Privacy Policy

This Privacy Policy explains how VenueRun ("VenueRun", "we", "us" or "our") collects, uses, shares and protects personal information when you use venuerun.com, the VenueRun dashboard, merchant and venue storefronts, the VenueRun App Clip, our APIs and any related services (together, the "Services").

VenueRun is an ordering platform. Businesses such as restaurants, bars, stadiums and other venues ("Merchants" and "Venues") use it to take table, pickup and self-checkout orders from their customers ("Customers"). This policy covers both groups:

• Merchants and Venues — the businesses, and their owners and team members, who create an account and use the dashboard.
• Customers — people who browse a storefront or place an order with a Merchant through the Services, on the web or in the App Clip.

If you do not agree with this policy, please do not use the Services.

1. Who is responsible for your information

When you create a VenueRun account or use the dashboard, VenueRun is responsible for your information.

When you order from a Merchant, the Merchant is the seller and decides how it uses your order details, as its own business. VenueRun processes that order on the Merchant's behalf and also uses some of it for our own purposes described below (for example, security, fraud prevention and running the Services). Questions about how a particular Merchant uses your information should go to that Merchant.

2. Information we collect

Information you give us

• Account information — name, email address, password (stored by our authentication provider, never in plain text), and profile details. If you sign in with Apple or Google, we receive the name and email address that provider shares with us.
• Business information — for Merchants and Venues: business name, handle, address, hours, branding, menus, products, prices, tax settings, team members and their roles, and other settings you configure.
• Order information — what you order, chosen options, notes, tip, fulfillment type (for example a table or tag number, or pickup), and the contact details you enter at checkout, such as your name, email address and phone number.
• Payment information — card and wallet payments are processed by Stripe. Your full card number is entered into Stripe's systems and is never stored by VenueRun. We receive limited details back, such as the payment status, card brand and last four digits.
• Content you upload — images, logos, menu photos and other files.
• Communications — messages you send us and your support requests.

Information collected automatically

• Device and usage data — IP address, browser and device type, operating system, language, pages and screens viewed, referring URLs, and the date and time of requests. We use this to operate, secure and improve the Services.
• Logs — requests made to our APIs, including by API keys a Merchant creates. Credentials in those logs are redacted.
• Cookies and local storage — see Cookies and similar technologies.

Information from the App Clip

• Invocation data — the VenueRun link, NFC tag or App Clip Code you scanned, which tells us which Merchant, Venue or table you are ordering from.
• Camera — with your permission, the App Clip uses the camera to scan table codes and product barcodes. Scanning happens on your device; we receive only the code that was read, never images or video.
• Apple Pay — when you pay with Apple Pay, Apple and Stripe process the payment. We receive the payment result and the contact details you choose to share.

Information from others

• Merchants may add customer records, for example from their own systems.
• Stripe shares information about a Merchant's connected account (such as onboarding status) and payment outcomes.
• Sign-in providers (Apple, Google) share the basic profile information you authorize.

3. How we use information

We use personal information to:

• Provide the Services — create and manage accounts, publish storefronts, take and route orders, and process payments.
• Send transactional messages — sign-in codes, order confirmations, "your order is ready" notices, refund notices, new-order alerts to Merchant staff, account and security emails, and workspace invitations.
• Provide support and respond to requests.
• Keep the Services secure — detect, prevent and investigate fraud, abuse and security incidents, and enforce our Terms of Service and Acceptable Use Policy.
• Improve the Services — understand how features are used and fix problems, using aggregated or de-identified data where we can.
• Comply with law — meet tax, accounting, legal and regulatory obligations, and respond to lawful requests.
• Send product news to Merchants and Venues, where permitted. You can opt out at any time.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

AI features

Some dashboard features use artificial intelligence. For example, a Merchant can photograph a printed menu and have its sections and products extracted automatically. To do this, the image is sent to a third-party AI model provider through our AI gateway, and the result is shown to the Merchant to review before anything is saved. We do not use Customer order data to train AI models, and our providers may not use the content we send them to train their models.

4. How we share information

We share personal information only as described here:

• With the Merchant you order from. When you place an order, the Merchant receives your order and the contact details you entered so it can prepare and hand over your order and contact you about it. The Merchant may also see your order history with that Merchant. Merchants can send order data to their own systems through webhooks, API keys and functions they configure. Each Merchant's use of your information is governed by its own privacy practices.
• With a Venue. When you order through a Venue's page, the Venue can see which of its Merchants you ordered from, but order and payment details belong to the Merchant.
• With team members of a workspace, according to the roles the workspace owner assigns.
• With service providers who process data on our behalf, under contracts that limit their use of it:

• For legal reasons — to comply with law, a court order or other legal process; to protect the rights, property or safety of VenueRun, our users or the public; or to enforce our agreements.
• In a business transfer — in connection with a merger, acquisition, financing or sale of all or part of our business, subject to this policy.
• With your consent or at your direction.

Stripe

Merchants connect their own Stripe account to accept payments. Payments are made to the Merchant through Stripe, and Stripe's processing is governed by the Stripe Privacy Policy. Merchants who onboard with Stripe also agree to the Stripe Connected Account Agreement.

5. How long we keep information

We keep personal information for as long as we need it for the purposes in this policy:

• Accounts — while your account is open. When a workspace is deleted, its data is deleted from our active systems.
• Orders and payments — for as long as the Merchant's account is active and as required for tax, accounting, chargeback and legal purposes.
• API logs — about 30 days.
• Sign-in codes — sign-in codes expire after 10 minutes.
• Backups — deleted data may remain in backups for a limited period before it is overwritten.

We may keep information longer where the law requires it or to resolve disputes, prevent fraud and enforce our agreements.

6. Cookies and similar technologies

We use a small number of cookies and browser storage that the Services need to work:

• Session cookies keep you signed in and protect against cross-site request forgery.
• Preference storage remembers settings such as your light or dark theme.
• Local storage in the browser holds things like the favorites you save before signing in and the dashboard's test-mode switch.

We do not use advertising cookies. You can clear or block cookies in your browser settings, but parts of the Services, such as signing in, will not work without them. Our Services do not currently respond to "Do Not Track" signals; we honor Global Privacy Control signals where the law requires it.

7. Security

We use administrative, technical and physical safeguards to protect personal information, including encryption in transit, access controls based on roles, scoped and revocable API keys, signed tokens for each order, and payment processing that keeps card numbers out of our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires.

8. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy of it.
• Correct inaccurate information.
• Delete your information.
• Object to or restrict certain processing, or withdraw consent you gave.
• Opt out of marketing emails, using the unsubscribe link in any marketing email.
• Not be discriminated against for exercising these rights.

Merchants and Venues can update most information directly in the dashboard and can delete their workspace under Settings → Danger.

To make a request, email us at the address in Contact us. We may need to verify your identity before acting on it, and we will respond within the time the law requires (generally 30 to 45 days). You may use an authorized agent where the law allows.

If your request concerns an order you placed with a Merchant, we may refer it to that Merchant, because the Merchant decides how it uses its customers' information.

California and other U.S. states

Residents of California, Colorado, Connecticut, Virginia, and other U.S. states with privacy laws have the rights above as those laws provide. In the past 12 months we have collected the categories of information described in Information we collect — identifiers, commercial information (orders), internet activity, and limited payment information — for the purposes in How we use information, and shared them only as described in How we share information. We have not sold or shared personal information for targeted advertising.

European Economic Area, United Kingdom and Switzerland

Where these laws apply, we process personal information to perform our contract with you, for our legitimate interests in running and securing the Services, to comply with legal obligations, and with your consent where we ask for it. You may lodge a complaint with your local data protection authority.

9. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. You must be at least 18 to create a Merchant or Venue account. If you believe a child under 13 has given us personal information, contact us and we will delete it.

10. International transfers

VenueRun is based in the United States, and our service providers may process information in the United States and other countries. Where we transfer personal information across borders, we rely on appropriate safeguards required by applicable law.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above. If the changes are material, we will give notice in the Services or by email before they take effect.

12. Contact us

Questions or requests about this policy or your personal information can be sent to venuerun@gmail.com.