Privacy Policy

1. Introduction

VibeDeploy (“VibeDeploy”, “we”, “us”, “our”) is a web hosting and deployment platform operated from Belgium. We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our platform at vibedeploy.be and all associated subdomains.

VibeDeploy acts as the data controller within the meaning of the EU General Data Protection Regulation (GDPR) (EU) 2016/679 for the personal data described in this policy. Our contact details are set out in Section 14.

This policy applies to all users of VibeDeploy, including visitors to our website, registered account holders, team members, and paying subscribers. We do not knowingly collect personal data from individuals under the age of 16 (see Section 12).

2. Personal Data We Collect

We collect personal data in several categories depending on how you interact with our platform:

2.1 Account Data

When you register for a VibeDeploy account, we collect:

• Email address — your primary identifier and the address we use for all communications
• Name — your display name as entered during registration
• Hashed password — your password is hashed using bcrypt before storage; we never store plaintext passwords
• MFA secrets — TOTP shared secrets or hardware key credentials used for multi-factor authentication
• MFA trusted-device tokens — cryptographic tokens that allow recognised devices to skip MFA for up to 30 days
• Account creation date, last login date, and account status

2.2 Profile Data

You may optionally provide additional profile information, which we use for billing, invoicing, and personalisation:

• Full name and display name
• Billing address (street, city, postal code, country)
• VAT number (for EU business customers wishing to receive invoices on a reverse-charge basis)
• Company or organisation name
• Contact phone number (optional)

2.3 Payment Data

Payments are processed by Mollie N.V., a PCI DSS-certified payment service provider. VibeDeploy does not store your full payment card details. We only retain:

• Mollie customer ID — a pseudonymous identifier linking your account to Mollie's records
• Mollie subscription ID — the reference for your active subscription mandate
• Invoice records — invoice number, date, amount, VAT, subscription tier, and payment status

For details on how Mollie processes your payment data, please refer to Mollie's Privacy Policy.

2.4 Usage Data

When you use the platform, we collect operational data necessary to provide and improve the Service:

• Deploy history — timestamps, deploy identifiers, deployment status (success/failure), source references, and build logs
• Audit logs — records of significant account and team actions (logins, permission changes, domain additions, API key creation)
• Site analytics — aggregated page view counts and visitor counts for your deployed sites. We hash IP addresses before storing them to prevent direct re-identification; raw IP addresses are not retained in analytics.
• API usage — request counts and error rates, used for quota enforcement and service improvement

2.5 Technical Data

For security and fraud prevention, we collect certain technical data when you access our platform:

• IP address — logged for security monitoring, rate limiting, and geographic access controls; retained for a maximum of 12 months in security logs
• User agent string — browser and operating system information, used to detect unusual access patterns
• Device fingerprint — a hash derived from browser characteristics, used exclusively for the trusted-device MFA feature; not shared with third parties and never used for cross-site tracking
• Session data — session tokens and activity timestamps stored in secure, httpOnly cookies

2.6 Content Data

Files, code, and assets that you deploy through VibeDeploy (“User Content”) are stored on our infrastructure. This content may incidentally contain personal data (for example, if you deploy a site that contains user-facing forms or data). We process User Content solely as a data processor on your behalf for the purpose of hosting and serving it. You remain the data controller for any personal data within your User Content and are responsible for ensuring its lawful processing.

3. How We Use Your Data

We use your personal data for the following purposes:

3.1 Providing the Service

We process account data, profile data, and usage data to create and manage your account, process deployments, serve your websites, manage custom domains, and provide the features of your subscription plan.

3.2 Authentication and Security

We process account data and technical data to authenticate you (including MFA verification), detect and prevent unauthorised access, identify and respond to security incidents, and enforce rate limits.

3.3 Payment Processing

We pass relevant billing information to Mollie to process payments, create and manage subscriptions, generate invoices, and handle payment failures or disputes.

3.4 Transactional Communications

We send emails to your registered address for service-related purposes, including:

• Deploy success and failure notifications
• Team invitations and membership changes
• Security alerts (new device logins, password changes, MFA changes)
• Billing confirmations, invoices, and payment failure warnings
• Account verification and password reset emails
• Material changes to these policies (see Section 13)

These communications are necessary for the performance of your contract with us and cannot be opted out of while you hold an active account. You may adjust notification preferences for non-critical deploy notifications in your account settings.

3.5 Fraud and Abuse Prevention

We use account data, technical data, and usage patterns to detect abusive behaviour, enforce our Acceptable Use Policy, and protect our platform and other users from harm.

3.6 Legal and Compliance Obligations

We retain invoices and related financial records to comply with Belgian tax law (7-year retention obligation). We may also process and disclose data in response to lawful requests from Belgian or EU public authorities.

3.7 Service Improvement (with Consent)

Where you have given your consent, we may use anonymised and aggregated usage statistics to understand how the platform is used and to guide product development. We do not use identifiable personal data for this purpose without your explicit consent.

We do not sell, rent, or trade your personal data. We do not use your data for targeted advertising.

4. Legal Bases for Processing (GDPR Article 6)

Every instance of personal data processing by VibeDeploy has a legal basis under the GDPR:

4.1 Contract Performance (Art. 6(1)(b))

Processing your account data, profile data, usage data, and payment data is necessary for the performance of the contract between you and VibeDeploy (i.e., providing the Service you signed up for). This covers account creation, deployment, billing, and transactional communications.

4.2 Legitimate Interests (Art. 6(1)(f))

We process technical data and security-related information on the basis of our legitimate interests in maintaining the security, integrity, and reliability of the platform, and in preventing fraud and abuse. We have balanced these interests against your rights and freedoms and concluded that our security interests are not overridden by your privacy interests, given the minimal privacy impact and the clear benefit to all users.

4.3 Legal Obligation (Art. 6(1)(c))

We retain invoices, billing records, and VAT-related documents for 7 years to comply with Belgian tax and accounting law (Belgian Code of Income Taxes and the VAT Code).

4.4 Consent (Art. 6(1)(a))

We rely on your freely given, specific, and informed consent for:

• Optional marketing and product update emails
• Analytics cookies (see our Cookie Policy)
• Any processing not covered by the above bases

You may withdraw consent at any time by adjusting your preferences in your account settings or by contacting us at privacy@vibedeploy.be. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5. Data Sharing and Third-Party Processors

We do not sell or rent your personal data to third parties. We share personal data only with the following categories of recipients, and only to the extent strictly necessary:

5.1 Mollie (Payment Processing)

Mollie N.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands) processes payment card data and manages subscription mandates. Mollie is an authorised payment institution under the supervision of De Nederlandsche Bank (DNB) and is PCI DSS Level 1 certified. We have a data processing agreement in place with Mollie.

5.2 Cloudflare (Network Infrastructure)

Cloudflare, Inc. provides DDoS protection and traffic routing for our platform. Cloudflare may process IP addresses and request metadata as traffic passes through their network. Cloudflare's European data processing is subject to their Data Processing Addendum. We have configured Cloudflare to minimise data retention. Cloudflare does not use your data for advertising.

5.3 Gandi (Domain Registration)

If you purchase a custom domain through VibeDeploy, the domain registration is fulfilled by Gandi SAS. Domain registration data (registrant name, email, address) is transmitted to Gandi and, where required by ICANN or relevant registry policy, may appear in the public WHOIS database unless you enable WHOIS privacy protection.

5.4 Transactional Email Service

We use a transactional email provider to deliver system-generated emails (deploy notifications, security alerts, invoices). Your email address and the content of those emails is processed by this provider as a data processor under our instructions. We have a data processing agreement in place with our email provider.

5.5 Legal and Regulatory Disclosures

We may disclose personal data to law enforcement agencies, courts, or regulatory authorities where required by Belgian or EU law, or where necessary to protect the rights, property, or safety of VibeDeploy, our users, or the public.

5.6 Business Transfers

If VibeDeploy is involved in a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our platform before your data is transferred and becomes subject to a different privacy policy.

6. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our specific retention periods are:

After the applicable retention period expires, data is securely and irreversibly deleted or anonymised.

7. International Data Transfers

VibeDeploy hosts all customer data exclusively within the European Union. Our primary infrastructure is located in Belgian data centers. We do not by default transfer personal data to countries outside the EU or the European Economic Area (EEA).

Where any third-party processor (see Section 5) involves processing outside the EU/EEA, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries with an adequacy decision under GDPR Article 45.

You may request information about the specific safeguards in place for any international transfers by contacting privacy@vibedeploy.be.

8. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights with respect to your personal data:

8.1 Right of Access (Art. 15)

You have the right to request a copy of the personal data we hold about you, together with information about how we process it (including categories, purposes, retention periods, and recipients).

8.2 Right to Rectification (Art. 16)

You have the right to request correction of inaccurate or incomplete personal data. You can update most profile information directly in your account settings.

8.3 Right to Erasure (Art. 17)

You have the right to request deletion of your personal data (“right to be forgotten”) where: (a) the data is no longer necessary for the purpose it was collected; (b) you have withdrawn consent and there is no other legal basis; (c) you have objected and there are no overriding legitimate grounds; or (d) the data has been unlawfully processed. This right is subject to our legal obligations to retain certain records (e.g., invoices for 7 years).

8.4 Right to Data Portability (Art. 20)

Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV), and to transmit that data to another controller.

8.5 Right to Restriction of Processing (Art. 18)

You have the right to request that we restrict processing of your personal data in certain circumstances, for example while the accuracy of data is being contested or while an objection is pending.

8.6 Right to Object (Art. 21)

You have the right to object to processing based on our legitimate interests (Art. 6(1)(f)). We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims.

8.7 Right to Withdraw Consent (Art. 7(3))

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Belgian Data Protection Authority (Autoriteit Persoonsgegevens / Gegevensbeschermingsautoriteit — APD/GBA):

• Website: www.dataprotectionauthority.be
• Email: contact@apd-gba.be
• Address: Rue de la Presse 35, 1000 Brussels, Belgium

We would, however, appreciate the opportunity to address your concerns before you approach the supervisory authority. Please contact us first at privacy@vibedeploy.be.

9. How to Exercise Your Rights

To exercise any of your GDPR rights, please submit a request to:

• Email: privacy@vibedeploy.be
• Subject line: “GDPR Rights Request — [Your Name]”

We may ask you to verify your identity before processing your request (for example, by confirming your email address). We will respond within one calendar month of receiving a valid request. In complex cases or where we receive multiple requests, we may extend this period by up to two further months, in which case we will inform you of the extension within the initial month.

There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive (for example, repetitive requests), in which case we may charge a reasonable administrative fee or refuse to act.

10. Data Security

We implement technical and organisational measures appropriate to the risk to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security measures include:

• HTTPS everywhere: All data in transit is encrypted using TLS 1.2 or higher. Automatic SSL/TLS certificates are provisioned for all deployed sites and our own dashboard.
• Password hashing: All passwords are hashed using bcrypt with a high work factor before storage. Plaintext passwords are never stored or logged.
• Mandatory MFA: Multi-factor authentication is required for all accounts, providing a second layer of protection against compromised credentials.
• Encryption at rest: Databases, backups, and snapshots are encrypted at rest using industry-standard AES-256 encryption.
• Network isolation: Each user's deployed containers and resources are isolated from other users at the network level within our Kubernetes infrastructure.
• Access controls: Access to production systems and customer data is restricted to authorised personnel on a need-to-know basis, with audit logging of administrative access.
• Regular security reviews: We conduct periodic security assessments of our infrastructure and application code.
• Incident response: We maintain a documented incident response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the APD/GBA within 72 hours and affected users without undue delay, as required by GDPR Article 33 and 34.

While we take security seriously, no system is completely secure. You are responsible for maintaining the security of your account credentials and for promptly reporting any suspected security incidents to us.

11. Cookies

We use cookies and similar technologies on our platform. For a full description of the cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

In summary, we use essential cookies that are strictly necessary for the platform to function (authentication, language, UI mode), and optional analytics cookies that are only activated with your explicit consent via our cookie consent banner.

12. Children's Privacy

The VibeDeploy Service is not directed at children. In accordance with GDPR Article 8 and Belgian implementing legislation, we do not knowingly collect personal data from individuals under the age of 16 years. If you are under 16, you must not create an account or submit personal data to us.

If we become aware that we have collected personal data from a child under 16 without verifiable parental or guardian consent, we will take steps to delete that data promptly. If you believe we may have inadvertently collected data from a minor, please contact us at privacy@vibedeploy.be.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. For material changes (such as changes to the categories of data collected, new purposes, or new sharing arrangements), we will provide at least 30 days' notice by email to your registered address before the changes take effect.

Non-material changes (such as clarifications, corrections, or updated contact details) may be made without prior notice, with the updated date reflected at the top of this policy.

We encourage you to review this policy periodically. Your continued use of the Service after the effective date of any change constitutes your acceptance of the updated policy.

14. Contact and Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your personal data, please contact us:

• Privacy / DPO email: privacy@vibedeploy.be
• General legal enquiries: legal@vibedeploy.be
• Address: VibeDeploy, Belgium

We aim to respond to all privacy enquiries within 5 business days. For formal GDPR rights requests, we will respond within the statutory one-month period as described in Section 9.