Vibasis Privacy Policy
DRAFT v0.2 — 2026-10-22. Not legal advice. Must be reviewed by a qualified lawyer (GDPR) before publication. v0.2 follows the implemented service: sign-in providers, cookies, processors and retention periods that the code sets.
Last updated: 23 October 2026
1. Controller
Vibasis Maksim Pauliukevich, a sole proprietorship entered in the Polish Central Register of Business Activity (CEIDG), NIP 7252281864, REGON 380857507, VAT EU PL7252281864, address Lodz, Gornica 26/6, 91-765, is the controller of personal data processed by Vibasis (vibasis.ai, Vibasis Desktop, CLI, MCP connector). Contact: privacy@vibasis.ai.
For purchases, the Creator who sells the Product is the seller and a separate controller of the purchase data they receive. Stripe processes payment data under its own privacy policy.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Account: email, name and profile picture; if you sign in with Google or GitHub, the account ID at that provider | Create and run your account, sign-in | Contract (6(1)(b)) | While the account exists + 30 days |
| Sign-in sessions on the website: session ID, IP address, browser type | Keep you signed in, security | Contract; legitimate interest in security (6(1)(f)) | 30 days from the last use |
| Sign-in links sent by email | Passwordless sign-in | Contract | 15 minutes, single use |
| Apps you connect (Vibasis Desktop, CLI, MCP): app name, granted permissions, when connected | Let the app act for you within those permissions | Contract | Up to 30 days without use; ends when you sign the app out |
| Creator data: store and product pages, images, plugin packages and their check results | Run your store, publish and deliver your Products, moderation | Contract; legal obligation (6(1)(c)) | While the creator account exists + periods required by law |
| Change log: which account changed what, when, and from which app (website, Desktop, CLI, MCP) | Security, disputes, moderation | Legitimate interest | 24 months |
| Library and purchase records: what you got, when, order status from Stripe (no card data) | Access, downloads and updates; support | Contract; legal obligation | While the account exists; financial records as required by law 5 years |
| Install records from Vibasis Desktop: random installation ID, OS and host application version, product and release, install result and error codes | Install, update and support; aggregated statistics for creators and us | Contract; legitimate interest in reliability | 24 months, then aggregated |
| Error reports from our servers: error message, the requested page, request ID, browser type | Fix errors | Legitimate interest | 90 days in Sentry |
| Analytics (Google Analytics 4), only with your consent | Understand how the website is used | Consent (6(1)(a)) | 2 months in Google Analytics |
| Support, reports and appeals | Answer you, handle reports under the DSA | Contract; legal obligation; legitimate interest | 3 years after closure |
| Marketing emails (only if you opt in) | News about Vibasis | Consent | Until you unsubscribe |
We do not collect hardware serial numbers or device fingerprints. Vibasis Desktop uses a random installation ID that you can reset by reinstalling.
We do not see your full card details. Payments are handled by Stripe.
Plugin packages are checked on our own servers only: an antivirus scan, detection rules and a static check of the package; the code is never run, and neither the package nor its checksum is sent to other services.
Error reports are configured not to include your name or email, cookies, request contents, page addresses with parameters or other personal data.
3. Where data comes from
From you; from Google or GitHub if you choose to sign in with them (name, email, profile picture, account ID); from Stripe (payment status, account status); from Vibasis Desktop, the CLI and the MCP connector when you use them.
4. Who receives data
- Service providers (processors), acting on our instructions under data processing agreements:
- Amazon Web Services EMEA SARL — servers and file storage, Frankfurt (Germany);
- Google Ireland Ltd — email (Google Workspace) and, with your consent, Google Analytics;
- Functional Software, Inc. (Sentry) — error reports, stored in the EU (Frankfurt).
- Sign-in providers (Google, GitHub) receive what is needed to confirm your sign-in when you choose them, under their own privacy policies.
- Stripe — payments, creator onboarding and the Vibasis Pro subscription, as an independent controller.
- Creators — for your purchases from them, the data needed for the sale, support and their legal obligations. Creators also get aggregated statistics that do not identify you.
- Authorities — where required by law.
5. Transfers outside the EEA
Our servers, file storage, database backups and error reports are in the EU (Frankfurt). Some providers (Google, GitHub, Stripe, Sentry) may process data in the United States. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses with additional safeguards.
6. Your rights
You can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time (for analytics — in Cookie settings in the website footer). Write to privacy@vibasis.ai; we respond within one month.
You can complain to the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or to the authority in your country.
7. Security
Data is encrypted in transit. Access is limited to people who need it. Sign-in links and app access tokens are stored only as one-way hashes; the website session cookie is signed. Database backups are kept for 14 days on the server and 35 days in separate storage. Secrets are never stored in Vibasis Desktop or sent to AI tools. Sign-in tokens on your computer are kept in the operating system's secure storage.
8. Children
Vibasis is not intended for people under 16.
9. Changes
We will announce material changes in the Service or by email before they take effect.