LegalPrivacy policy
Effective
MyVenueHQ is venue management software for event and wedding venues, operated by Colorado Web Forge LLC, a limited liability company in Colorado, United States (“MyVenueHQ”, “we”, “us”). This policy explains what personal information we collect through myvenuehq.com and app.myvenuehq.com (together, the “Service”), why, who handles it for us, how long we keep it, and what you can do about it.
Questions or requests: hello@myvenuehq.com. It reaches the people who run the Service.
The short version
- We collect what you and your venue put into MyVenueHQ, plus the minimum we need to keep it secure and to bill for it.
- We never see or store card numbers. Payments happen on pages hosted by Stripe, Square or PayPal.
- We don’t sell personal information, we don’t share it for advertising, and we don’t use it to train AI models.
- The marketing site sets no cookies. The app uses cookies only to keep you signed in and to protect forms. We show no cookie banner because nothing here needs your consent. The cookie policy lists every item.
- You can download your data and delete your account yourself, in Settings, under Your account.
- MyVenueHQ is for people aged 18 or over.
Two roles, and which one applies to you
Your account and our own relationship with you. When a venue owner or staff member signs up, pays, writes to us or visits our website, we decide how that information is used. We are the “controller” (GDPR) or “business” (California law) for it, and this policy covers it directly.
Your venue’s records. Venues use MyVenueHQ to store information about their own clients, guests, ticket buyers and vendors. For that information we act on the venue’s behalf as its “processor” or “service provider”, and only on its instructions. The venue decides what to collect and why, and is responsible for having the right to do so. If you are a venue’s client, guest or ticket buyer and want to see or delete your information, contact the venue first. We will help the venue respond, and you can also write to us and we will point you to the right place.
What we collect, why, and on what basis
Where the law asks us to name a legal basis (the GDPR and UK GDPR), it is shown in the last column. “Contract” means we need it to provide the Service you asked for. “Legitimate interests” means a purpose we have that does not override your rights, such as keeping the Service secure.
| What | Why | Basis |
|---|---|---|
| Account: name, email address, a one-way hash of your password (argon2), your role and permissions on a venue’s team, preferences, the page of our site that sent you to sign up | Create and secure your account, sign you in, send invitations, count which pages help venues | Contract; legitimate interests (the page that sent you) |
| Venue details: name, address, branding, settings, team members and invitations | Run your venue in the Service. The address goes to Google to place it on a map | Contract |
| Billing: plan, status and dates from Stripe. Stripe holds your card; we don’t | Charge for the Venue plan, apply the trial and refund terms, keep tax and accounting records | Contract; legal obligation |
| Venue records a venue adds: contacts, bookings, inquiries, form submissions, proposals, contracts, invoices, ticket orders, vendors, comments, reviews, messages and uploaded files | Provide the Service to the venue, as its processor | The venue decides. For us: contract with the venue |
| E-signatures: signature image, signer’s name and email, time of signing, signer’s IP address | Keep a record that the person signed | The venue’s legitimate interests and contract with its client |
| Chats with the AI assistant (HQ): the questions a person asks, HQ’s answers, the pictures and cards it shows and the ids of proposals it offers. Not kept: the model’s tool calls or reasoning | Let the person pick a conversation back up | Contract |
| IP address and request details | Limit repeated sign-in attempts, form submissions and abuse; fix faults | Legitimate interests (security) |
| An activity log of actions in an account, such as a contract being sent | Show a venue its own history | Contract |
| Page views on myvenuehq.com and the app, and a few product events (a signup, a first floor plan saved), counted by Vercel Web Analytics | Understand which pages and features help venues. No cookies, no advertising profile, and the events carry page paths and button names only | Legitimate interests |
| Email you send us, including through the contact form | Answer you and keep a record of the conversation | Legitimate interests; contract |
| Email preferences, including whether you ticked the box for offers and product news | Send only the email you agreed to or that the account needs | Consent (offers and news); legitimate interests and contract (account email) |
We don’t knowingly collect special categories of personal data (such as health, religion or biometric data), and we ask venues not to enter them. If a venue enters dietary or accessibility notes about a guest, that is the venue’s decision.
What we don’t collect
We never receive or store full card numbers or bank details. Card payments for invoices, deposits and tickets happen on checkout pages hosted by Stripe, Square or PayPal, and we keep only the payment’s reference, amount and status. We don’t use advertising or cross-site tracking cookies, we don’t buy personal information, and we don’t build profiles of people.
How we use information
- To provide the Service: store your venue’s records, show them to the right people, and do what you ask, such as sending a proposal, a contract or an invoice.
- To send email the Service needs: confirmations, invitations, password resets, contracts, proposals, invoices, ticket confirmations, event reminders, and reminders about your own account such as a trial ending. Venues can also send their own messages, such as announcements to ticket buyers, through MyVenueHQ.
- To bill for subscriptions and apply ticket service fees.
- To keep the Service secure, prevent fraud and abuse, and fix problems.
- To answer support requests and improve the product.
- To send offers and product news, only if you ticked the box at sign-up or told us you want them. Every such email has an unsubscribe link, and you can also change this at any time by replying or using the link.
We don’t make decisions about people by automated means that have legal or similarly significant effects.
Who handles it for us
These are the companies that process personal information for us or for venues that use them through MyVenueHQ. “If connected” and “if used” means the company only gets data when a venue turns that feature on. We choose processors carefully and rely on the data protection terms they publish. We don’t sell personal information or share it for cross-context behavioral advertising. We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a sale or reorganization of our business, in which case this policy continues to apply to the information transferred.
| Company | What it does | Personal information it receives | Where | When |
|---|---|---|---|---|
| Vercel | Hosts the website and the app, stores uploaded files (Vercel Blob), and counts page views on myvenuehq.com and app.myvenuehq.com with Web Analytics | Everything that passes through the Service, uploaded files, IP addresses in server logs, anonymous page-view counts | United States | Always |
| Neon | Hosts our database | All account and venue records | United States | Always |
| Resend | Delivers the email the Service sends: confirmations, invitations, contracts, invoices, ticket emails, reminders and our own messages | Recipient name and email address, and the content of each message | United States | Always |
| Zoho Mail | Receives the mail you send to hello@myvenuehq.com and our replies | Your email address, name and the message | Zoho data centers | Always |
| Stripe | Bills Venue plan subscriptions, and processes a venue’s ticket and invoice payments when the venue connects Stripe | Name, email address, billing details and payment details you enter on Stripe’s pages. We never receive card numbers | United States and other countries where Stripe operates | Always |
| Square, PayPal | Process a venue’s invoice, deposit and ticket payments | Payer name, email address, amount and payment details entered on their pages | United States and other countries where they operate | If a venue connects it |
| Clover, Toast, Lightspeed | Send point-of-sale sales data to MyVenueHQ for a venue’s revenue reports | Sales totals and line items from the venue’s point-of-sale system | United States | If a venue connects it |
| Intuit QuickBooks | Receives invoices and customers from a venue’s account | Customer names, email addresses and invoice details | United States | If a venue connects it |
| DocuSign | Collects signatures on a contract when a venue connects DocuSign | Signer name, email address and the contract | United States and other countries where DocuSign operates | If a venue connects it |
| OpenRouter, and the model hosts it routes to (Google Vertex AI, Microsoft Azure and Amazon Bedrock for Anthropic’s Claude models; DeepInfra as a last resort) | Runs the AI assistant that drafts replies and summaries when a venue uses it | The booking, inquiry or email text the venue asks the assistant about, which can include client names and email addresses. Every request tells the provider not to keep or train on it | United States only: Google Vertex AI (US), Microsoft Azure (US), Amazon Bedrock (us-east-1); DeepInfra, which states it serves from US data centers | If a venue or visitor uses the feature |
| Google Maps Platform | Looks up a venue’s address and shows maps on event pages | The venue or event address, and the IP address of anyone who opens a page with a map | United States and other countries where Google operates | Always |
| Eventriloquist | Creates inquiries in MyVenueHQ and is told when records change, when a venue connects this event planning app | Inquiry details, and record identifiers (not contents) when records change | United States | If a venue connects it |
| goQR.me (api.qrserver.com) | Draws the QR code image when a venue shares an event or ticket link | The link being encoded and the IP address of the person who opens the share dialog | Germany | If a venue or visitor uses the feature |
| Unsplash | Serves a few texture images in the layout builder | The IP address of the person using the layout builder | United States | If a venue or visitor uses the feature |
| YouTube, Vimeo | Play a video a venue has added to an event page | The IP address of the person who opens that event page. YouTube videos load from youtube-nocookie.com | United States | If a venue or visitor uses the feature |
Integrations a venue connects are governed by that venue’s own agreement with the provider. We exchange data with them on the venue’s instruction.
The AI assistant
When a venue uses the AI assistant, we send the text it asks about (for example an inquiry, an email or a booking summary) to OpenRouter, which routes it to one of Anthropic’s Claude models run by Google Vertex AI (US region), Microsoft Azure (US region) or Amazon Bedrock (us-east-1). We pin the routes to those United States regions and the assistant refuses rather than use any other host. As a last resort it can use the DeepSeek V3.2 model hosted by DeepInfra, never DeepSeek’s own service; DeepInfra states in its documentation that it serves from data centers in the United States. Every request tells the provider not to keep the text or use it to train models, and we ask for zero data retention where a provider offers it. The assistant drafts; a person at the venue reads and sends. We don’t use your content to train any model.
Your chats. We keep a person’s conversations with the assistant so they can return to them. A chat is visible in the app only to the person who had it, in that venue; other staff and the venue owner can’t open it. You can delete a chat yourself: it disappears at once and is erased from our database 30 days later by a daily job. A chat nobody has written in for 12 months is erased the same way, and deleting an account or a venue erases its chats. Only the chat being asked in is sent to the AI provider. Copies kept for recovery can hold an erased chat until they age out (see below).
Links, shared pages and files
Some things in MyVenueHQ are designed to be opened by link without signing in: proposals, contracts to sign, shared floor plans, public event pages, a venue’s public calendar, and ticket pages. Anyone who has the link can open that page, so venues should share these links only with the people meant to see them. Files uploaded to the app are stored at long, unguessable web addresses; anyone with a file’s address can open it.
Cookies and browser storage
The marketing site sets no cookies. The app sets a cookie that keeps you signed in for up to 30 days and two short-lived security cookies used during sign-in, none readable by scripts on the page or used for tracking. Both the app and the free tools save small items in your browser, such as your theme or an unfinished draft; those never leave your browser unless the item says otherwise. We don’t use anything that needs a consent banner. The full list, with purposes and lifespans, is in the cookie policy. If your browser sends Do Not Track or Global Privacy Control, the app sends no product events and saves no flags for them.
How long we keep it
| What | How long |
|---|---|
| Account and venue records | While the account is open, including if a paid plan lapses and the venues become read-only, so nothing is lost if you return. When you delete your account in Settings, it is removed from our live database right away. If you ask by email, within 30 days. |
| AI assistant chats | Until you delete them (then erased after 30 days), 12 months after the last message, or when you delete your account or venue. |
| Database backups | Our database provider keeps a rolling history of recent database changes for a limited time, so the database can be restored to an earlier moment after a mistake. A deleted account leaves that history when its window ends. We don’t restore deleted accounts from it except to recover from a failure, and if we do, we delete them again. |
| Billing and payment records | Stripe and the payment providers keep these as tax and accounting law requires, even after your account is deleted. We keep only what we need to show a charge, refund or invoice. |
| Sign-in and abuse limits (IP addresses) | About a day, or the length of the limit window, then deleted automatically. |
| Email you send us | As long as we need it to help you and to keep a record of what we agreed, then deleted. |
| Email already sent through the Service | Resend keeps delivery records for its own short period. Copies in recipients’ inboxes are theirs. |
| Page views and product events | Kept by Vercel Web Analytics under its own retention. They are anonymous counts and not linked to your account. |
Moving data across borders
MyVenueHQ is run from the United States, and information is stored and processed in the United States. If you use the Service from the European Economic Area, the United Kingdom or Switzerland, your information is transferred there. For transfers we make to processors, we rely on the European Commission’s standard contractual clauses, with the UK addendum, or on the processor’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, as each processor’s own terms provide. If you are a venue in those regions and need a data processing agreement that includes the standard contractual clauses between you and us, email hello@myvenuehq.com and we will send it.
Your rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong;
- delete your information or your account;
- stop sending you email about MyVenueHQ.
Do it yourself. In the app, Settings, Your account lets you download your data, change your name and password, and delete your account and data. Each email we send for marketing has an unsubscribe link.
Or ask us. Email hello@myvenuehq.com from the address on the account, or tell us how we can confirm it’s you. We reply within 30 days (45 days where California law gives us longer, and we will tell you if we need it). We won’t treat you differently for making a request. If your information is in a venue’s records, we may pass your request to that venue, which controls that information.
If you are in the European Economic Area or the United Kingdom, you also have the right to object to processing based on legitimate interests, to ask us to restrict processing, to receive your data in a portable format, and to withdraw consent at any time (withdrawing doesn’t affect what we did before). You can complain to your local data protection authority; in the UK that is the Information Commissioner’s Office. We would like the chance to fix it first, so please write to us.
If you are a California resident, you have the rights to know, delete, correct, and limit the use of sensitive personal information, and to opt out of sale or sharing. In the last 12 months we collected the categories shown in the table above (identifiers, contact details, commercial information such as plan and billing status, internet activity such as page views, and records you or your venue entered) for the purposes described, and disclosed them to the processors listed. We do not sell personal information or share it for cross-context behavioral advertising, and we don’t use or disclose sensitive personal information for purposes beyond running the Service. We treat a browser’s Global Privacy Control signal as an opt-out request. You can use an authorized agent; we will ask for proof they act for you.
Residents of other US states with a privacy law, such as Colorado, Virginia or Connecticut, can use the same requests above. If we decline a request you can appeal by replying to our answer.
Deleting your account
Open Settings, then Your account, then Delete my account. We ask you to type your email address and, if you set one, your password. If you own a venue on your own, it is deleted with everything in it. If other people work in a venue you own, we stop and ask you to hand it over or remove them first, so they don’t lose their workplace; or email us and we will sort it out together. Work you did in a venue owned by someone else stays with that venue. A paid plan is cancelled when you delete. Files you uploaded are stored separately and are not removed automatically; email us and we will delete them. Download your data first if you want a copy.
We send two kinds of email. Account email (confirmations, invitations, receipts, security and billing notices, a reminder before a trial ends) is part of the Service. Offers and product news go only to people who ticked the box at sign-up or asked for them. Every marketing email has an unsubscribe link and a one-click unsubscribe header, and we honor unsubscribes within 10 days. Marketing email carries the sender’s postal address, as US law requires.
Security
All connections to MyVenueHQ are encrypted with HTTPS. Passwords are stored only as argon2 hashes. Access to a venue’s records is limited to that venue’s team, by role. We rate-limit sign-in and other sensitive requests, and card data never touches our systems. No service can promise perfect security. If we learn of a breach that affects your information, we will tell you and the authorities as the law requires.
Children
MyVenueHQ is a business tool for people aged 18 or over, and isn’t directed to children. We don’t knowingly collect personal information from anyone under 18. A venue may enter information about guests who are minors (for example a child’s name on a guest list); that is the venue’s responsibility. If you believe a child has created an account or given us personal information, email us and we will delete it.
Changes to this policy
When we change this policy we will update the effective date above. If a change is significant, we will also email account owners before it takes effect.
Contact
Colorado Web Forge LLC, doing business as MyVenueHQ
10181 Park Meadows Drive, Suite 4-102
Lone Tree, CO 80124, United States
hello@myvenuehq.com
See also our terms of service, cookie policy, refund policy and security and data handling page.