The Law of Venoly

This document is the Law of Venoly: the foundational rules of the Venoly platform. It sets out who runs Venoly, which laws Venoly is subject to, the rights every user has, the duties every user accepts, and the limits on what Venoly itself may do. It is written to be read, not to impress.

How it relates to our other documents.

• The Terms of Service govern day-to-day use of the platform. They must be read together with this Law.
• The Privacy Policy describes what data we hold about you and what you can do about it.
• The Acceptable Use Policy, Code of Conduct, Developer Terms and Refund Policy apply to the activities they name.

If the Terms of Service or a policy conflicts with this Law, this Law prevails. If anything in this Law conflicts with a right that the law gives you and that cannot be contracted away — consumer law, data-protection law, the Digital Services Act — that right prevails, and the conflicting sentence here is read down to the extent needed. Nothing in this document is intended to take a statutory right away from you.

By creating an account or using the platform you agree to this Law and the documents above. If you do not agree, do not use Venoly. There is no form to fill in to decline; not using the service is enough.

Honesty note: this document has not yet been reviewed by a qualified Dutch lawyer. It was written by Venoly's founders to describe accurately what the platform does and which laws apply to it. We will have it reviewed before the company is incorporated. If you spot a statement here that does not match how the platform actually behaves, tell us at legal@venoly.nl — we would rather correct the page than defend it.

Venoly is run by its two founders. The platform is operated from Emmen, the Netherlands, where its servers are and where the founder who acts as its operator and data controller lives. The co-founder is based in the United States and has no access to user data, the database or the codebase — only the Dutch founder does, and that will not change. There are no employees, no separate departments and no outsourced moderation team. When this document says "we", it means the two founders personally.

Venoly is not yet a company. The founders intend to incorporate Venoly B.V. (a Dutch private limited company) and register it with the Kamer van Koophandel. Until that happens, every reference to "Venoly" or "Venoly B.V." in this Law and in the Terms of Service means the natural person operating the platform. On incorporation, the company takes over these rights and obligations by novation; nothing changes for you and no action is needed on your part. We will update this page, the Terms of Service and the Privacy Policy with the registration number and registered address when they exist.

Because Venoly is a micro-enterprise, some obligations that EU law places on large platforms — the Digital Markets Act, the very-large-online-platform rules of the Digital Services Act, the NIS2 cybersecurity directive, corporate sustainability reporting — do not currently apply to it. We do not claim to comply with rules that do not apply to us. If we grow into them, we will say so here.

"Platform" means the Venoly service in every form we offer it: the website and web app, the desktop application, the Android application, the public API, bots and integrations, and the infrastructure behind them.

"User" or "you" means anyone who uses the Platform, with or without an account.

"Content" means anything you post, upload or transmit through the Platform: messages, files, images, voice, profile information, server configuration.

"Personal Data", "processing", "controller" and "processor" have the meanings given in Article 4 of the GDPR (Regulation (EU) 2016/679).

"BW" means the Burgerlijk Wetboek, the Dutch Civil Code. "DSA" means the Digital Services Act (Regulation (EU) 2022/2065). "AP" means the Autoriteit Persoonsgegevens, the Dutch data-protection authority. "ACM" means the Autoriteit Consument & Markt, the Dutch consumer and markets authority and Digital Services Coordinator.

Headings are for convenience only. "Including" means "including but not limited to". Days are calendar days unless stated otherwise. Where this Law refers to a statute, it refers to that statute as amended.

This Law, the Terms of Service and every dispute between you and Venoly are governed by the law of the Netherlands. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Talk to us first. If you have a problem with Venoly, email support@venoly.nl before doing anything else. Two people run this platform, and most problems are solved by a conversation. We will engage with you in good faith and reply within a reasonable time.

Courts. If a dispute cannot be resolved, the competent court is the court of the Netherlands for the district in which Venoly is established — currently the Rechtbank Noord-Nederland. If you are a consumer living in the European Union, you may instead bring proceedings in the courts of your own country, and we may only sue you there (Regulation (EU) No 1215/2012, Articles 17–19). Nothing here removes that right.

Out-of-court options. EU consumers may use the European Commission's Online Dispute Resolution platform at ec.europa.eu/consumers/odr. Venoly is not currently a member of a certified dispute-resolution body and does not require mediation before court. You are always free to complain to the ACM, to the AP, or to the regulator in your own country.

Every user of Venoly has the following rights. They are the standard against which everything else in this Law, and everything Venoly does, is measured.

• Expression. You may say what you want within the rules. Restrictions on your content must be proportionate, explained, and open to challenge (Article 14).
• Privacy. We collect what we need to run and protect the platform and nothing more. What we collect and why is written down in the Privacy Policy, and where the Privacy Policy and the code disagree, we fix one of them.
• Transparency. You are entitled to know how moderation works, which automated systems touch your account, and which third parties process your data. We publish all three.
• Due process. No account is suspended or terminated by an automated system alone. A person decides, you are told why, and you can appeal (Articles 14 and 15).
• Your data is yours. You can export it and you can delete it, from Settings → My Account, without asking anyone's permission (Article 6).
• To know when you are talking to an AI. AI characters are labelled as AI and are never presented as human (Article 21).
• Not to be tricked. We do not use dark patterns. Cancelling is as easy as subscribing, "reject" is as prominent as "accept", and we do not re-prompt a choice you have already made.
• Accessibility. We are working toward WCAG 2.1 AA conformance. We have not yet published a formal accessibility statement; report barriers to support@venoly.nl and we will treat them as bugs.

Venoly processes personal data under the GDPR and the Dutch implementing act (Uitvoeringswet AVG). The controller is the natural person operating the platform until incorporation, then Venoly B.V. (Article 2). The competent supervisory authority is the Autoriteit Persoonsgegevens.

Legal bases. We rely on performance of our contract with you (Article 6(1)(b) GDPR) to run the service; on our legitimate interest in keeping the platform safe (Article 6(1)(f)) for security logging, abuse detection and device fingerprinting; on your consent (Article 6(1)(a)) where the law requires it; and on legal obligation (Article 6(1)(c)) where we must keep or hand over records. The Privacy Policy states the basis for each category of data.

Your rights. Access, rectification, erasure, restriction, portability, objection, and the right not to be subject to a decision based solely on automated processing (Articles 15–22 GDPR). Export and deletion are self-service in Settings → My Account. Everything else: email privacy@venoly.nl. We answer within one month, extendable by two further months for complex requests as Article 12(3) allows, and we may ask you to prove you are the account holder first. You may complain to the AP at any time.

No Data Protection Officer. Venoly is not required to appoint a DPO under Article 37 GDPR and has not appointed one. Privacy questions go to the founders directly.

Breaches. If personal data is breached, we will notify the AP within 72 hours of becoming aware unless the breach is unlikely to result in a risk to you, and we will notify you directly where the risk is high (Articles 33–34 GDPR).

Records. We keep a written record of our processing activities and a written legitimate-interests assessment for device fingerprinting. Both are available to the AP on request.

Article 11.7a of the Dutch Telecommunicatiewet (implementing the ePrivacy Directive) governs what we may store on your device. Venoly stores only what is needed to run the service: sign-in cookies, your interface preferences, unsent drafts and your cookie choice itself. These are exempt from the consent requirement because you asked for the service they make work.

We do not run analytics cookies, advertising cookies or cross-site trackers. The cookie banner offers "analytics" and "marketing" categories because the law requires us to be able to ask; both are unused today, and if that ever changes we will re-ask before anything is set. The full list is in the Privacy Policy.

If you use Venoly for purposes outside your trade or profession, you are a consumer and Dutch and EU consumer law protects you: the Consumer Rights Directive as implemented in Articles 6:230g–6:230z BW, the Digital Content Directive as implemented in Articles 7:50aa–7:50af BW, and the rules on unfair terms in Articles 6:231–6:247 BW. This Law is a set of general terms and conditions within the meaning of Article 6:231 BW, and we have tried to write it so that nothing in it is unfair.

Paid features today. Venoly offers paid plans, but there is currently no in-app checkout: every paid plan so far has been arranged personally with the founders. When you buy a plan from us as an EU consumer, you have 14 days to withdraw without giving a reason (Article 6:230o BW). If you ask us to start immediately and acknowledge that you lose the withdrawal right once we have fully performed, that right ends when we have (Article 6:230p BW); we will ask you for both statements separately and keep a record. Withdrawal is by any clear statement to support@venoly.nl, and we refund within 14 days by the same means you paid. When in-app checkout launches, the same rules apply and the two acknowledgements are collected at checkout.

Conformity. The platform must work as described. If it does not, you have the remedies Articles 7:50ab–7:50af BW give you. We are obliged to keep the platform updated so it continues to conform, and to tell you about updates you need to install.

You must be at least 13 to use Venoly. We check age by the date of birth you declare when you sign up and in no other way: there is no identity-document check and no age-estimation technology. If we learn that an account belongs to someone under 13, we disable it and delete its data.

Under Dutch law the age at which a person can consent to data processing themselves is 16 (Article 5 UAVG). For users aged 13 to 15 we therefore rely on the contract and on our legitimate interests, not on consent, for the processing needed to run the service. We do not show advertising to anyone, so the DSA's ban on profiling-based advertising to minors (Article 28 DSA) is satisfied by design.

The rules of behaviour are in the Terms of Service, the Acceptable Use Policy and the Code of Conduct. In short: no illegal content, no abuse of other people, no child sexual abuse material of any kind, no attacks on the platform, no impersonation, no spam. Server owners set additional rules for their own servers and must enforce ours.

You may not use Venoly if EU or Dutch sanctions law prohibits us from providing services to you. We do not run our own sanctions screening; we rely on our payment providers' checks and on lawful orders we receive.

Venoly's data is off limits. Attempting to obtain, copy, exfiltrate or decrypt Venoly's data, encryption keys or backups without authorisation is prohibited, is a criminal offence in the Netherlands (computervredebreuk, Article 138ab Wetboek van Strafrecht), and will be reported. That the data is encrypted (Article 19) does not make the attempt permitted.

You own what you post. To run the platform we need a licence from you: a worldwide, non-exclusive, royalty-free licence to store, reproduce, display, transmit, resize, transcode and cache your content for the purpose of operating and improving Venoly. The licence ends when you delete the content, except for copies that remain in backups until they rotate (about 15 days) and copies other users have legitimately made, such as a quoted or forwarded message.

To the extent Dutch law allows (Article 25 Auteurswet), you agree not to object to the technical modifications that delivery requires — resizing, compressing, re-encoding. We do not otherwise alter your content, and we do not use it for advertising or to train AI models.

You promise that you have the right to post what you post and that it does not infringe anyone else's rights. Do not upload identity documents, payment cards or other people's personal data unless you have a lawful reason to. Venoly can technically read the content of any conversation (Article 19), so do not use it for information you could not bear the operator to see.

You are responsible for what happens under your account. Keep your password secret and unique, turn on two-factor authentication or a passkey (both are available in Settings → Security), and tell us at security@venoly.nl the moment you suspect a compromise. Settings → My Account has a "Lock Account" button that revokes every session everywhere. One person, one account, unless we have agreed otherwise; extra accounts made to evade a ban are removed.

If your account is misused because your credentials leaked through no fault of ours, we are not liable for the resulting loss; we will still help you recover the account. That is the whole of our position on account security — there is no further waiver hidden elsewhere.

Bots and integrations are welcome under the Developer Terms. Scraping, credential stuffing, flooding and any automation that degrades the service for others are not. Rate limits apply to every endpoint and are documented for developers.

What automated abuse defence does, and does not do. Our systems detect floods and error storms per network address and block that address for a limited time (fifteen minutes to twenty-four hours). Those blocks expire automatically. They never suspend, delete or otherwise touch an account. If you believe you were caught by mistake, email support@venoly.nl; the block will have expired by the time we reply, but we will look at why it fired.

Venoly is a hosting service under Article 3(g) DSA, and where it disseminates content to the public, an online platform under Article 3(i). Article 6 DSA shields us from liability for content we do not know about, provided we act expeditiously once we do. Our point of contact for authorities (Article 11 DSA) and for users (Article 12 DSA) is one of the founders; the addresses are on the Legal Contact page. Being established in the Netherlands, we do not need an EU legal representative under Article 13.

Who decides. Every warning, mute, removal, suspension and termination is decided by a founder personally. Automated tools — the policy rule engine, upload malware scanning and flood blocking — can slow an action down, block a single request, quarantine a file or put something in a queue. They cannot remove your content or end your account on their own. The full list is in the Terms of Service, Article 15, and in our Automated Decision-Making Disclosures.

Notices. Anyone may report illegal content at /legal/report-content (Article 16 DSA). We confirm receipt, review the notice in a timely, diligent, non-arbitrary and objective manner, and tell the reporter the outcome. Reports of child sexual abuse material may be made anonymously.

Statement of reasons. When we restrict content or an account we give the affected user a statement of reasons that meets Article 17 DSA: what we did, the facts, whether an automated tool was involved, which rule was breached and why, and how to appeal — unless the law forbids telling you, for instance to protect a criminal investigation.

Appeals. You can appeal a suspension, a termination, a posting limit or a warning from the Venoly team within six months of the decision, free of charge. Signed in, go to Settings → Account standing. If your account is suspended or terminated, the sign-in screen offers "Appeal this decision", or go to venoly.nl/appeal and use the email address on your account. Email appeals@venoly.nl if neither works, or to appeal any other decision, such as content we removed. Each decision can be appealed once; a withdrawn appeal can be filed again, a denied one is final. A person reviews every appeal, where possible someone other than the person who made the decision. Venoly is a very small team, so that is not always possible, and when it is not the appeal record says so. We aim to decide within 14 days, and you are told the outcome and the reasons. If we were wrong, we lift the decision, and a terminated account is restored; server memberships removed before 24 October 2026 cannot be restored. Bans and warnings inside a server are appealed to that server's moderators. As a micro-enterprise we are exempt from the DSA's formal internal complaint system and certified out-of-court settlement (Articles 20–21); we offer this appeal route voluntarily, and it never limits your right to go to court or to the ACM.

Proportionality. We restrict the least we can to solve the problem, with regard to your freedom of expression and everyone else's safety, and we apply the same rules to everyone. Repeatedly filing manifestly unfounded reports may lead us to stop processing your reports for a period (Article 23 DSA).

For cause. We may suspend or terminate an account immediately for a serious breach of this Law or the Terms of Service: illegal content, child safety violations, harassment, attacks on the platform or other users, fraud, ban evasion, or conduct that puts people at risk. A statement of reasons follows as Article 14 describes. No refund is due for the unused part of a paid plan when the termination is for cause; that is the consequence of your breach, not a penalty.

Without cause. We may also end our relationship with you without a specific breach — for example if we discontinue the platform or a feature. We will give you at least 30 days' notice where we can, and we will refund any prepaid fees for the period after termination on a daily pro-rata basis, within 30 days, to the payment method you used.

Suspension pending investigation. We may suspend an account temporarily while we look into a suspected breach. If we find nothing, we restore the account and, where you had a paid plan, extend it by the length of the suspension.

By you. You can delete your account at any time from Settings → My Account → Danger Zone. A paid plan you cancel stays active until the end of the period you paid for and does not renew.

What happens to your data. When you delete your account it is deactivated immediately and permanently purged within 30 days. During those 30 days you can ask us to restore it. If you want it gone sooner, email support@venoly.nl and we will purge it directly. Three things survive the purge: copies in backups, which rotate after about 15 days; hashed device identifiers and ban records, which we keep so that a ban cannot be evaded by deleting and re-registering; and records the law requires us to keep, such as a statement of reasons or a payment record. An account we terminate for a breach is deactivated but not purged while the ban stands — the record is what enforces the ban and what an appeal is decided on. A granted appeal, or a founder who lifts the ban, restores the account.

Articles 3, 4, 11, 19, 23, 24, 25 and 29 survive termination.

We may amend this Law, the Terms of Service and the Privacy Policy. For a change that reduces your rights or increases your obligations, we give at least 30 days' notice through at least two channels: an in-app notice and either an email to your registered address or a banner on the website. You may end your account before the change takes effect, and if you have a paid plan you receive a pro-rata refund for the remainder. Corrections, clarifications and changes required by law take effect on publication. Continued use after the effective date is acceptance.

Every version of this document is kept in our source-control history and is available on request from legal@venoly.nl.

As a micro-enterprise Venoly is exempt from the DSA's formal transparency-reporting duty (Article 15(2) DSA). We publish a Transparency Report anyway: notices received and their outcomes, restrictions we applied on our own initiative, requests from authorities, and appeal outcomes. Appeal figures are counted live from 24 October 2026; the other counts fill in as the first reporting period closes. We will not publish numbers we cannot back.

We do not run recommender systems that rank content for you, and we do not show advertising, so Articles 26 and 27 DSA do not apply.

Venoly calls itself security-first, so this article lists what is actually in place rather than what a framework would like us to say. Where it says "we", two people did it.

• All traffic is encrypted in transit with TLS.
• Message content in server channels and direct messages, email addresses, support-ticket contents, two-factor secrets and integration credentials are encrypted at rest with keys held outside the database (Article 19).
• Passwords are hashed with bcrypt; access and refresh tokens are hashed at rest; sign-in uses HTTP-only cookies in the browser.
• Two-factor authentication and passkeys are available to every account.
• Uploaded files are scanned for malware; infected files are quarantined and escalated to a founder.
• Rate limiting on every endpoint, automatic time-limited blocking of flooding addresses, and a rule engine that screens risky requests.
• An append-only, hash-chained audit log of administrative actions.
• Backups every six hours to hardware we control in the Netherlands, rotated after about 15 days.
• Production systems — the database, the servers and the codebase — are run by the Dutch founder. Staff whose rank carries moderation, safety or legal duties can open message content in the staff tools to handle a report or an appeal, and each opening is recorded in an append-only access log kept for two years. The co-founder has no access.
• A full internal security audit was completed in August 2026; findings are being worked through.

Data-access rules. These are the only ways data gets out of Venoly, and they are meant to be hard to satisfy:

• Inside Venoly. One person — the Dutch founder — holds production access. Message content is opened only to act on a report, to comply with a lawful order, or to investigate a specific safety concern, and every such action taken through the platform is written to the hash-chained, append-only audit log. Content is never browsed, searched or read for any other reason.
• Bulk export. The only bulk export of user data is the owner-only export function, which requires the founder account, is rate-limited and is recorded. There is no API, partner feed or integration that hands user data to anyone in bulk.
• Your own data. Export and deletion are self-service from a signed-in session, and an export is released only after a code emailed to the account address is entered. We do not release account data by phone, chat or social media, nor to a third party claiming to act for you without written authority and identity verification.
• Processors. Only the processors named in Article 20 receive data, only the categories listed there, and only under a data-processing agreement — or, where a vendor offers none, with that fact disclosed.
• Authorities. Only under the process in Article 22 — written, verified, specific, minimal, logged and published.
• Nobody else. Venoly does not sell, license, share or trade user data, has no backdoor, and maintains no interception capability.

Venoly is not an essential or important entity under the NIS2 Directive and makes no claim to NIS2 conformance. We do have an incident process: contain, assess, notify the AP within 72 hours where personal data is affected, notify you where the risk to you is high, and publish what happened.

Responsible disclosure. If you find a vulnerability, email security@venoly.nl. We will not take legal action against good-faith research that respects our disclosure policy.

Venoly does not offer end-to-end encryption, and this is a deliberate choice rather than a gap. No part of the Platform provides E2EE or client-side encryption for messages today. Questions about this go to legal@venoly.nl.

The reason is stated plainly: end-to-end encryption would make it technically impossible for Venoly to detect child sexual abuse material, grooming, and other illegal content in private conversations. Venoly has chosen the ability to detect and act on that material over the additional privacy that E2EE would provide. Users who require end-to-end encrypted messaging should use a service built for that purpose.

What protection is actually in place:

• In transit. All traffic between your device and Venoly is encrypted with TLS. This protects your messages from interception on the network.
• At rest — the Vault (SMUSH v1). Sensitive fields are stored only in sealed form: message content in server channels and direct messages, email addresses, support-ticket contents, two-factor secrets and integration credentials. Each value is sealed individually — a per-record key is derived under HKDF from the active keyring key, with a fresh random salt every time, and the resulting envelope is cryptographically bound to the exact row it belongs to, so a sealed value can never be swapped onto a different record and still open. Sealing uses an authenticated cipher (AES-256-GCM, with ChaCha20-Poly1305 available as an alternate suite), so two identical values never look alike in storage and any tampering is detected the moment it is opened. Fields that must still be found by value — an email address, an IP address — use a separate keyed index instead of the plaintext, and searching message content works the same way: the index stores blinded terms, which can reveal term-frequency patterns but never the underlying words.
• Keys. The encryption keys live only in a keyring file kept outside the database — never in the database itself, never in a database backup, and never committed to the source repository. Database backups are themselves sealed the same way as live data before they leave this server. The owner holds one printable recovery bundle, generated once and stored offline, as the only way to restore the keys if this server were lost; without the keyring file or that bundle, there is no practical recovery of the sealed data. We verified on 31 August 2026 that every protected row decrypts only under the current key and that no row depends on a default or development key.
• Credentials. Passwords and access tokens are stored as irreversible hashes, never in a recoverable form.

What that means in a breach. Recovering a Vault-protected value without the key would require guessing a 256-bit key. With every computer on Earth working on nothing else, that takes longer than the age of the universe — by a margin so large that the attempt is meaningless. So if a copy of the database or of a backup is stolen and the keys are not, the protected fields are unintelligible to whoever holds it, and GDPR Article 34(3)(a) recognises exactly that. We will still treat it as a breach: we notify the Autoriteit Persoonsgegevens within 72 hours where required, we tell you what was taken, and we do not call it nothing.

What the Vault does not cover — read this part too. Not every column is sealed. Usernames, display names, the birth month and day shown on a profile (with the year hidden by default), browser fingerprint hashes, the device hash, hardware UUID and machine ID reported by the desktop app, profile text, server memberships and uploaded files are stored in ordinary form, and a breach of the database or of file storage would expose them. The full date of birth collected at signup is sealed; IP addresses and user agents in security logs are sealed with a keyed index for lookups; the MAC addresses and hostname the desktop app reports are sealed too. The hashes and identifiers used to detect ban evasion are not, because they must still be compared exactly. And encryption at rest protects stolen copies, not a running server: someone who fully compromises the live server holds the keys too. That is why the rest of Article 18 exists.

What this means for you. Venoly is technically able to access the content of direct messages. It does so only where necessary — to act on a report, to comply with a lawful order, or to investigate a specific safety concern — and such access is logged. You should not use Venoly to transmit information you would not want the operator to be technically capable of reading. We would rather tell you that clearly than imply a protection that does not exist.

Nothing in this article transfers Venoly's own obligations under the Digital Services Act onto you. Venoly remains responsible for acting on illegal content it is notified of, and a User does not assume Venoly's regulatory liability by using any feature of the Platform.

Your data is stored on servers Venoly owns and operates in Emmen, the Netherlands: the database, the cache, uploaded files, the voice and video server, and the local AI runtime all run there. It is not stored in a public cloud. Only the Dutch founder has access to those systems and to your data; the co-founder, based in the United States, has none. No personal data is accessed from outside the European Economic Area by anyone at Venoly.

A small number of third parties process data for us. The complete list, with what each receives, is the Subprocessors page; the ones that matter most are:

• Cloudflare carries every request to our API through its network, so it sees your IP address and request metadata for all API traffic.
• Vercel hosts the web application and sees the IP address and request metadata of anyone loading it.
• Our email delivery provider receives your email address and the content of the emails we send you.
• Google and Discord handle sign-in when you choose them, and Google delivers push notifications to Android devices. Browser push notifications go through your browser vendor's push service.
• Groq, a hosted AI provider in the United States, processes the text an AI feature needs when you invoke it — the support assistant, catch-up and thread summaries, smart replies, translation, search-query expansion, image descriptions and voice-clip transcription — and generates AI-character replies from the recent messages of the channel (Article 21).
• Pollinations.AI, a free text-to-image service, receives the short description a server manager types to have a server emoji drawn.
• When a founder reviews an account for abuse, the approximate location of an IP address may be looked up through a third-party geolocation service.
• PayPal will process payments when in-app checkout launches; today no payment data passes through the platform.

Where a processor is outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) or, where the provider is certified, the EU–US Data Privacy Framework (Chapter V GDPR). We do not use processors that would require your explicit consent to a transfer.

Venoly uses AI in three places: AI characters that can take part in server conversations, features you invoke yourself (the support assistant, catch-up and thread summaries, smart replies, translation, search-query expansion, image descriptions, voice-clip transcription), and an emoji generator for server managers. The characters and the invoked features send the text they need to Groq; the emoji generator sends the typed description to Pollinations.AI (Article 20). Nothing is sent unless someone uses a feature, or an AI character replies in a channel — which a character does when it is mentioned and, now and then, on its own. When one replies, its persona and the last 15 messages of that channel are sent.

Honesty about status. AI characters are active on the platform. They carry a persistent, visible AI label and you are told before you first interact with one — our obligation under Article 50 of the EU AI Act (Regulation (EU) 2024/1689), which has applied since 2 August 2026. We will never present an AI as a person. A character takes part only in a server it is a member of, and only in channels it can see and post in. Characters are on by default; the server's owner, or anyone with Manage Server, can switch them off for that server, and Venoly can switch them off for a server.

None of our AI systems is a high-risk system under Annex III of the AI Act, and we deploy nothing prohibited by Article 5: no social scoring, no biometric categorisation, no emotion recognition. No model classifies your messages. We do not train any model on your content, and Groq's terms state that API inputs are not used to train theirs.

AI output can be wrong. It is not advice and not a statement by Venoly; you remain responsible for what you do with it.

Venoly discloses user data to an authority only through the following process, and no other:

1. Written legal process under Dutch law. A court order, an order of the examining magistrate (rechter-commissaris), a demand by the public prosecutor that the Dutch Code of Criminal Procedure authorises for the data in question, or a binding order under the Digital Services Act. The content of communications is disclosed only on a judicial order. Requests made by email, telephone or web form, and requests that cite no legal basis, are refused.
2. Verified. Before anything is disclosed we confirm the identity of the requesting authority through an official channel we look up ourselves — never through the contact details in the request.
3. Specific. The order must name a specific account, identifier or piece of content and a bounded time period. Requests for "all users who…", for everyone in a server, or for open-ended monitoring are refused, and we ask the issuing authority to narrow anything overbroad.
4. Minimal. We disclose only the data the order covers, and nothing more.
5. Foreign authorities. Requests from outside the Netherlands are accepted only through the channels Dutch law recognises — a European Investigation Order, a mutual legal assistance treaty, or a Dutch court. We do not hand data to foreign agencies on a direct request, and no foreign law obliges us to.
6. Emergencies. Where an authority states there is an imminent threat to someone's life, we act quickly — under the same verification step — and disclose only what is needed to address the threat.
7. Logged and published. Every request, refused or fulfilled, is recorded, and the counts are published by country in the Transparency Report, including when the count is zero.
8. You are told. We notify the affected user before disclosing unless the law prohibits it or a court orders otherwise, and afterwards once any prohibition lapses.

Venoly is not a public telecommunications provider, maintains no interception capability under the Telecommunicatiewet, and has no backdoor into the Vault (Article 19). An order can compel us to hand over what the platform holds, and nothing more.

What we are liable for. Venoly is liable to you for loss caused by our own failure to do what this Law and the Terms of Service oblige us to do — for example, not refunding you when a refund is due, or losing your data through our fault. That liability is real and we do not try to contract out of it.

What we are not liable for. To the extent Dutch law allows, we are not liable for indirect or consequential loss (lost profit, lost revenue, lost goodwill), for loss caused by things outside our control (Article 27), for loss caused by another user, a third-party service or your own conduct, or for the platform being unavailable. Venoly gives no uptime guarantee; live status is at status.venoly.nl and we tell you about planned maintenance in advance where we can.

Cap. Our total liability to you in any twelve-month period is limited to the greater of EUR 100 or the amount you paid us in the twelve months before the event giving rise to the claim.

Limits on the limits. None of the above applies to liability for intent or gross negligence on our part, for death or personal injury caused by our negligence, for fraud, or to any liability that cannot be limited under Dutch consumer law or the GDPR. Those apply in full. Nothing in this article prevents you from bringing a claim in court; it defines what the claim can succeed on.

You are liable to us for loss we suffer because you breach this Law — including claims by third parties about your content — and you will compensate us for it, except where Dutch consumer law limits that obligation.

We publish only what we can back up. Every statement on this page, in the Terms of Service and in the Privacy Policy is meant to describe what the platform actually does. If you find one that does not, it is a mistake, not marketing; report it to legal@venoly.nl and we will correct the page.

Third parties speak for themselves. Services you use alongside Venoly — Discord, Google, Vercel, your browser, your internet provider, a bot someone else wrote — are run by other companies under their own terms. They are responsible for their own services and for the data they hold about you (your IP address, your provider details, credentials you gave them). Statements those companies make about Venoly, and claims other users make about Venoly, are not ours. We are responsible for what we say and do, and for nothing else.

Both sides deal with each other in good faith, as Article 6:248 BW requires. We read this Law as a whole and according to its evident purpose, and so should you; neither of us may use a literal reading of one sentence to defeat the plain meaning of another.

Knowingly false abuse reports, fabricated claims and attempts to extort refunds through threats are breaches of this Law and may lead to termination for cause. That is the only consequence. Nothing here stops you from complaining to a regulator, from going to court, or from saying what you think of us in public — and we do not impose penalties, forfeitures or fixed sums for doing any of those things.

Features marked as beta, experimental or early access may change, break or disappear without notice, and data inside them may not be kept if the feature is withdrawn. They are provided as they are, and the conformity rights in Article 8 apply to them only to the extent the law does not allow us to exclude them. Do not rely on a beta feature for anything you cannot afford to lose.

Neither of us is liable for failing to perform because of something genuinely outside our control (overmacht, Article 6:75 BW): natural disaster, war, government action, strikes, failure of the internet or of a third-party provider we reasonably depend on, power loss, or a cyberattack we could not reasonably have prevented. The affected party tells the other without undue delay and does what it reasonably can to resume. If the situation lasts more than 90 days, either of us may end the agreement without liability. Being short of money is not force majeure.

You may not transfer your account or your rights under this Law to anyone else. Venoly may transfer its rights and obligations to Venoly B.V. on incorporation (Article 2) and, with notice to you, to a successor in a merger, acquisition or reorganisation that takes on the same obligations. If you object to a transfer, your remedy is to delete your account, with a pro-rata refund of any prepaid fees.

If Venoly shuts down. Should we discontinue the platform, we will give at least 30 days' notice where we can, keep the data-export function working for that period, and refund prepaid fees pro rata. In an insolvency the Dutch Faillissementswet governs what happens, an appointed trustee decides whether the service continues, and claims for prepaid fees rank as ordinary unsecured claims. We say this so that you know to keep your own copies of anything you cannot afford to lose.

Severability. If a provision of this Law is invalid, the rest stands, and the invalid provision is replaced by a valid one that comes closest to its purpose (Article 3:41 BW).

No waiver. If we do not enforce a provision on one occasion, we may still enforce it later.

Entire agreement. This Law, the Terms of Service, the Privacy Policy and the policies named in Article 1 are the whole agreement between you and Venoly. Terms on a purchase order or in an email do not change it.

Notices. Notices to Venoly go to the addresses in Article 30 and take effect on receipt. Notices to you go to the email address on your account and to the app; keep that address current.

Language. This document is written in English. If we publish a translation and it differs from the English text, the English text prevails.

No partnership. Using Venoly, running a server on it or building a bot for it does not make you our partner, agent or employee, and does not let you speak for us.

Venoly is run by its two founders — one in Emmen, the Netherlands, where the platform is operated, and one in the United States. There is no legal department; the addresses below reach the founders directly.

• Legal notices: legal@venoly.nl
• Privacy & data rights: privacy@venoly.nl
• DSA points of contact (authorities and users): see the Legal Contact page
• Appeals: venoly.nl/appeal, or appeals@venoly.nl
• Security & responsible disclosure: security@venoly.nl
• Everything else: support@venoly.nl

We aim to answer legal correspondence within ten business days and data-subject requests within the one month the GDPR allows. A registered address for service of process will be published here once Venoly B.V. is incorporated; until then, write to legal@venoly.nl.

The Law of Venoly — Emmen, the Netherlands — version of 24 October 2026. Earlier versions are available on request.