Venakis Privacy Policy

What this covers: what personal data Venakis holds, why, who else sees it, how long it is kept, and what you can ask us to do about it. Takes effect on 30 September 2026. Version 1.3: adds payments taken from your clients through your own Stripe account (1.1), the ICO registration number (1.2), and the Rapport module's processing, with Anthropic and Deepgram as sub processors (1.3, 15 October 2026). Version 1.4 (16 October 2026): adds the Loyalty, Video library and Standard integrations modules' processing, Mux as a sub processor for the Video library, and the services you connect yourself (section 4). Version 1.5 (16 October 2026): the Features page demo count (section 5) and what happens to Rapport's data when it is switched off (section 6). Version 1.6 (2 November 2026): bookings from other booking sites. Vouchers your clients use on your site; booking emails you forward to us, read by our own software and, only if you switch it on and our software doesn't recognise one, by Anthropic, and deleted after 30 days; calendar links from other booking sites; and your clients' requests to change the time of a booking (sections 3, 4 and 6). Anthropic and Resend, already on the list in section 4, each do one more thing for you, described there.

In this document, "we", "us" and "our" mean Felix Venus, trading as Venakis.

There are two different things going on in this policy and it is worth separating them before you start.

1. Data about you, our customer. Your name, your business, your login, your billing, your support emails. Here we are the controller. We decide what happens to it, and this policy is the notice the law requires us to give you.
2. Data about your clients. The names, contact details and appointment history your clients' records contain. Here we are only the processor. You decide what happens to it. We act on your instructions, under the data processing terms in Annex A of the Terms of Service. The notice your clients are entitled to has to come from you, not from us, because you are their controller.

We cannot be controller and processor for the same information, and the system keeps the two apart.

1. Who we are

There is no data protection officer. The law requires one only in specific circumstances, and Venakis does not meet them: it is not a public authority, its core activity is booking administration rather than large scale monitoring, and it is very small. We have recorded that assessment in writing. We deliberately do not give anyone the title of data protection officer, because a voluntary appointment brings a whole regime with it, including independence from the business, and in a business run by one person nobody can be independent of it.

2. Data we hold as controller, and why

On legitimate interests. Where we rely on legitimate interests, the interest is running, securing and improving a small software business. We have weighed that against your privacy in each case, and we will share the assessment if you ask.

Card details. We never see or hold your card number. Payments run through Stripe, and card data goes straight to them.

3. Data about your clients, held as processor

Through the Service we process, on your behalf:

• your clients' names, email addresses, telephone numbers, and postal addresses where you collect them;
• appointments: date, time, service booked, staff member, status, and history, including a client's request to change the time of a booking and any note they add to it;
• notes you or your staff record against a client;
• payment records and references relating to their bookings;
• references Stripe gives us for payments you take through your own Stripe account: which booking, membership or fee a payment was for, its amount and status, refunds and disputes, and, where a client agreed to save a card, Stripe's reference to that card with the exact consent wording they agreed to, the fees in it, and when;
• the names, email addresses and access rights of your own staff users;
• if you use Loyalty & promotions: each client's stamps or points and every change to them with its reason, who referred whom, a random code for their loyalty QR code, and, only if the client gives it, their birthday as a month and day (never the year);
• if you use the Video library: the videos you upload, their automatically made captions, and where each signed-in client got to in each video;
• if you use Standard integrations: the record of what was sent to the webhook addresses you choose (kept 30 days), which team members have a private calendar link, and the accounts you chose in Xero;
• vouchers from Groupon, Wowcher and other sites that your clients use to book: the code, which site sold it, the deal, what you are paid for it, its history, and the bookings it paid for. A voucher's security code, if it has one, is stored encrypted and shown only to your own HQ users;
• if you bring in bookings from other sites (on the Team and Expert plans): the booking emails you forward to your Venakis address, and anything else sent to that address, kept for 30 days (see below); the bookings we read from them; and the events in calendars you link from other booking sites, with their times and the title the other site gives them, which can include a client's name.

We process this only on your documented instructions, which means the functionality of the Service and anything else you tell us in writing. We do not use it for our own purposes, we do not sell it, we do not market to your clients, and we do not use it to train models.

Where a boundary genuinely exists, here it is. Operational monitoring, fault diagnosis and keeping the Service working are part of providing the Service and we do them as your processor. Producing aggregated statistics about the Service that are irreversibly anonymised is also within that. Anything beyond that, such as analysing your clients' booking records to derive commercial insight, would make us a controller for that activity, so we do not do it. If that ever changes, we will tell you in advance, explain the basis, and give you a choice.

If a client contacts us directly about their data, we will not answer the substance of it. We will refer them to you and tell you it happened. You hold the relationship and the legal duty.

Booking emails you forward to us

If you forward booking emails from other sites to your Venakis address, we store each email encrypted and read it, to propose the booking, move or cancellation it describes. Our own software reads the emails from the booking sites we know. If it doesn't recognise an email's layout, and you have switched on "Read emails we don't recognise with AI", we send the email's subject and text to Anthropic to read it (see section 4). Emails that aren't from a booking site we know are kept with the rest but not read further.

So that nothing else can be booked at the same time while you decide, a new booking or a new time from an email we trust is held in your diary as a tentative booking straight away. Nothing is sent to the client. If you say it isn't a real booking, or you don't deal with it within 14 days, the hold is removed. A booking read with AI is always shown to you to approve; it is never confirmed without you.

The email itself, everything we read from it, and the client's name and contact details on any proposal it made are deleted 30 days after it arrives. A proposal you don't deal with within 14 days loses the client's details then. The bookings you approve stay in your diary like any other booking.

When you link a calendar from another booking site, we read each event's title and description to find which of your team it is with. We keep the title and the times; the description is read and not kept.

What Rapport stores

Rapport is an optional module for businesses that want to remember their clients better. When it is on, we also process, on your behalf:

• notes about clients, typed or spoken. A spoken note is turned into text and the text is kept as a note; the audio is never stored. Each note is marked "Team" or "Only me". An "Only me" note is readable by the person who wrote it and by the business owner, and nobody else, including us in the normal running of the Service;
• connections: the people, places, workplaces, events and interests a client mentions, taken from those notes. For a person who is not a client of the business (a client's partner, child or friend) we keep a first name and the relationship only, never contact details;
• pre-appointment briefs: a few lines written from the notes before a visit, kept until the notes change;
• the owner's and staff members' own diary items (the school run, an appointment of their own). These are personal to the person who added them. Other staff and the public see only that the time is unavailable;
• a change log of what was changed in HQ, by whom and when, kept for 30 days so changes can be undone;
• health details a client mentions in a note are not saved automatically. The person recording the note decides whether to keep them, and they go into the client's health notes, which only the owner and admins can read.

Nothing in Rapport is used to train models, ours or anyone else's. The text of a note is sent to the model as data to be read, never as instructions to be followed, and the model's output is checked before anything is saved.

Special category data. If your business is health adjacent, for example physiotherapy, counselling, dentistry, aesthetics or podiatry, your clients' appointment records may amount to health data, which the law treats as needing extra protection. Tell us at signup if that applies to you, because it changes how the data must be handled at both ends.

4. Who else is involved

These are the suppliers who process personal data as part of running Venakis. This list is versioned and dated, and we tell existing customers by email at least 30 days before adding or replacing anyone on it.

Two things about this list you should actually read.

Frankfurt is not the whole story. The database sits in Frankfurt, which is good for latency and good for the physical location of the data. But the law does not follow the servers, it follows the company. Render is a United States company, so using it is a transfer of data to the United States even though the machines are in Germany. Render's own suppliers, and Resend's, are also United States companies. Saying only "hosted in Frankfurt" would understate that, so we are not saying only that.

Stripe is not simply our supplier. By its own terms, Stripe decides for itself what to do with payment data for fraud monitoring, anti money laundering checks, payment method selection, legal compliance and its own product improvement. For those purposes Stripe is a separate controller in its own right, not our processor, and its own privacy policy governs what it does. That is worth knowing because it is not something we can control on your behalf.

When you take payments from your clients, you have your own agreement with Stripe, and Stripe acts for you under it, not for us and not as our sub processor. Your clients' card details go directly from their browser to Stripe; we never see them.

Services you connect yourself are not our suppliers. If you connect your own Xero, Zapier, Make, Google, Apple or Outlook calendar, or another address you give us for webhooks, we send data there on your instruction: a nightly summary of your takings, booking and client details to a webhook address you chose, or a calendar link that shows a client's first name and the service. That service acts for you under your own agreement with it, not for us, so it is not our sub processor and is not in the table above. The same applies to Groupon, Wowcher, Treatwell, ClassPass and any other site you sell on, and to your own email provider. We don't connect to them: you forward their emails to us and give us their calendar links, and you give them your busy-times link, which shows only when you are busy, never who with or for what. What is sent, and when, is described in the help centre for each one, and you can disconnect any of them in HQ at any time, which stops anything more being sent and deletes our access to it.

Mux sees videos, not your client list. Mux receives the videos you upload and, when someone watches, the request for the stream. It does not receive your clients' names, email addresses or membership details: we decide who may watch and give the viewer a short signed pass. If the Video library is off for your business, nothing is sent to Mux.

What Anthropic sees of a forwarded booking email. Only the subject and text of that one email, which will include the client's name and contact details and the booking, and may include the address it was forwarded from. Not your client list, and nothing else from your account. It is sent only when our own software can't read an email from a booking site we know, only if you have switched AI reading on for your forwarding address (it starts off), and at most 100 times a month for your business. You can switch it off in HQ, under Diary, From other sites, at any time; emails we can't read are then left for you to handle.

Rapport's two suppliers see note text, not your client list. Anthropic receives the text of a note, the first names and recent service of the clients that note might be about, and the connections already on the map, so it can tell which client was meant. Deepgram receives the audio of a spoken note and a short list of your clients' first names and service names so it hears them correctly. Neither receives email addresses, telephone numbers, payment records or health notes, and both are instructed, by contract, not to keep what they are sent beyond processing the request. If the Rapport module is off for your business, nothing is ever sent to either of them.

Transfers outside the UK. There is no adequacy decision needed for the European Economic Area: transfers there are already covered by UK law with no expiry date. For the United States, the mechanisms above apply. Because we chose these suppliers and we initiate the transfers, the transfer risk assessments are our legal obligation, not yours, and we keep them under review at least once a year. You may ask to see them.

Others who may see data. Our accountant, for financial records. Professional advisers where we need advice. A regulator, court or law enforcement body where we are legally required to disclose. Nobody else, and we do not sell personal data to anyone.

5. Cookies and similar technologies

Venakis uses the minimum it can.

• Strictly necessary: a session cookie to keep you logged in, and security tokens that protect forms against abuse. These do not need your consent, and there is no way to turn them off and still use the application.
• Analytics: one count, nothing else. Since 16 October 2026 venakis.com counts how many times each demo on the Features page is started and watched to the end. Your browser tells our server the name of the demo and nothing more: no cookie is set, nothing is stored on your device, and we keep only the daily total for each demo, never your IP address or anything else that could tell visitors apart. It is first party, used only to improve the demos, and not shared with anyone else. The application itself isn't measured. Under the rules that came into force on 5 February 2026 this doesn't require consent, but you can object, simply and for free, at https://venakis.com/privacy/preferences or by emailing help@venakis.com, and from then on your browser sends nothing. Your choice on that page is kept in your browser's own storage, only to remember it. A Global Privacy Control signal from your browser counts as an objection. Objecting costs you nothing and changes nothing else about the service.
• No advertising, no remarketing, no third party tracking, no cross site profiling. If that ever changed, a consent banner would appear, and rejecting would be exactly as easy as accepting.

In plain terms: there is no cookie banner because there is nothing here that needs your consent. That is not a shortcut. It is a consequence of not doing advertising tracking.

6. How long data is kept

The table in section 2 gives the periods for data we hold as controller. Two notes on it.

Tax records are different. Financial records are kept for 6 years after the end of the relevant tax year, because HMRC requires it. That period applies to invoices and accounts, and it does not leak into anything else. It is not a reason to keep your marketing preferences or your clients' appointment history.

Rapport. Spoken audio is not kept at all. A proposed change that was never confirmed is cleared after 24 hours. Undone or removed items sit in a bin for 30 days and are then removed for good. Notes, connections and briefs stay for as long as the client's record does. If a business switches Rapport off, its connections, briefs, suggestions and everyone's life lane are kept for 30 days, so switching it back on restores them, and are then deleted; client notes stay with the client's record.

Loyalty, video and integrations. Stamps, points, referrals and where a client got to in a video stay for as long as the client's record does, and go when it is erased. Webhook delivery records are kept for 30 days. Deleting a video deletes it from Mux too. Disconnecting Xero deletes our access to it at once; what was already sent stays in your own accounts.

Bookings from other sites. Forwarded emails, what we read from them, and the client's details on any proposal they made are deleted 30 days after the email arrives; a proposal not dealt with loses the client's details after 14 days, and any time it held is released. Events from a linked calendar are kept for the next 90 days, and for 30 days after they end, and removed when they leave that calendar or when you remove the link. If a business switches the Standard integrations module off, its forwarding address, forwarded emails, proposals and linked calendars are deleted after 30 days. Bookings and vouchers stay with the client's record. A client's request to change a booking's time stays with that booking.

Your clients' data is on your clock, not ours. You decide how long it is kept. The Service gives you retention controls and deletion tools. At the end of our contract we delete it or return it, at your choice, on the timetable in Data Ownership and Exit.

7. Security

Current measures:

• Data encrypted in transit (TLS) and at rest.
• Access to production systems restricted to Felix Venus alone, with multi factor authentication and unique credentials.
• Secrets held in managed secret storage, never in code.
• Logical separation of each customer's data, with access controls tested as part of the release process.
• Continuous backups with 3 days of point-in-time recovery, provided by our hosting provider.
• Dependency and vulnerability scanning on every release.
• Audit logging of administrative access.
• Card data never touches Venakis systems; it goes directly to Stripe.
• Saved cards are stored by Stripe; we hold only Stripe's reference to them.

Security documentation, and answers to a written security questionnaire, are available on request. Venakis is run by one person, so we will tell you plainly what is in place rather than imply a security team.

If there is a breach. If a breach affects your account data, we will tell you without undue delay and, where the law requires it, report it to the Information Commissioner within 72 hours. If it affects your clients' data, we will tell you within 24 hours of becoming aware, with what we know, and it is then your decision as controller whether to report it. We will never report your breach to the regulator on your behalf.

8. Your rights

Where we are the controller of data about you, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it, where we no longer have a reason to keep it;
• restrict what we do with it while a disagreement is sorted out;
• give it to you or another provider in a machine readable form, where that right applies;
• stop processing it where we rely on legitimate interests and you object;
• withdraw consent where consent is what we relied on, at any time.

There is no automated decision making in Venakis that produces legal effects for you, and no profiling of that kind.

How to ask. Email help@venakis.com. It is free. We will respond within one month. If a request is complex or you have made several, we may need up to two further months, and if so we will tell you why within the first month.

If you are unhappy: complain to us first. Since 2026 you have a statutory right to complain directly to us about how we handle your data. Send it to help@venakis.com with "Complaint" in the subject line. We will acknowledge it within 30 days and respond without undue delay, and we will tell you what we have done about it.

And you can go to the regulator. You can complain to the Information Commissioner's Office at any time, whether or not you have complained to us first. ico.org.uk/make-a-complaint, or 0303 123 1113. You can also take a claim to court.

If your complaint is about your own client's data held in a Venakis system, the controller is the business you booked with, not us. Ask them.

9. Marketing

We email customers about product changes and, occasionally, new features. You can opt out of the non essential ones at any time using the link in the email or by emailing help@venakis.com, and we will keep a record of the opt out so it is not undone.

Service messages are different from marketing. Confirmations, receipts, password resets, security notices, outage notices and changes to these documents are not marketing, and you cannot opt out of them while you have an account, because they are how the service works.

We will not add a promotional line to a service email, because doing so would turn the whole message into marketing.

Prospective customers. If you enquire, we will reply and may follow up. If we contact you cold, we do so on the basis that applies to you, which for many small businesses, including sole traders and most partnerships, means consent or a prior enquiry rather than "it is a business address". You can tell us to stop at any time and we will.

10. Children

Venakis is sold to businesses and is not for use by children. Your clients' records may include data about a child, for example a parent booking a child's appointment. Where that happens you are the controller of it and the extra care that child data needs is your responsibility, supported by the security and access controls in the Service.

11. Changes to this policy

If we change this policy we will publish the new version with its date, keep the old versions available, and email customers before anything material takes effect. If we ever want to use personal data for a genuinely new purpose, we will tell you before we start, and explain the basis.

12. Summary of the legal position, for anyone who needs it in one place

• Controller of customer account, billing, support, usage and marketing data: Felix Venus trading as Venakis.
• Processor of end client booking data: Felix Venus trading as Venakis, acting for each business customer as controller, under Annex A of the Terms of Service, which is the Article 28 contract.
• Separate controller for parts of payment processing: Stripe.
• Transfers outside the UK: to the United States, under the mechanisms in section 4, with transfer risk assessments held by us.
• ICO registration: ZC261769, registered 29 September 2026, fee tier 1.
• Records of processing: maintained separately for the controller activities and the processor activities.