Privacy Policy

We collect the following categories of information:

• Account information: your name, email address, phone number, password (stored only as a cryptographic hash by our authentication provider), venue name, and role within the venue.
• Customer information you store: names, email addresses, phone numbers, event details, notes, documents, contracts, invoices, estimates, and payment records that you or your staff enter into or collect through the Services. For this information, the Subscriber is the data controller and Venue Nest acts as a processor on the Subscriber’s behalf.
• Communications: email and text (SMS) messages sent and received through connected channels, including message content and attachments, so the Services can show conversation history.
• Payment information: when you or your Customers pay through the Services, payment is processed by Stripe. We store transaction records (amounts, dates, card brand, and last four digits) but never full card numbers or security codes.
• Google user data: if you connect a Google account, we access Gmail and Google Calendar data as described in Section 3.
• Technical information: log data, IP addresses, browser type, and error reports needed to operate and secure the Services. We do not use third-party advertising trackers or sell advertising.

We use the information we collect to:

• Provide, operate, and maintain the Services, including CRM, calendars, messaging, invoicing, contracts, and automations the Subscriber configures.
• Send messages the Subscriber composes or schedules (for example appointment confirmations and payment reminders) to the Subscriber’s Customers by email or SMS.
• Process payments and maintain billing records.
• Secure the Services, prevent abuse, and debug errors.
• Communicate with Subscribers about their account and the Services.

We do not sell personal information, and we do not use the contents of your messages, documents, or calendars for advertising.

If you choose to connect your Google account, Venue Nest requests the following scopes, and uses each only as described:

• Read Gmail messages (gmail.readonly): we sync messages from your Inbox and Sent folders (only those two labels) so your venue’s client conversations appear in the Venue Nest inbox. Message content, headers needed for threading, and attachments are stored in our database so your team can read and reply to conversation history.
• Send email (gmail.send): we send messages that you or your configured automations compose, from your own Gmail address. We do not send email from your account except at your or your automation’s direction.
• View and edit calendar events (calendar.events): we import events from the calendars you select so availability and bookings appear in Venue Nest, and we create, update, and delete mirrored copies of Venue Nest appointments on your primary Google calendar so your availability stays accurate.
• List your calendars (calendar.calendarlist.readonly): shown once at setup so you can choose which calendars to sync.
• Email address and sign-in (userinfo.email, openid): used to identify which Google account is connected.

OAuth tokens are encrypted at rest with AES-256-GCM and are readable only by our server-side processes — never by browser sessions or other users. Google message and calendar content is never used for advertising, is never sold, and is never used to train artificial-intelligence or machine-learning models, whether ours or anyone else’s. Humans at Venue Nest do not read your Google data except with your explicit permission for support, where required for security or abuse investigation, or where required by law. Venue Nest’s in-app assistant does not read your email or calendar content.

When you disconnect Google (or delete your account), we stop all access, revoke the OAuth token with Google, delete synced Gmail messages from our systems, delete imported Google Calendar events, and remove the mirrored Venue Nest copies from your Google calendar. Deletion happens immediately on disconnect.

Venue Nest's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We share information only with service providers that help us operate the Services, under agreements that limit their use of the data to providing their service to us:

• Supabase (database and authentication hosting).
• Vercel (application hosting and file storage).
• Stripe (payment processing).
• Quo (business phone and SMS delivery for connected phone channels).
• Google (when you connect Gmail or Google Calendar, as described above).
• Sentry (error monitoring; reports are scrubbed of tokens and sensitive values before sending).

We may also disclose information when required by law, to protect the rights and safety of Venue Nest and its users, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to previously collected data). We never share Google user data with advertising platforms, data brokers, or information resellers.

All traffic to the Services is encrypted in transit with TLS. Data is encrypted at rest by our hosting providers, and high-sensitivity values (OAuth tokens and integration credentials) carry an additional layer of application-level AES-256-GCM encryption. Access to Customer data within a venue is controlled by per-venue isolation enforced in the database (row-level security) and by the roles and permissions the Subscriber assigns to staff.

We retain information for as long as the Subscriber’s account is active and as needed to provide the Services. Specifically:

• Disconnecting an integration (Google, phone) immediately deletes the messages and events synced through it, as described in Section 3.
• Subscribers can delete Customer records; records tied to financial history (invoices, estimates, payments) are archived instead of destroyed, because those are business records the venue is typically required to keep.
• To delete your account and its data entirely, contact us at the address below and we will complete the deletion within 30 days, except for records we are legally required to retain.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Subscribers can exercise most of these directly in the product; for anything else, contact us and we will respond within the time required by applicable law. If you are a Customer of one of our Subscribers, the venue you did business with is the controller of your information — we will refer your request to them and assist them in honoring it.

The Services are business software, are offered only to users 18 and older, and are not directed to children. We do not knowingly collect personal information from children under 13; if you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will notify Subscribers by email or an in-product notice before the change takes effect, and we will update the effective date above. Continued use of the Services after a change takes effect constitutes acceptance.

Questions about this policy or our data practices: support@venuenest.com. Venue Nest, LLC, Utah, United States.