VenusHub Monitor: Privacy Notice
Version: 1.0 Last updated: 12 November 2026
1. Who we are
VenusHub Monitor is run by VENUSHUB CY LTD ("VenusHub", "we", "us"), Geranon 1, 7040 Larnaca, Cyprus, registration number HE442414, VAT number CY60003025H. Contact for anything in this notice, including privacy requests: admin@venushub.eu, +357 99 212336.
2. What the service is
VenusHub Monitor measures video and audio streams that you ask us to watch. We connect to the stream addresses you register, measure what arrives (availability, picture, sound, transport quality), keep the results, show them to your team, and alert the people you name when something goes wrong. We measure each stream as it arrives at our measuring point, not at your viewers' homes, and we collect nothing from the viewers of your streams.
3. Who is responsible for what
- Your account and our own operation (sign-in, security, billing, support): we decide why and how the data is used, so we are the controller.
- The content of your streams (pictures and sound that our measurements, snapshots and clips may contain): you decide what we watch and why, so you are the controller and we act on your instructions as your processor, under the data-processing terms in our Terms of Service.
4. What personal data we process, why, and on what basis
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: e-mail address, your name if you give it on the sign-up form, the password (held by our sign-in system only as a hash), the second-factor secret for owners and administrators, your role in your organisation | to create your account and let you sign in | contract |
| Sign-in and security records: sign-in times, whether a second factor was used, a session token (stored only as a hash), failed attempts, the network address (IP) of requests | to keep accounts secure, limit abuse and investigate incidents | legitimate interests (security) |
| Organisation data: organisation name, the people on your team and their roles, invitations (the invitee's e-mail), the e-mail addresses you ask us to alert, API keys you create, and a record of your acceptance of our terms | to run your organisation's account and send what you ask for | contract |
| Your streams: each stream's address (which may contain a user name, password or token if you put one in it), its name and settings, an SRT passphrase if you give one | to connect to your streams | contract |
| Measurements: per-minute results, snapshots (still pictures), clips and recordings cut when an alert fires, logos you upload, reports | to show you the state of your streams and evidence of incidents | contract, and your instructions (section 3) |
| Audit records: which of our staff or your team members changed what, and when (with their e-mail address) | accountability and security | legitimate interests |
| Support: what you write to us and our replies | to help you | contract / legitimate interests |
| Billing: your plan, your company name, billing address, VAT number and billing contact, and the invoices we issue from our accounting system (Odoo). If card payment is introduced, card details go straight to our payment provider and never reach us | to charge and account for the service | contract, legal obligation (accounting) |
| E-mail we send you: address verification, password reset, invitations and the alert e-mails you ask for | to deliver the service | contract |
Automated decisions: none. Alerts follow thresholds set by you or by your plan; no one is profiled.
5. What we do not collect
- Anything from the end viewers of your streams.
- Advertising or analytics trackers. The service uses only the cookies listed in section 11.
- We do not sell personal data.
6. Where the data is kept
- Production: OVHcloud servers in London, United Kingdom.
- Backups: encrypted before they leave the production server, and kept on a separate OVHcloud server in Roubaix, France, and on a computer controlled by VenusHub in Cyprus. The decryption keys are not kept on either server.
7. Who else handles the data (our sub-processors)
| Provider | For what | Location |
|---|---|---|
| OVHcloud (France) | servers and backups | United Kingdom and France |
| Cloudflare (USA) | the network in front of the service, protection against attacks, access control for our staff pages; sees traffic metadata and the requests as they pass | global network |
| Resend (USA) | sending verification, password-reset, invitation and alert e-mails | USA |
| Odoo (Belgium) | our website and our invoicing | EU |
| Stripe (only if card payment is introduced) | card payments | EU / USA |
Our sign-in system (Keycloak) runs on our own servers and is not a separate provider.
8. Transfers outside the EU/EEA
Our production data is in the United Kingdom, which the European Commission recognises as providing adequate protection (renewed in December 2025, in force until 27 December 2031). Where a provider in section 7 processes data in the USA, we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses in that provider's data-processing agreement.
9. How long we keep it
- Measurement history: kept while your organisation is active. We do not currently promise a fixed retention period.
- When you close your organisation: its plan stops at once; its team can still sign in, read history and download reports for 30 days. Then we delete its streams, measurements, snapshots, clips, recordings, reports, team, invitations, API keys and plan from the live system. Our audit records keep their entries with each member's address replaced by a placeholder.
- Backups: encrypted backups made before the deletion keep a copy for up to 35 days more, then disappear.
- Sign-in sessions: a session ends after 8 hours at most, or 60 minutes without use; we keep only a hashed token, the sign-in provider's identifier and whether a second factor was used. A sign-in in progress is held for 10 minutes.
- Streams you stop monitoring: the measuring server removes its local copy about 15 minutes later.
- Server logs (which include network addresses): kept for a limited time; they are rotated by size and removed when the service is updated.
- Accounting records (invoices, payments) are kept as long as the law requires. Closing an organisation does not delete them.
10. How we protect it
- Separation: each organisation sees only its own data.
- Sign-in: a second factor is required for owners and administrators; repeated wrong passwords are throttled; sessions are time-limited.
- Network: traffic to the service is encrypted in transit; our staff pages sit behind an access gate; our measuring servers refuse to reach private network addresses.
- Backups: encrypted, with the keys held outside the servers.
- A limit you should know about: stream addresses (including any user name, password or token you put in them) are stored without encryption at rest on our server's disk and in our daily database copy. Avoid putting a credential in a stream address where you can.
- Incidents: if a breach affects your personal data, we notify the supervisory authority within 72 hours where the law requires it, and tell affected customers without undue delay.
11. Cookies and similar storage
We use only cookies the service needs to work. None is used for advertising or analytics.
| Name | Where | Purpose | Lasts |
|---|---|---|---|
__Host-vh_customer | portal | keeps you signed in | up to 8 hours, 60 minutes idle |
__Host-vh_login | portal | ties a sign-in in progress to your browser | 10 minutes |
vh_lang | portal | remembers the language you chose (English, Greek or Arabic) | 1 year |
vh_flash | portal | shows one short message after a change | seconds |
AUTH_SESSION_ID, KC_RESTART, KC_AUTH_SESSION_HASH, KEYCLOAK_IDENTITY, KEYCLOAK_SESSION | sign-in page | our sign-in system's session | the sign-in session (up to 10 hours, 30 minutes idle) |
The portal also remembers a few display choices (such as a chart's time window) in your browser's own storage; they are not sent to us.
12. Your rights
Under the GDPR you may ask us for access to your data, correction, deletion, restriction of use and a portable copy, and you may object to processing based on our legitimate interests. Write to admin@venushub.eu. We reply within one month (extendable as the law allows). If your data appears in a customer's stream content, please contact that customer first; we will help them answer.
13. Complaints
You may complain to the Cyprus Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy), or to the authority in your own country.
14. Changes to this notice
We publish changes on this page with a new version and date, and tell account owners by e-mail when a change matters to them.
VenusHub Monitor: Privacy Notice
Version: 1.0 Last updated: 12 November 2026
1. Who we are
VenusHub Monitor is run by VENUSHUB CY LTD ("VenusHub", "we", "us"), Geranon 1, 7040 Larnaca, Cyprus, registration number HE442414, VAT number CY60003025H. Contact for anything in this notice, including privacy requests: admin@venushub.eu, +357 99 212336.
2. What the service is
VenusHub Monitor measures video and audio streams that you ask us to watch. We connect to the stream addresses you register, measure what arrives (availability, picture, sound, transport quality), keep the results, show them to your team, and alert the people you name when something goes wrong. We measure each stream as it arrives at our measuring point, not at your viewers' homes, and we collect nothing from the viewers of your streams.
3. Who is responsible for what
- Your account and our own operation (sign-in, security, billing, support): we decide why and how the data is used, so we are the controller.
- The content of your streams (pictures and sound that our measurements, snapshots and clips may contain): you decide what we watch and why, so you are the controller and we act on your instructions as your processor, under the data-processing terms in our Terms of Service.
4. What personal data we process, why, and on what basis
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: e-mail address, your name if you give it on the sign-up form, the password (held by our sign-in system only as a hash), the second-factor secret for owners and administrators, your role in your organisation | to create your account and let you sign in | contract |
| Sign-in and security records: sign-in times, whether a second factor was used, a session token (stored only as a hash), failed attempts, the network address (IP) of requests | to keep accounts secure, limit abuse and investigate incidents | legitimate interests (security) |
| Organisation data: organisation name, the people on your team and their roles, invitations (the invitee's e-mail), the e-mail addresses you ask us to alert, API keys you create, and a record of your acceptance of our terms | to run your organisation's account and send what you ask for | contract |
| Your streams: each stream's address (which may contain a user name, password or token if you put one in it), its name and settings, an SRT passphrase if you give one | to connect to your streams | contract |
| Measurements: per-minute results, snapshots (still pictures), clips and recordings cut when an alert fires, logos you upload, reports | to show you the state of your streams and evidence of incidents | contract, and your instructions (section 3) |
| Audit records: which of our staff or your team members changed what, and when (with their e-mail address) | accountability and security | legitimate interests |
| Support: what you write to us and our replies | to help you | contract / legitimate interests |
| Billing: your plan, your company name, billing address, VAT number and billing contact, and the invoices we issue from our accounting system (Odoo). If card payment is introduced, card details go straight to our payment provider and never reach us | to charge and account for the service | contract, legal obligation (accounting) |
| E-mail we send you: address verification, password reset, invitations and the alert e-mails you ask for | to deliver the service | contract |
Automated decisions: none. Alerts follow thresholds set by you or by your plan; no one is profiled.
5. What we do not collect
- Anything from the end viewers of your streams.
- Advertising or analytics trackers. The service uses only the cookies listed in section 11.
- We do not sell personal data.
6. Where the data is kept
- Production: OVHcloud servers in London, United Kingdom.
- Backups: encrypted before they leave the production server, and kept on a separate OVHcloud server in Roubaix, France, and on a computer controlled by VenusHub in Cyprus. The decryption keys are not kept on either server.
7. Who else handles the data (our sub-processors)
| Provider | For what | Location |
|---|---|---|
| OVHcloud (France) | servers and backups | United Kingdom and France |
| Cloudflare (USA) | the network in front of the service, protection against attacks, access control for our staff pages; sees traffic metadata and the requests as they pass | global network |
| Resend (USA) | sending verification, password-reset, invitation and alert e-mails | USA |
| Odoo (Belgium) | our website and our invoicing | EU |
| Stripe (only if card payment is introduced) | card payments | EU / USA |
Our sign-in system (Keycloak) runs on our own servers and is not a separate provider.
8. Transfers outside the EU/EEA
Our production data is in the United Kingdom, which the European Commission recognises as providing adequate protection (renewed in December 2025, in force until 27 December 2031). Where a provider in section 7 processes data in the USA, we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses in that provider's data-processing agreement.
9. How long we keep it
- Measurement history: kept while your organisation is active. We do not currently promise a fixed retention period.
- When you close your organisation: its plan stops at once; its team can still sign in, read history and download reports for 30 days. Then we delete its streams, measurements, snapshots, clips, recordings, reports, team, invitations, API keys and plan from the live system. Our audit records keep their entries with each member's address replaced by a placeholder.
- Backups: encrypted backups made before the deletion keep a copy for up to 35 days more, then disappear.
- Sign-in sessions: a session ends after 8 hours at most, or 60 minutes without use; we keep only a hashed token, the sign-in provider's identifier and whether a second factor was used. A sign-in in progress is held for 10 minutes.
- Streams you stop monitoring: the measuring server removes its local copy about 15 minutes later.
- Server logs (which include network addresses): kept for a limited time; they are rotated by size and removed when the service is updated.
- Accounting records (invoices, payments) are kept as long as the law requires. Closing an organisation does not delete them.
10. How we protect it
- Separation: each organisation sees only its own data.
- Sign-in: a second factor is required for owners and administrators; repeated wrong passwords are throttled; sessions are time-limited.
- Network: traffic to the service is encrypted in transit; our staff pages sit behind an access gate; our measuring servers refuse to reach private network addresses.
- Backups: encrypted, with the keys held outside the servers.
- A limit you should know about: stream addresses (including any user name, password or token you put in them) are stored without encryption at rest on our server's disk and in our daily database copy. Avoid putting a credential in a stream address where you can.
- Incidents: if a breach affects your personal data, we notify the supervisory authority within 72 hours where the law requires it, and tell affected customers without undue delay.
11. Cookies and similar storage
We use only cookies the service needs to work. None is used for advertising or analytics.
| Name | Where | Purpose | Lasts |
|---|---|---|---|
__Host-vh_customer | portal | keeps you signed in | up to 8 hours, 60 minutes idle |
__Host-vh_login | portal | ties a sign-in in progress to your browser | 10 minutes |
vh_lang | portal | remembers the language you chose (English, Greek or Arabic) | 1 year |
vh_flash | portal | shows one short message after a change | seconds |
AUTH_SESSION_ID, KC_RESTART, KC_AUTH_SESSION_HASH, KEYCLOAK_IDENTITY, KEYCLOAK_SESSION | sign-in page | our sign-in system's session | the sign-in session (up to 10 hours, 30 minutes idle) |
The portal also remembers a few display choices (such as a chart's time window) in your browser's own storage; they are not sent to us.
12. Your rights
Under the GDPR you may ask us for access to your data, correction, deletion, restriction of use and a portable copy, and you may object to processing based on our legitimate interests. Write to admin@venushub.eu. We reply within one month (extendable as the law allows). If your data appears in a customer's stream content, please contact that customer first; we will help them answer.
13. Complaints
You may complain to the Cyprus Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy), or to the authority in your own country.
14. Changes to this notice
We publish changes on this page with a new version and date, and tell account owners by e-mail when a change matters to them.