Privacy Policy

Section 01

Who is responsible for your data

The data controller for vibemyway.com and the VibeMyWay for Mac app is:

Federico Pizzutto, sole proprietorship
Cité Grand-Duc Jean, Walferdange, Luxembourg, European Union
VAT: LU34016608 · RCS: A44145
Contact: federico [at] vibemyway.com

We are based in Luxembourg and operate under the EU General Data Protection Regulation (GDPR) and Luxembourg's data protection law. The supervisory authority is the CNPD (Commission nationale pour la protection des données).

Section 02

What data we collect, and why

We only collect data when you choose to give it to us, or when it is strictly necessary to serve the website.

When you visit the site

The site is a self-hosted static website. The server logs a minimal record of each request (IP address, timestamp, page requested, and browser user-agent) strictly to keep the site running and to spot abuse. These logs are not used to profile you and are not sold or shared.

Legal basis: legitimate interest

Operating and securing the website. Server access logs are kept no longer than 30 days, then overwritten.

Analytics and session recording (PostHog)

If you accept analytics cookies through our cookie banner, we use PostHog to understand how the site is used and to improve it. PostHog collects:

• Product analytics, which pages you visit, in what order, how long you stay, which buttons or links you click, and technical context (approximate country from IP, browser, device type, screen size, referring site).
• Session recordings, an anonymized replay of your visit. Input-masking is on: text you type into forms is replaced with asterisks before leaving your browser. Your IP address is not stored alongside the recording.

A pseudonymous identifier is assigned to your browser so page views and recordings from the same visit can be grouped. This identifier is not linked to your name or email unless you sign up for the newsletter, in which case it may be associated with your subscriber record within PostHog for product analytics only, never resold, never shared.

Legal basis: consent

Given through the cookie banner. Withdraw at any time by opening the banner again or clearing your browser cookies. PostHog event data is retained up to 12 months; session recordings up to 30 days. If you decline analytics cookies, PostHog does not load at all.

When you sign up for the newsletter

If you enter your email into the newsletter form, we collect:

• Your email address
• The date and time of sign-up
• The page or source you signed up from (if we tag the link)
• Your interactions with our emails, whether you open them and which links you click

This data is processed through Sender.net so we can send the newsletter and understand which content lands.

Legal basis: consent

Withdraw at any time by clicking "unsubscribe" in any email we send. After unsubscribing, Sender.net retains your record according to its own retention policy.

When you email us

If you email federico [at] vibemyway.com, we receive whatever is in your message and keep it in Proton Mail to reply and maintain a record of the exchange.

Legal basis: legitimate interest or consent

Depending on context. Retained for up to 24 months after the conversation closes.

When you purchase a product

Paid products are sold through Lemon Squeezy (Lemon Squeezy, Inc.), which acts as the merchant of record and as a separate data controller for the payment transaction. When you check out, Lemon Squeezy collects the data it needs to complete the sale: your name, billing address, email address, VAT ID (if you provide one), and payment details. We never see your full card number, that stays between you, Lemon Squeezy, and their payment processors.

From that transaction we receive and store the order record (order ID, product purchased, amount, country, tax applied, email address, and (if you provided one) your VAT ID and business name), and, for VibeMyWay for Mac, your license key. We use it to deliver the product, support you afterwards, and meet our tax and accounting obligations.

Legal basis: performance of the sales contract, and legal obligation (Luxembourg tax and accounting law)

Payment-related records are retained for the period required by Luxembourg tax law, generally 10 years for invoices (see Section 7). Lemon Squeezy processes the data it collects under its own privacy notice; please read it for details of what they do with the data they control.

When you use VibeMyWay for Mac

VibeMyWay for Mac is local-first. Your projects, brand documents, generated content and API keys stay on your Mac. The app contacts us for one thing only: checking your license.

When you activate the app, and about every 14 days after that while you're online, it sends our license server:

• your license key and an activation ID;
• your Mac's name (its Computer Name in System Settings), so you can tell your devices apart;
• the app version.

Our license server is hosted by Neon in the EU (Frankfurt, Germany). It passes each check to Lemon Squeezy, which holds your license key and the Mac it's activated on alongside your order. Like any internet request, a check reveals your IP address to Neon and to Lemon Squeezy. The license server itself stores nothing. Its technical logs are kept for 3 days.

License backups. Once a week we copy our license records from Lemon Squeezy into a backup. The copy includes license keys, activations and orders, with the name and email on each order. We keep it on our own computer and in a database hosted by Neon in the EU, so your license keeps working even if we ever have to change payment provider.

What the app does not send us: usage analytics, crash reports, your content, prompts, files, brand documents or API keys. API keys you add are stored in the macOS Keychain on your Mac.

Services you connect yourself. The app sends your prompts and content directly from your Mac to the AI provider you choose (such as Anthropic, OpenAI or Google). It does the same for any image, video or design service you connect. That happens under your own account with each service. We don't see this traffic. Those services are not our processors: their own privacy policies apply.

When you first set up the app, it downloads standard components directly from their official servers. That includes the Node.js runtime, plus Remotion packages if you add video. Those requests go to those servers, not to us.

Legal basis: performance of the license contract, and legitimate interest

• Contract: verifying your license and keeping it to one Mac at a time.
• Legitimate interest: preventing license misuse, and keeping licenses working if we change provider.

Section 03

Cookies and similar technologies

Categories we use

No analytics cookies are set before you give consent. If you decline or ignore the banner, those scripts do not load at all.

PostHog cookies

Sender.net cookies

These are only set once you actively engage with the newsletter. For the authoritative list see sender.net/privacy and posthog.com/privacy.

Your choices

• Use the cookie banner to accept or decline analytics.
• Re-open the banner at any time via the "Cookie settings" link in the site footer to change your choice.
• Block or delete cookies in your browser at any time. This may affect features that rely on them but does not affect your ability to read the site.
• Unsubscribe from the newsletter using the link at the bottom of every email.

Section 04

Do Not Track and Global Privacy Control

Our analytics provider (PostHog) honours the Global Privacy Control (GPC) signal when sent by your browser. If GPC is enabled, analytics and session recording are disabled automatically, even if you haven't interacted with the cookie banner.

Section 05

Who we share your data with

We do not sell your data. We share it only with the service providers we need to run the site, the analytics, and the newsletter. Each one acts as a data processor under a written data processing agreement (DPA) with us.

We will update this list if a processor changes.

Section 06

International transfers

Most data stays within the EU / EEA.

• PostHog: we use the EU Cloud region (Frankfurt, Germany). Data is stored and processed inside the EU. PostHog Inc. is US-incorporated, so in the limited cases where support staff access EU data, that access is covered by the EU Standard Contractual Clauses and PostHog's supplementary measures.
• Sender.net is established in Lithuania (EU), no extra safeguards required.
• Proton Mail is based in Switzerland, which has an EU adequacy decision, your data receives equivalent protection.
• Lemon Squeezy processes checkout and billing data in the United States under the EU Standard Contractual Clauses and Lemon Squeezy's supplementary technical and organisational measures.
• Neon: the license server and the backup database run in the EU (Frankfurt, Germany). Neon is part of Databricks, and the contracting entity, Neon Inc., is a US company. So in the limited cases where support staff access this data from outside the EU, that access relies on the EU-U.S. Data Privacy Framework and, where that doesn't cover the transfer, on the EU Standard Contractual Clauses.

Section 07

How long we keep your data

• Server logs: up to 30 days.
• PostHog product analytics events: up to 12 months, then deleted.
• PostHog session recordings: up to 30 days, then deleted.
• Newsletter subscription data: for as long as you remain subscribed. After unsubscribing, retention follows Sender.net's own schedule.
• Email correspondence: up to 24 months after the last exchange, then reviewed and deleted if no longer needed.
• Payment records (future): the period required by Luxembourg tax law, generally 10 years for invoices.
• License server logs: 3 days.
• License keys and activation records: held by Lemon Squeezy for as long as your license exists, under its own retention policy.
• License backups: the 12 most recent weekly copies, about three months, then deleted.

Section 08

Your rights under GDPR

You have the right to:

• Access the data we hold about you.
• Correct it if it is wrong or incomplete.
• Delete it ("right to be forgotten"), subject to legal retention obligations.
• Restrict or object to certain processing.
• Port your data to another service in a machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of processing done before withdrawal.
• Lodge a complaint with the CNPD or the data protection authority in your country of residence.

If you ask us to delete your license data, your license can no longer be checked, and the app will stop working on your Mac. We'll tell you before we do it.

To exercise any of these rights, email federico [at] vibemyway.com with "Privacy request" in the subject line. We will respond within 30 days, and usually much sooner.

For newsletter-specific requests (change your email, delete your subscriber record), you can go directly to Sender.net's subscriber preferences link included in every email. For analytics-specific requests, we can delete the PostHog record tied to your pseudonymous ID on request.

Section 09

Security

We apply standard technical measures: HTTPS across the site, strong passwords and two-factor authentication on the accounts that access your data, and restricted access to systems that handle personal information. The service providers listed in Section 5 apply their own security controls, documented in their respective policies.

No online service is absolutely secure. If a breach that affects your personal data occurs, we will notify the CNPD within 72 hours and, if the risk to you is high, notify you directly as required by GDPR.

Section 10

Children

The site, the newsletter and the VibeMyWay for Mac app are not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has signed up, email us and we will delete the record.

Section 11

Automated decisions and profiling

We do not make automated decisions that produce legal or similarly significant effects on you. PostHog's engagement data and Sender.net's open/click data may be used to group visitors and subscribers into coarse segments (for example, "reads the newsletter regularly" vs. "new visitor") so we can send more relevant content. This is ordinary segmentation, not automated decision-making in the GDPR sense. You can opt out at any time by withdrawing consent or unsubscribing.

Section 12

Changes to this policy

We will update this policy when something material changes, for example, when a new processor is added or a retention period changes. The "Last updated" date at the top tells you when the most recent change happened. For significant changes affecting active subscribers, we will send a short notice by email before the change takes effect.

Section 13

Contact