®
--:--
Svenska Sign in Book a demo /30 min

Product

Venuvo OSFour modules, one database, nothing to integrate. Customer IntelligenceContacts, companies and the whole history of a relationship. Pipeline ArchitectureLeads staged and scored, moving into delivery without a handover. NovaAn assistant with the run of your workspace and nothing outside it. PricingPer seat, per month. No modules to unlock.
Nova · The loopIt does the work, then it stops and asks

Company

About VenuvoFounder-run since 2024. Still building. Client caseRaise The Bar AB — quotes, drawings, installations. ContactThirty minutes, your pipeline on the screen, no deck. Sign inGo to your workspace.
Client case · EskilstunaErgonomic bars, designed and installed worldwide

Findings

Four stages, four documentsField research · 3 min · 9 July 2026 All findingsField research and engineering notes.
Latest · Field researchFour stages, four documents

Security

How it is builtWhat the system does, and what it does not do yet. Data sovereigntyWhere the data sits and who is able to reach it. Sub-processorsEvery third party with access, named. Help centreAnswers, and a person at the end of them.
Security · How it is builtEvery control, and how it is enforced

LegalSub-ProcessorsEffective September 5, 2026

Sub-Processors

Venuvo AB, org. nr 559499‑4484. This is the document as it stands today. When it changes, the effective date above changes with it.

All documents are indexed on the legal page. A Swedish version of this document is available on request from info@venuvo.net.

1. Introduction

Venuvo AB (org.nr 559499-4484) engages the following third-party sub-processors to assist in providing the Venuvo platform and related services. This list is maintained in accordance with our Data Processing Agreement (DPA) and Article 28 of the GDPR.

As a Data Processor, Venuvo is required to maintain a current list of all Sub-Processors that process Personal Data on behalf of our Customers (Data Controllers). This document serves as that list.

  • What is a Sub-Processor? A Sub-Processor is a third-party company that we use to help deliver parts of our Service. For example, Supabase hosts our database — they process your data on our behalf, making them a Sub-Processor.

2. Notification of changes

In accordance with our DPA, Venuvo will provide Customers with at least thirty (30) calendar days' prior written notice before engaging any new Sub-Processor or replacing an existing Sub-Processor. Notifications will be sent via email to account administrators. Customers who wish to object to a new Sub-Processor may do so within fifteen (15) days of receiving the notification, in accordance with Section 5.4 of the DPA.

3. Current sub-processors

Sub-ProcessorLegal EntityPurpose of ProcessingLocation of ProcessingCategories of Data Processed
SupabaseSupabase, Inc.Database hosting, authentication, realtime subscriptions, file storage, edge functionsEU (Stockholm, Sweden); US parent entity (SCCs)All Customer Data including contact records, deal data, communications, files, authentication credentials, and session data
LovableLovable Labs IncorporatedApplication hosting for app.venuvo.net, backend runtime, and AI Gateway routing for the Nova assistantEU (application data on Supabase infrastructure); onward transfers to AI providers (SCCs)All Customer Data processed by the application, and any Customer Data included in prompts submitted to Nova
OpenAIOpenAI Ireland Ltd. / OpenAI, L.L.C.AI model inference for the Nova assistant, accessed via the Lovable AI GatewayEU / US (SCCs)Prompt content, including any Customer Data included in a Nova request, and generated outputs
Google (Gemini)Google Ireland Limited / Google LLCAI model inference for the Nova assistant, accessed via the Lovable AI GatewayEU / US (SCCs)Prompt content, including any Customer Data included in a Nova request, and generated outputs
StripeStripe Payments Europe, Ltd. / Stripe, Inc.Payment processing, subscription billing, invoice management, fraud preventionEU (Ireland) / US (SCCs)Billing data: payment card tokens, billing addresses, VAT numbers, transaction records, subscription status
Google WorkspaceGoogle Ireland LimitedBusiness email and support correspondence (info@venuvo.net), document storageEU / US (SCCs)Any personal data contained in support correspondence sent to or from Venuvo
ResendResend, Inc.Transactional email delivery (account invitations, notifications). Not yet in production — see Section 4.US (SCCs)Recipient names and email addresses, and the content of transactional messages
CloudflareCloudflare, Inc.Authoritative DNS for venuvo.net; delivery and CDN for the public marketing websiteGlobal network / EUDNS query metadata, access logs, IP addresses and browser information for the marketing website. No Customer Data is stored at rest.

Resend is listed in advance of deployment. It is not currently in production use and no Personal Data is transmitted to it at the date of this list. This entry serves as advance notice under Section 2.

4. AI processing (Nova assistant)

The Venuvo platform includes an AI assistant (“Nova”). When a user submits a request to Nova, the request and any Customer Data included in it are transmitted through the Lovable AI Gateway to a third-party model provider — currently OpenAI or Google — which generates the response. Venuvo does not use Customer Data to train AI models, and requires that its AI sub-processors do not do so either.

Customers are informed when a feature is powered by AI, and Nova does not make automated decisions producing legal or similarly significant effects without human involvement.

5. Transfer safeguards

For Sub-Processors located outside the European Economic Area (EEA), or whose parent entity is established outside the EEA, we ensure that appropriate safeguards are in place for the transfer of Personal Data:

  • Standard Contractual Clauses (SCCs): We have entered into the European Commission's Standard Contractual Clauses (adopted under Commission Implementing Decision (EU) 2021/914) with all non-EU Sub-Processors.
  • Adequacy Decisions: Where applicable, we rely on adequacy decisions issued by the European Commission under Article 45 of the GDPR.
  • Supplementary Measures: We implement supplementary technical and organizational measures as recommended by the European Data Protection Board (EDPB) in its Recommendations 01/2020, where a Transfer Impact Assessment indicates they are necessary.
  • Contractual Protections: All Sub-Processors are contractually bound to implement security measures and data protection standards no less protective than those set forth in our DPA.

6. Sub-processor security requirements

All Sub-Processors must meet the following minimum security requirements:

  • Encryption of Personal Data at rest and in transit.
  • Access controls implementing the principle of least privilege.
  • Regular security assessments and vulnerability management.
  • Incident response procedures and data breach notification capabilities.
  • Compliance with applicable data protection laws.

7. Updates

This list was last updated on the date shown above. The most current version is always available at https://www.venuvo.net. For questions about our Sub-Processors, contact us at info@venuvo.net.

Venuvo AB Org.nr: 559499-4484 Örebro, Sweden Email: info@venuvo.net Website: https://www.venuvo.net

Questions about this document?

Legal and privacy enquiries go to info@venuvo.net and reach a founder, not a queue.

Book a demo /30 min