Pre-incorporation notice. Venoly is run by its two founders and operated from Emmen, the Netherlands (the co-founder is based in the United States), while the legal entity (a Dutch B.V.) is being incorporated. Contracts and liabilities referenced in these documents are entered into by the founder personally until incorporation completes, at which point they transfer to Venoly B.V. by novation without action required from you. Where the documents refer to Venoly B.V., that name should be read as "Venoly (operating as a sole proprietorship pending incorporation)" until the entity is registered with the Dutch Chamber of Commerce (KvK).
1. Overview
Venoly keeps as much processing as possible on hardware Venoly owns and operates in Emmen, the Netherlands: the database, file storage, and voice and video all run there (section 4). AI character replies are written by Groq (see the table). The vendors below process limited categories of personal data on our behalf to make the rest of the platform work.
This list is derived from what the code actually contacts, not from a template. Where a vendor offers a data-processing agreement under Article 28 GDPR we have accepted it, and where data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) or the EU–US Data Privacy Framework where the vendor is certified. Where a vendor offers no agreement — currently ip-api.com — we say so rather than imply a protection that does not exist.
2. Current Subprocessors
Current as of the "Last updated" date above.
| Vendor | Purpose | Region | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. IP address, request headers and metadata, and request/response content in transit for API calls; cached copies of uploaded files (images, video, audio and other attachments) for up to 30 days. | Carries all traffic to our API (api.venoly.nl) through its network via a Cloudflare Tunnel. TLS terminates at Cloudflare’s edge, so it processes API requests and responses in transit. Uploaded files are served with a 30-day cache lifetime, so Cloudflare also keeps cached copies of them at its edge for up to 30 days, including after a file is deleted. | Global edge network | Standard Contractual Clauses in Cloudflare’s DPA; Cloudflare is certified under the EU–US Data Privacy Framework |
| Vercel Inc. Browser request metadata: IP address, user-agent, request path, referrer. | Hosts the web frontends (venoly.nl, app, landing, blog, status, developer, support, staff, panel). | Global; EU regions where available | Standard Contractual Clauses in Vercel’s DPA; Vercel is certified under the EU–US Data Privacy Framework |
| Resend, Inc. Your email address and the content of the emails we send you. | Delivers our transactional email: verification, password reset, security alerts, DSA notice acknowledgements, maintenance notices. | United States | Standard Contractual Clauses in Resend’s DPA |
| Google LLC — Sign in with Google Google user ID, email address, name, avatar. | Identity flow only, when you choose to sign in with Google. | United States | Standard Contractual Clauses in Google’s terms; Google is certified under the EU–US Data Privacy Framework |
| Google LLC — Firebase Cloud Messaging FCM device token and the notification title/body (we send no message bodies beyond that). | Delivers push notifications to the Android app. | United States | Standard Contractual Clauses in Google’s terms; Google is certified under the EU–US Data Privacy Framework |
| Discord Inc. Discord user ID, email address, username, avatar. | Identity flow only, when you choose to sign in with Discord. | United States | Standard Contractual Clauses in Discord’s terms |
| Groq, Inc. Whatever the feature used is given: your support question, the messages being summarised or translated (including other people’s messages in that conversation), your search query, an image you asked to have described, a voice clip you asked to have transcribed, short clips of your own microphone while you have live captions on (and the text of a caption line you ask to have translated), the recent messages of a channel, with their authors’ display names, when a server owner captures an FAQ from it, the interest blurbs of members who opted in to Meet People in a server, the description you type into the AI server-template or bot generator (and a test message you send to a generated bot), or — for AI characters — the recent messages of the channel the character is replying in. | Hosted language and speech models behind the AI features people invoke on demand: the support assistant, conversation catch-up (when you press Catch me up) and thread summaries, smart-reply suggestions, message translation, search-query expansion, image descriptions, voice-clip transcription, live captions in calls, auto-responder rules a server owner sets up for their own server, FAQ auto-capture (when a server owner presses Capture, the recent messages of the channel they pick are sent so that answered questions can be drafted into the server’s FAQ), and Meet People matchmaking (when a member of a server presses Find matches, their interest blurb and the blurbs of up to 30 other members who opted in there are sent), and the AI generators for server templates and bots (the description you type, and a test message you send to a bot you generated). Nothing is sent unless one of those features is used — by you, by a server owner on their own server, or, for Meet People, by another member who opted in — and there is no background classification of messages. Live captions are per person: only while you have captions on are short clips of your own microphone sent, the server refuses clips from anyone who has not turned captions on, and the text is shown live in the call and not saved. AI characters (the named personas that reply in some server channels) also run on Groq: when one replies, its persona prompt and the last 15 messages of that channel are sent to generate the reply. A character replies only in a server it is a member of, when mentioned and now and then on its own. You are shown a disclosure the first time you meet one, and the server’s owner, or anyone with Manage Server, can switch characters off for their server. | United States | Standard Contractual Clauses in Groq’s DPA. Groq states that API inputs are not used to train its models. |
| Pollinations.AI (image.pollinations.ai) The emoji description they typed (up to 200 characters), with a fixed style suffix appended. No account details, no IP address beyond the one our server connects from, no message content. The returned image is stored on Venoly; nothing is fetched from the provider afterwards. | Draws the picture for Server Settings → Emojis → “Generate with AI”. Only a server member with the Manage Emojis permission can use it, and nothing is sent unless they press Generate. | Germany (Berlin-based project). Where the image models it routes to run is not stated. | None specific to Venoly — a free, keyless public API with no data-processing agreement. Do not put anything personal in the description; the form says so next to the button. |
| GIPHY, Inc. and KLIPY (GIF search) The words you search for, from our server (not your browser). Once results are on screen, your browser loads the GIF images from the provider’s image servers (as it would for any image link in chat), which shows them your IP address; the same happens for everyone who sees a GIF you send. | The GIF button in the message box. Our server sends your search to the provider and returns the results; GIPHY and KLIPY never see your account. | United States (GIPHY); KLIPY does not state where it processes requests. | API terms only; no data-processing agreement. Search terms carry no account identifier. Paste a link instead if you do not want to use the search. |
| Imgflip, Inc. (memes) The caption text you write, sent by our server when you press Make and send. The finished picture is public on Imgflip (anyone with its link can see it), and viewers’ browsers load it from Imgflip. | The Memes tab of the GIF button: the list of meme templates, and making a meme from one. | United States | API terms only; no data-processing agreement. Captions pass Venoly’s content filters first, and each person can make 15 an hour. |
| ip-api.com A truncated form of the IP address under review — the last octet of an IPv4 address (or the last 80 bits of an IPv6 address) is dropped before the lookup, so the provider never receives the exact address. Sent over plain HTTP, not HTTPS, on the free tier we use. | IP geolocation lookup when a founder reviews an account for abuse (approximate country/city of an IP address). | Not stated by the provider | None. No data-processing agreement is available on this tier. We list it so the transfer is not hidden; it is being replaced by a local geolocation database, after which this row will be removed. |
| Your browser's push service (Mozilla, Google or Apple, chosen by your browser) An opaque push-subscription endpoint. Notification payloads are encrypted to your browser, so the push service cannot read them. | Delivers browser push notifications for the web app, if you turn them on. | Depends on your browser vendor | Not a Venoly-contracted processor — governed by your browser vendor’s terms. Turn browser notifications off to stop it. |
Removed on 31 August 2026 because the code does not use them: Twilio SendGrid (email is delivered by Resend), Cloudflare Turnstile (our captcha is self-built and involves no third party), Stripe (not active — see section 3) and "LiveKit Inc." (our voice server is self-hosted, not a vendor service — see section 4).
3. Planned, Not Yet Active
There is currently no in-app checkout, so no payment data passes through the platform. When checkout launches, PayPal will process payments and will be added to the table above at least 30 days before activation, as section 5 requires. A Stripe integration exists in the codebase but is not enabled and contacts nothing; if it is ever switched on, the same notice applies.
4. Self-Hosted Components
The following run on a server Venoly owns in Emmen, the Netherlands (Arch Linux). They are parts of our own infrastructure, not subprocessors, and data handled by them does not leave our hardware:
- PostgreSQL — the application database. Direct-message content is encrypted at rest with keys we hold.
- Redis — sessions, rate limiting, presence, realtime fan-out, scheduled-job locks.
- LiveKit — our own voice and video relay. Calls are not recorded.
- Ollama — a local language-model runtime, installed and reachable, but not currently the backend for AI characters — those replies are generated by Groq (see the table). If we move characters back to this local runtime, the Groq row will be updated the same day.
- ClamAV — malware scanning of uploaded files.
- NGINX and cloudflared — the reverse proxy in front of the API and the tunnel client that connects it to Cloudflare.
- PM2 — process supervisor.
The database and uploaded files are backed up every six hours to internal disks in the same machine. Database backups are rotated after about 15 days, and a file deleted from Venoly is kept in the file backup for about 15 days.
5. Changes & Notice
Before we add or replace a subprocessor we update this page at least 30 days before the change takes effect, and we announce it in-app. Business customers under a Data Processing Agreement receive direct email notice and may object as set out in section 6. Removals and corrections take effect on publication.
6. Right to Object
If you are a business customer using Venoly as a processor for your own users, you may object to a new subprocessor within 30 days of notice on legitimately reasoned data-protection grounds. We will work in good faith to resolve the concern or, if we cannot, you may terminate the affected service.
Everyone else: objections to any of the processing described here go to privacy@venoly.nl, and the rights in the Privacy Policy apply.
