Pre-incorporation notice. Venoly is run by its two founders and operated from Emmen, the Netherlands (the co-founder is based in the United States), while the legal entity (a Dutch B.V.) is being incorporated. Contracts and liabilities referenced in these documents are entered into by the founder personally until incorporation completes, at which point they transfer to Venoly B.V. by novation without action required from you. Where the documents refer to Venoly B.V., that name should be read as "Venoly (operating as a sole proprietorship pending incorporation)" until the entity is registered with the Dutch Chamber of Commerce (KvK).

1. Overview

GDPR Article 13(2)(f) and Article 22 require that when we use automated processing to make decisions that significantly affect you, we tell you about it and explain the logic. The DSA reinforces this for content moderation. This page is the consolidated, human-readable disclosure of where we use automated processing, what data feeds it, and how to opt out where possible.

2. Venilator Policy Evaluation

Venilator is our policy engine. Eight policies run on the request path to evaluate signals like rate, entropy, content length, and known-bad indicators. Each evaluation returns one of four actions:block, throttle, warn, or captcha.

Account security — login-attempt scoring, credential-stuffing detection.
Anti-spam — message-burst rate limiting, repeated-content scoring.
Content filter — caps ratio, mention spam, invite spam, link spam thresholds.
DDoS shield — global request rate limiting.
File upload — MIME, magic-byte, and ClamAV result combination.
Global — cross-policy entropy and reputation gating.
Invite abuse — invite-velocity and conversion scoring.
Login guard — geo and device anomaly detection.

A Venilator block outcome can prevent you from sending a particular message, completing a login, or uploading a file. It does not on its own terminate an account; account-level decisions require a human moderator and produce a separate Statement of Reasons.

3. Hardware & Browser Forensics

We compute device-level signals to combat ban evasion and raid coordination. These include:

Canvas / WebGL fingerprinting on the web.
Hardware identifiers (MAC, hardware UUID, machine ID, hostname, derived device hash) on the desktop app.
Connection metadata (IP, ASN, country).

The legal basis is legitimate interest (Art. 6(1)(f) GDPR). We hold a written Legitimate-Interest Assessment for this processing; request a copy by emailing privacy@venoly.nl. Retention is two years from last observation. You may object at any time; see §7.

4. AI Character Disclosures

Some marketplace personas and server members are AI characters powered by a language model run by Groq, a hosted provider in the United States. They look like other members in some contexts and that is exactly the situation EU AI Act Article 50(1) is designed for.

Our commitments:

Every AI character carries a persistent [AI] badge on their profile and member-list card.
The first time you message an AI character, you see a one-time disclosure modal explaining that you are interacting with AI. Your acknowledgement is stored.
AI characters do not see private DMs between you and other humans.
The recent messages an AI character reads are sent to Groq to write its replies. Venoly doesn't use them to train models, and Groq's terms say API inputs are not used to train theirs.

5. Voice & Video Calls

We do not record voice or video calls by default. Where a server's configuration enables moderator review of a stream — for instance the Aegis lockdown feature — a persistent indicator is shown to every participant, and you confirm a one-time recording acknowledgement before joining a recordable surface.

Recording another participant without their knowledge using third-party software is prohibited by the Acceptable Use Policy and may be a criminal offence under Article 139a of the Dutch Penal Code.

6. Behavioral Analytics

We capture aggregated, anonymous product analytics — how many users opened a page, average session length, error rates — to keep the platform reliable. The analytics pipeline does not build profiles tied to your real identity for any business purpose other than operational reliability and abuse prevention. We do not run ad-tech tracking.

7. Your Rights Around Automated Processing

Under GDPR Article 22 you have the right:

To object to automated processing — email privacy@venoly.nl.
To request human review of any automated decision that significantly affects you.
To receive meaningful information about the logic involved — this page is the public summary; details specific to a decision against you are provided in the Statement of Reasons you receive.
To contest the decision: a suspension, termination, posting limit or warning is appealed from Settings → My Account → Account standing, or at venoly.nl/appeal if you cannot sign in; any other decision by email to appeals@venoly.nl. A person reviews every appeal and can overturn the decision.