful before you rely on this page.

7. Who else touches your data

These are the only third parties involved in running Venuely:

• Paymob, in Egypt, processes subscription card payments. Card details are entered on Paymob's hosted checkout and never reach our servers. We receive a payment reference, the amount and whether it succeeded.
• Oracle Corporation provides the Oracle Cloud Infrastructure server and storage the data sits on, in its Jeddah region in Saudi Arabia.
• Cloudflare provides DNS for our domains, sits in front of public pages, and delivers our transactional email. It handles email content in transit and sees visitors' IP addresses.
• Google is involved only if you choose to sign in with a Google account, in which case Google confirms your identity to us. Separately, our pages load an icon font from Google Fonts, which means Google receives the IP address of anyone who loads a page.
• We may share data where a court or a competent authority lawfully requires it.

7.1 What we do not do

We do not sell personal data. We do not share it with advertisers, data brokers or ad networks, and we do not use your clients' contact details to market anything to them.

8. How long we keep data

While your account is active, we keep your data so the service works.

If a free trial is not converted to a paid plan, the venue goes through a 7 day grace period, is then suspended and taken offline, and is permanently deleted 7 days after that. Cancelled paid accounts follow the same path.

Deleted data is removed from the live system immediately. Because encrypted backups are kept on a rolling 14 day window, a copy can remain in a backup for up to 14 more days until that backup is deleted in turn.

We may keep financial records for longer where tax or accounting law requires it.

9. Security

Passwords are stored as hashes, never in readable form. Each venue's data is isolated in the database using PostgreSQL row level security, so one venue's queries cannot reach another venue's rows. Traffic to and from Venuely is encrypted with TLS. Access to the server is restricted to named administrators using key based authentication. Nightly backups are encrypted with AES-256 before they reach disk, and we have rehearsed a restore from an encrypted backup and confirmed the recovered data was correct.

No system is completely secure. If a breach affects your personal data, we will tell you and the relevant authority as the law requires, and explain what happened and what we are doing about it.

10. Your rights

Depending on the law that applies to you, you can ask us to:

• give you a copy of the personal data we hold about you
• correct data that is wrong or incomplete
• delete your data
• stop or limit a particular use of your data
• export your data in a machine readable form
• withdraw a consent you gave us

10.1 How to ask

Email support@venuely.mena-x.com from the address on your account and say what you want. We will reply as soon as we can and in any case within 30 days. We may need to confirm who you are before we act, so that nobody else can request your data.

To delete a whole venue and everything in it, email support@venuely.mena-x.com and ask us to delete it. We will confirm what will be removed, delete it from the live system, and confirm when it is done. Deletion is permanent, so export what you need first.

If you are the client or guest of a venue, contact that venue. It decides what happens to its own records.

11. Children

Venuely is for businesses and is not directed at children. Do not open an account if you are under 18. If a guest list includes a child, record no more about them than the event actually needs.

12. Changes to this policy

We may update this policy. The current version is always on this page with its effective date at the top. If a change materially affects how we handle your data, we will email the address on your account before it takes effect.

13. Contact

[LEGAL_ENTITY_NAME], [LEGAL_ENTITY_ADDRESS]. Email: support@venuely.mena-x.com.