Venera privacy notice

This privacy notice tells you what to expect us to do with your personal information.

Contact details

Email: [email protected]

What information we collect, use, and why

We collect or use the following information for the operation of customer accounts:

• Account information, including registration details (username, email address, hashed passwords. We do not store your actual password).
• An optional profile picture, if you choose to upload one. We crop and resize it, and re-encode it so that only the image itself is kept. All meta-data will be removed and is not stored on our server.

We collect or use the following information for preventing fraud and misuse of our service:

• IP address and browser signals, processed via Cloudflare Turnstile when you sign up, to confirm you're not an automated bot
• A short-lived log of failed sign-in and password-reset attempts, used to prevent abuse of those forms

We collect or use the following information for publishing and hosting packages:

• The package files and metadata you choose to upload (including the package name, version, description, and any other details you provide)
• Your username, which is shown publicly as the package's publisher so that other users know who to credit and can report issues to the right person

Package publishing is a public feature. Once you publish a package, its contents, metadata, and your username as publisher are visible to, and downloadable by, anyone. Your email will stay private.

We also use:

• A session cookie to keep you signed in while you use the site.

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information.

Our lawful basis for the operation of customer accounts is:

• Contract - We have to collect and use this information to create and operate your account. Without it, we can't provide you the account-based features of the site. All of your data protection rights may apply except the right to object.

Our lawful basis for preventing fraud and misuse of our service is:

• Legitimate interests - We collect and use this information because it protects our service and other users from automated abuse (fake accounts, credential-stuffing attempts), without creating undue risk of harm to you. We don't use this data for anything beyond that purpose. All of your data protection rights may apply, except the right to portability.

Our lawful basis for publishing and hosting packages is:

• Contract - We have to collect, store, and publicly display this information so we can provide the package-publishing features of the site to you, and so that other users can discover, download, and rely on the packages you publish. Because publishing is inherently public, the right to object and the right to restriction of processing may not apply to information you've chosen to publish.

Your data protection rights are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website.

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure - You have the right to ask us to delete your personal information.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
• Your right to object to processing - You have the right to object to the processing of your personal data.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
• Your right to withdraw consent - When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details above.

Where we get personal information from

• Directly from you

How long we keep information

• Failed sign-in / password-reset attempt logs - Automatically deleted after 1 day.
• Account information - Kept for as long as your account exists. You can delete your account at any time in your account settings. Deleting your account immediately disables login, but we keep the underlying record for 30 days in case of a mistake or a compromised account — contact us within that window if you'd like it restored. After 30 days it's permanently and irreversibly erased.
• Profile picture - Kept until you remove or replace it in your account settings, at which point it's deleted immediately. If you delete your account, it's kept for the same 30-day restore window as your account information and then permanently erased.
• Published packages - Kept indefinitely once published, even if you later delete your account, because other people's projects may depend on them continuing to be available. You can contact us to request removal of a specific package, but we may decline where removing it would break other users' projects.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: [email protected]

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:

ICO Head Office 4th Floor, No.3 Circle Square 5 Hawkshaw Street Manchester M1 7BL

Helpline number: 0303 123 1113 Website: https://www.ico.org.uk/make-a-complaint