This notice explains what Vennado does with information about you. It covers the website at vennado.com and the planner on it.
The short version
- No accounts. We do not collect passwords or email addresses. A plan is reached by its link.
- The group sees when you are busy and what kind of busy it is: work, on call, personal or rest. Never what, where or who with. Event titles, locations, notes and attendees are never uploaded from a calendar file, and are stripped from a calendar link before it reaches your browser.
- Rota files are read only with your agreement, then dropped. A rota you add is read by an AI model run by Cloudflare to find your work and on-call times, after you tick a box to agree. We do not store or log the file, the photo or the text. Leave and sickness are not read into your diary at all, and nothing records them.
- A shared plan stores very little: its name, dates and settings, each person's display name and busy times, the shortlist, the votes and the choice you lock in.
- Plans delete themselves 90 days after they were last changed. The person who created a plan can delete it at once, from the browser they started it in or with their private organiser link. Anyone else can ask us by email.
- Our host keeps short records of its own. Cloudflare, which runs Vennado, sees your network address, as any host does, and keeps some request records for days or weeks. They are described below.
- No advertising cookies and no tracking pixels.
- You can see, correct and remove your own entry from the plan itself, or ask us by email.
Who we are
Vennado is operated by Sycamore Healthworks Ltd, company number SC886987, registered at 2/3, 48 Clyde Offices, West George Street, Glasgow, G2 1BP. We are the controller of the personal information described in this notice.
- Email: contact@sycamorehealthworks.com
- Registration with the Information Commissioner's Office: ZC215158
What we collect, feature by feature
Reading the website
You can read every page without telling us who you are. We do not ask you to sign in and there is nothing to sign in to.
Starting a plan
When you start a plan you give it a name and say how far ahead to look. You also give yourself a display name. This can be a first name or a nickname. It does not have to be your real name. Later steps ask for the plan's preferences: the size of the group, the budget a head and the town you are setting off from.
A plan you never share stays only in your browser's local storage. It is not sent to our server.
Sharing a plan and joining one
When a plan is shared, it is saved on our server so that other people can open it. Anyone who has the link can view the plan and add themselves to it. The link contains an id that cannot be guessed, but it is the only thing protecting the plan, so send it only to the people you want in it.
The person who shares the plan is also given a private organiser link. It carries a key that lets them remove people or delete the plan from any browser. The key sits in the part of the link after the # sign, which browsers do not send to any server, so we never receive it. Keep the organiser link to yourself.
For a shared plan the server stores:
- the plan's name, its range of dates and its preferences (budget a head, group size, setting-off town and the settings that decide what counts as a free window);
- each member's display name;
- each member's busy intervals, which are a start time, an end time and a kind (work, on call, personal or rest);
- the shortlist of ideas, each member's votes, and the choice that is locked in;
- the technical records needed to run the plan: when it was created and last changed, and scrambled (hashed) versions of the keys that show who may edit an entry or delete the plan. The keys themselves are not stored.
If you add somebody else to a plan, such as a relative who does not use a phone, you are giving us their display name and busy times. Please tell them, and show them this notice.
Adding a calendar file
A calendar file (.ics) is read in your own browser. Only busy intervals are kept: a start, an end and a kind. Event titles, locations, notes and attendees are never uploaded.
Adding a calendar link
A calendar link is the .ics address your calendar gives you in Google Calendar, iCloud or Outlook. Browsers cannot fetch these addresses directly, so the link is fetched through our server. The server strips every event down to its timing fields before passing it to your browser. It does not store or log the feed or the link.
The link itself is saved only in your own browser, so that you can refresh your diary later. It is not saved with the plan and other members cannot see it.
Adding a rota
A rota file (a PDF, a spreadsheet or a Word document), photo or pasted text is sent to our server, once you have ticked the box to agree, and read by an AI model run by Cloudflare (Workers AI) to extract shift dates and times. The file and the text are not stored by Vennado and are not logged.
A rota often has other people's names on it. They are read in the same pass, so that you can be asked which name is yours, and they are not stored or logged either. If you would rather not send them, crop the image to your own row or paste only your own shifts.
A rota can also say more than when people work. It may mark annual leave, training or sickness, for you and for others on it. The model is asked for your work and on-call times only, within the plan's dates, and to leave out days off, leave and sickness altogether. So only work and on call become busy time, nothing records that a day was leave or sickness, and nothing from other people's rows is kept.
Because a rota can show these things, the planner asks you to agree before it is sent: you tick a box that says what will happen to it, and nothing is sent until you do. If you would rather not send it, you can type your shifts in or mark your busy days by hand instead, and nothing is sent at all.
You review and correct the extracted shifts before they count. Only the resulting busy intervals join the plan.
Tapping busy days in by hand
What you tap becomes busy intervals in the same way. Nothing is read.
Following a link to a seller
When you follow a link from Vennado to a ticket seller, restaurant, hotel or travel company, we count the click in aggregate, by provider and by category of idea only. The count holds no personal data.
The link may carry what a search on the seller's site needs, such as the town, the date and the size of the group. It carries nothing about who you are. Once you are on the seller's site, the seller's own privacy terms apply. If an affiliate programme is active for that link, the seller may record that the visit came from Vennado.
Keeping the service running
To stop the service being overloaded or abused, our server counts requests from each internet connection over a minute, an hour and a day. It does this with a scrambled (salted and hashed) value made from your network address, also called your IP address. Vennado's own database does not store the address itself, and each count is deleted within a day of the period it covers.
Your network address is still seen by our host. Every website works this way: your device sends its address with each request so that the answer can come back to it. Our host is Cloudflare. It uses the address to deliver pages and to protect the site, and keeps some of it in the records described next.
Records our host keeps
Cloudflare keeps these records for us, as part of running Vennado.
- Request logs. For each request that reaches Vennado's own server code (loading a shared plan, saving a diary, reading a rota and so on), our code writes one short line: the kind of request, the general form of the address it was sent to with any ids left out, whether it worked and how long it took. Our code does not write your network address, a plan's id, a name, a calendar link or anything you entered. Cloudflare may attach further details of the request to each line. Cloudflare keeps these lines for up to 7 days. Ordinary pages, pictures and styles are not logged by our code.
- Security records. When one of Cloudflare's protections blocks or challenges a request, for example because one connection is sending too many, Cloudflare keeps a sample of those requests with the network address, the address of the page asked for, the browser and the country. For a shared plan, the page address includes the plan's id. We can look at these records for up to 31 days.
- Traffic totals. Cloudflare counts the requests the site receives and shows them to us as totals, for example by country.
We use these records only to keep Vennado running and secure, and to look into problems.
Contacting us
If you email us, we receive your email address and whatever you write. Our email is hosted by Google (Google Workspace), which stores messages for us. Mail sent to an address at vennado.com is forwarded to that mailbox by Cloudflare's email routing. We use them to answer you and keep them only as long as that takes, or as long as the law requires.
What we never collect
- Passwords, because there are no accounts.
- Email addresses, unless you choose to email us.
- Payment details. You pay sellers directly, on their own sites.
- The titles, locations, notes or attendees of your calendar events.
- Your rota file, photo or pasted text, once it has been read, or the reason for any day you were not working.
- Your calendar feed or its link.
- Anything through advertising cookies or tracking pixels. We use neither.
We do not sell personal information and we do not use it for advertising.
Why we are allowed to use your information
Data protection law requires a lawful basis for each use.
| What we do | Lawful basis |
|---|---|
| Store a shared plan and show it to the people who have its link | Legitimate interests: providing the planner you and your group have chosen to use, in the way you would expect |
| Read a rota | Your consent, given by ticking the box before the rota is sent. A rota can show sickness, which is health information, so this is also your explicit consent to it being read in the same pass (it is then left out, not kept). Nothing is sent without it |
| Fetch a calendar link when you ask us to | Legitimate interests: carrying out the action you have just requested |
| Limit requests, and keep the records our host keeps, to prevent overload and abuse | Legitimate interests: keeping the service available and secure |
| Answer your emails and requests about your information | Legitimate interests in dealing with enquiries, and our legal obligations under data protection law |
We rely on consent only to read a rota. You can withdraw it at any time by removing the rota from your diary in the plan; the rota itself was never kept, so there is nothing else to undo. For everything else we rely on legitimate interests, and we do not use your information for anything you would not expect from a planner. You have the right to object to any use that is based on legitimate interests. See "Your rights" below.
Please do not put sensitive information into a plan. A display name and busy times are all a plan needs. The label on a calendar event, such as a medical appointment, never reaches us, and a sick day on a rota counts only as not busy.
Who else handles your information
We use two companies to run Vennado. Both handle information on our behalf and on our instructions.
- Cloudflare, Inc. provides the hosting, the database that holds shared plans (Cloudflare D1), the AI model that reads rotas (Workers AI), and the records described under "Records our host keeps".
- Google (Google Workspace) hosts our email, so it holds the messages you send us and our replies. Cloudflare passes on mail sent to vennado.com addresses.
Cloudflare publishes its position on Workers AI and privacy. It says that it does not use the inputs and outputs of the service to train the AI models made available on Workers AI, or to improve Cloudflare's or anyone else's services, without explicit consent, and that it does not make them available to any other Cloudflare customer. It also says the models are provided by third parties and are not created or trained by Cloudflare.
The other members of a plan can see your display name, your busy times and the kind of each (work, on call, personal or rest), because that is what the plan is for. Anyone else who obtains the plan's link can see them too.
We do not share personal information with sellers, advertisers or anyone else. We would disclose information if the law required us to.
Where your information is processed
Cloudflare runs a worldwide network, so your information may be processed outside the United Kingdom, including in the United States.
Cloudflare's privacy policy says that for transfers of personal data from the UK to the United States it relies on its certification under the UK Extension to the EU-U.S. Data Privacy Framework, which the UK government calls the UK-US data bridge, and that it otherwise uses standard contractual clauses. If our email provider stores messages outside the UK, the same kind of safeguard applies. You can ask us for more detail about any of these using the contact details above.
How long we keep it
| Information | How long |
|---|---|
| A shared plan and everything in it | Deleted automatically 90 days after the plan was last changed. The person who created the plan can delete it at once, from the browser they started it in or with the organiser link, and anyone can ask us to. Deletion removes it from the live database straight away; Cloudflare's point-in-time recovery history for the database, which exists so that a fault can be undone, keeps earlier states for up to 30 days and then discards them |
| Your own entry in a shared plan | Until you remove yourself, the organiser removes you, or the plan is deleted |
| A plan you never share | It stays in your own browser until you clear it. We never hold it |
| Rota files, photos and pasted text | Not stored. Read, then dropped |
| Calendar feeds and calendar links | Not stored on our server. The link stays in your browser until you clear it |
| Request counts used to prevent abuse | Deleted within a day of the period they cover |
| Request logs kept by Cloudflare | Up to 7 days |
| Security records kept by Cloudflare | We can see them for up to 31 days |
| Aggregate click counts | Kept. They contain no personal data |
| Emails you send us | As long as it takes to deal with them, or as the law requires |
Storage in your browser, and cookies
Vennado uses your browser's local storage to remember the plans you have opened and who you are in each one. This is also where a plan you have not shared lives, where a calendar link is kept so that you can refresh it, and, if you started a shared plan, the key that lets you delete it. This storage is needed to provide the planner you have asked for. It stays on your device, and you can clear it at any time in your browser's settings. If you clear it, this browser will no longer know which entry in a plan is yours.
We use no advertising cookies and no tracking pixels.
Children
Vennado is for adults. Please do not use it if you are under 18, and do not enter children's names. A plan does not need them. A child's commitments can go in as busy time on an adult's diary, and a label such as "school run" is never stored anyway.
Automated decisions
Rota reading is automated, but it makes no decision about you. It produces a list of shifts, and you check and correct that list before it is used. We do not make decisions about people by automated means that have legal or similarly significant effects.
Your rights
Under UK data protection law you have the right to:
- be told how your information is used, which is the purpose of this notice;
- see the information we hold about you;
- have it corrected if it is wrong;
- have it erased;
- restrict how we use it;
- object to our using it, where we rely on legitimate interests;
- complain to us and to the Information Commissioner's Office.
These rights are free to use, and we will normally respond within one month.
How to use your rights when there are no accounts
Most of this you can do yourself, straight away.
- To see what we hold: open the plan from its link. Your display name, your busy times and your votes are everything we hold about you in that plan, and they are all shown there.
- To correct it: edit your diary or your name in the plan, from the browser you used to add it.
- To erase it: remove yourself from the plan. If you created the plan, you can delete the whole plan at once, from the browser you started it in or, in any browser, with your organiser link. Otherwise it is deleted automatically 90 days after it was last changed.
- To clear what is on your device: clear this site's storage in your browser.
If you cannot do this yourself, email contact@sycamorehealthworks.com. That happens more often than you might think: you may have changed phone, your browser may have cleared the site's storage (some browsers do this when a site has not been visited for a while), or you may have opened the link inside another app that keeps its own browser. Send us the plan's link and the display name of the entry, and say what you would like us to do. We can send you a copy of what we hold, correct it, remove your entry or delete the plan. We have no account to check you against, and anyone with a plan's link can already see what is in it, so we may ask a question or two to be sure the entry is yours before we change or remove it.
We cannot find a plan from your name alone. Without the link we have no way of telling which plan is yours.
If you are unhappy
Tell us first, at contact@sycamorehealthworks.com. We will acknowledge a data protection complaint within 30 days and respond without undue delay.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator. You can do so at ico.org.uk/make-a-complaint or by calling 0303 123 1113. The ICO will usually expect you to have raised the matter with us first.
Changes to this notice
If Vennado changes in a way that affects this notice, for example if accounts are ever added, we will update this page and the date at the top before the change takes effect. The terms of use and the accessibility statement sit alongside this notice, and how Vennado works describes each feature in more detail.