Privacy notice · VenueMind Docs

Collected and excluded data

Stored: account identity, organization membership, venue geometry, briefs, Plans, Proposals, comments, approvals, aggregate operations, incidents, and audit evidence.
Excluded by design: attendee records, individual check-in events, raw integration credentials, free-form accessibility records, and retained generated export files.
Browser recovery stores the current Project envelope locally; Cloudflare D1 stores durable application state. Vercel serves the frontend and Cloudflare runs the API Worker.
Diagnostics use allowlisted bounded metadata and never raw geometry, Project payloads, identity attributes, cookies, credentials, or comment content.
Optional product analytics is off by default and stores only daily counts across fixed event, outcome, stage, and error-category dimensions. It excludes raw events, geometry, content, URLs, free text, credentials, and object, Project, or user identifiers.

VenueMind processes data to authenticate users, keep Project state, validate and simulate Plans, coordinate supervised review, generate requested exports, secure the service, and measure aggregate product friction when analytics is enabled. Product analytics cannot grant automation authority, change supervision, or weaken Validation. Project data is not sold or used to train a model by VenueMind.

Vercel processes frontend requests; Cloudflare processes API and D1 data. Their own service terms govern their infrastructure handling.
Hashed share tokens allow the recipient selected by a user to read a bounded shared review. Revocation immediately removes that access.
External adapters receive only the scoped values required for the configured operation; secret values remain environment bindings.

Retention, export, and deletion

Project content remains until deletion; deleted Projects default to 30 days of recovery before primary purge.
Operational-sensitive records default to 365 days and security evidence to 400 days. Organization administrators may select only the documented bounded ranges.
Account export includes identity, memberships, relevant organization audit events, and Projects. Project exports are generated on demand and are not retained by VenueMind.
Project deletion purges browser recovery immediately and D1 data at the configured deadline. Provider backups expire under the documented provider boundary after primary purge.
Account deletion revokes sessions, suspends memberships, and anonymizes identity fields while retaining opaque security evidence until expiry.
Content-free product-analytics aggregates expire after 180 days and cannot be linked to an account, user, Project, or object.

Full data-protection contract

Your controls

Export Project or account data from the product controls before deletion.
Delete a Project with its exact-name confirmation or delete the account from organization settings.
Product analytics is off by default. Settings provides deterministic opt-in and opt-out; essential integrity and security logs remain active.
Revoke shared-review links and external adapter grants when no longer needed.

Product analytics contract

Collected and excluded data

Stored: account identity, organization membership, venue geometry, briefs, Plans, Proposals, comments, approvals, aggregate operations, incidents, and audit evidence.
Excluded by design: attendee records, individual check-in events, raw integration credentials, free-form accessibility records, and retained generated export files.
Browser recovery stores the current Project envelope locally; Cloudflare D1 stores durable application state. Vercel serves the frontend and Cloudflare runs the API Worker.
Diagnostics use allowlisted bounded metadata and never raw geometry, Project payloads, identity attributes, cookies, credentials, or comment content.
Optional product analytics is off by default and stores only daily counts across fixed event, outcome, stage, and error-category dimensions. It excludes raw events, geometry, content, URLs, free text, credentials, and object, Project, or user identifiers.

Purpose and sharing

Vercel processes frontend requests; Cloudflare processes API and D1 data. Their own service terms govern their infrastructure handling.
Hashed share tokens allow the recipient selected by a user to read a bounded shared review. Revocation immediately removes that access.
External adapters receive only the scoped values required for the configured operation; secret values remain environment bindings.

Retention, export, and deletion

Project content remains until deletion; deleted Projects default to 30 days of recovery before primary purge.
Operational-sensitive records default to 365 days and security evidence to 400 days. Organization administrators may select only the documented bounded ranges.
Account export includes identity, memberships, relevant organization audit events, and Projects. Project exports are generated on demand and are not retained by VenueMind.
Project deletion purges browser recovery immediately and D1 data at the configured deadline. Provider backups expire under the documented provider boundary after primary purge.
Account deletion revokes sessions, suspends memberships, and anonymizes identity fields while retaining opaque security evidence until expiry.
Content-free product-analytics aggregates expire after 180 days and cannot be linked to an account, user, Project, or object.

Full data-protection contract

Your controls

Export Project or account data from the product controls before deletion.
Delete a Project with its exact-name confirmation or delete the account from organization settings.
Product analytics is off by default. Settings provides deterministic opt-in and opt-out; essential integrity and security logs remain active.
Revoke shared-review links and external adapter grants when no longer needed.

Product analytics contract