---
title: "Security and data privacy"
summary: "How VenueX handles store, stock and sales data for multi-location retailers, with SHA-256 hashed contact data, no raw contact data received, role-based access, isolation between brands, brand-owned platform accounts and the KVKK and GDPR data-processor role."
canonical_url: https://venuex.io/security
lang: en
alternate:
  tr: https://venuex.io/tr/security.md
last_updated: 2026-10-28
type: security
---

> Site index: https://venuex.io/llms.txt
>
> Türkçe: https://venuex.io/tr/security.md

# Security and data privacy at VenueX

VenueX keeps store details, reviews and local inventory correct on Google, Apple Maps, Meta and Yandex, and sends store sales to Google Ads, Meta and TikTok, for multi-location retailers. To do this, VenueX receives a brand's store list, store stock and store sales, and works inside the brand's own platform accounts. This page lists the security and data-handling controls that are in the product today, and the documents that a legal or IT team can request.

## Controls at a glance

- Email addresses, phone numbers and names arrive hashed with SHA-256. No raw contact data is received.
- Data sent by SFTP, API, file or Google Sheet. No ERP or CRM access: the brand chooses the files or feeds VenueX reads.
- Four roles. Review responders cannot edit locations or see ad results.
- Each brand isolated from every other brand.
- Platform accounts owned by the brand. VenueX works with partner or OAuth access.
- VenueX AI (Beta) changes go live only after a person approves them.
- VenueX works as the brand's data processor under KVKK and GDPR.

## Data VenueX receives

Each kind of data has one job. The brand chooses which fields it sends and how often.

| Data | Fields | Used for | Sent to |
|---|---|---|---|
| Store list | Store names, addresses, opening hours, store phone numbers, store codes | Store presence | Google, Apple Maps, Meta, Yandex |
| Stock | Product ID, store ID, in stock or not. Stock counts are not needed. | Local inventory | Google (Merchant Center), Meta (catalog) |
| Store sales | Hashed email, phone and name, sale value, store code, time of sale. Basket lines are optional. | Online-to-offline measurement | Google Ads, Meta, TikTok |

Reviews are read from the brand's Google Business Profile. Review replies are posted there after a person approves them.

VenueX does not ask for special categories of personal data, such as health data or religious belief.

## How data arrives

- Transfer methods: SFTP, API, a file (for example Excel, JSON or XML) or a shared Google Sheet.
- The store list can come from an Excel file, the brand's website store locator or a shared Google Sheet.
- Stock can come from an export of the brand's stock system, the website's per-store stock or a Google Sheet. Binary availability (in stock or not) is enough.
- Store sales usually arrive as a daily file from the brand's POS or CRM.
- VenueX does not connect to the brand's ERP, CRM, POS databases or production systems. The brand sends the data; VenueX does not pull it from the brand's network.

## Hashing and personal data

- Email addresses, phone numbers and names are hashed with SHA-256. The exact field formats, including the phone number format, are agreed in the sales data contract during setup.
- The brand hashes the identifiers in its own systems before sending the file.
- VenueX does not receive raw contact data: email, phone and name arrive hashed.
- Store code, sale value and time of sale are not hashed, because the ad platforms need them to report store sales.
- Google Ads, Meta and TikTok match the hashed identifiers against their own users through their official APIs. VenueX does not build its own customer profiles and does not sell data.
- Hashed identifiers are pseudonymised data, not anonymous data. Under KVKK and GDPR they are still personal data.

## Access control

- VenueX has four roles: admin, brand member, location member and review responder.
- The review responder role is for customer relations and store teams that answer reviews. A review responder can reply to reviews, cannot edit locations and cannot see ad results or ad spend.
- Each brand is a separate tenant. Access checks block any access across brands.
- The full permission list for each role is available on request.

## Platform accounts and access

The brand owns every platform account. VenueX works through partner or OAuth access that the brand, or its agency, grants. If the brand stops working with VenueX, the accounts stay with the brand.

| Platform | What VenueX manages | Notes |
|---|---|---|
| Google Business Profile | Store details, reviews and review replies | Group permission on the brand's own profiles. The brand stays the owner. |
| Apple Maps | Store details | Through the brand's own Apple account. |
| Meta | Store pages, catalog for local inventory, store sales dataset | Through the brand's own Meta business account, page and ad account. |
| Yandex | Store details | Sent as a store data file under the brand's own Yandex account. |
| Google Merchant Center | Local inventory feed | Store codes are matched to the Google Business Profile locations. |
| Google Ads | Store sales upload | Ad account access granted by the brand or its agency. |
| TikTok | Store sales upload | Ads only. VenueX does not manage store details on TikTok. |

## VenueX AI and your data

VenueX AI is the in-platform assistant. It is in Beta.

- It answers questions about the brand's locations, reviews and Google and Meta ad results at campaign level.
- It prepares changes to location fields and review replies. Each change shows the store, the field, the current value and the new value.
- Nothing goes live until a person approves the change. Approved changes are logged, and the result is read back from the platform.
- It works only inside the brand's own data. Access to other brands' data is blocked.
- Conversations with the assistant are logged.
- It uses the signed-in user's role. A user sees and changes only what the role allows.
- VenueX AI acts on request. It does not make changes on its own.

## KVKK and GDPR

- VenueX works as a data processor. The brand is the data controller.
- The brand decides which data is sent, for which purpose and to which platforms. VenueX processes the data on the brand's instructions.
- Because hashed identifiers are still personal data, the brand's own legal review and KVKK sign-off apply before store sales are sent.
- A data processing agreement (DPA) is available on request.

## Documents on request

- Data processing agreement (DPA)
- Answers to the brand's security questionnaire
- Subprocessor details
- Details on hosting, encryption, backups and data retention

To request a document, email info@venuex.io or plan a call through https://venuex.io/contact. VenueX replies within 1 business day.

## Not supported

- VenueX holds no security certification, such as ISO 27001 or SOC 2, at this time.
- VenueX does not connect to the brand's ERP, CRM, POS databases or production systems.
- VenueX does not receive raw contact data: email, phone and name arrive hashed.
- VenueX does not sell data and does not build its own customer profiles.
- VenueX does not take ownership of the brand's platform accounts.
- VenueX AI does not publish changes without approval and cannot create new locations.
- VenueX AI reports ad results at campaign level only, not at ad set or ad level.

## FAQ

### Is hashed data anonymous?

No. SHA-256 hashing pseudonymises email addresses, phone numbers and names. Under KVKK and GDPR, hashed identifiers are still personal data. VenueX works as the brand's data processor.

### Does VenueX need access to our ERP or CRM?

No. The brand sends data by SFTP, API, file or Google Sheet. VenueX does not connect to the brand's databases or production systems.

### Who owns our Google, Apple Maps, Meta and Yandex accounts?

The brand does. VenueX works with partner or OAuth access and does not take ownership. If the brand stops working with VenueX, the accounts stay with the brand.

### Can our customer relations team reply to reviews without seeing ad spend?

Yes. The review responder role can reply to reviews. It cannot edit locations or see ad results.

### Can VenueX AI change our store data on its own?

No. VenueX AI prepares a change and shows the current and new value. The change goes live only after a person approves it.

### Does VenueX have ISO 27001 or SOC 2?

No. VenueX holds no security certification at this time. The DPA, answers to your security questionnaire and subprocessor details are available on request.

## Related pages and actions

- [Security and data privacy (web page)](https://venuex.io/security)
- [VenueX AI](https://venuex.io/platform/venuex-ai) ([Markdown](https://venuex.io/platform/venuex-ai.md))
- [Online-to-offline measurement](https://venuex.io/platform/offline-conversions) ([Markdown](https://venuex.io/platform/offline-conversions.md))
- [Store presence](https://venuex.io/platform/store-presence) ([Markdown](https://venuex.io/platform/store-presence.md))
- [Local inventory](https://venuex.io/platform/local-inventory) ([Markdown](https://venuex.io/platform/local-inventory.md))
- [Privacy policy](https://venuex.io/privacy) ([Markdown](https://venuex.io/privacy.md))
- [KVKK notice (Turkish)](https://venuex.io/tr/kvkk)
- [Plan a call or request documents](https://venuex.io/contact) ([Markdown](https://venuex.io/contact.md))
- Email: info@venuex.io