Who controls your data
The data controller for VibeDeck and getvibedeck.com is INVENTIVE HILL DANIEL POLAK, NIP 5272898325, Kolska 9A/107, 01-045 Warsaw, Poland. Contact: [email protected].
We process only the information needed to provide and secure VibeDeck, validate licenses, deliver updates, answer support requests, meet legal obligations, and understand aggregate website performance. The specific legal bases and retention periods are set out below.
License checks
Activation, validation, and deactivation contact api.inventivehill.com. Requests include your license key, an activation identifier after activation, and a random per-request nonce. Activation also sends the computer hostname as a recognizable device name. Validation normally runs at startup and roughly every 24 hours. A signed offline lease keeps a previously validated installation working for up to 72 hours when the service cannot be reached.
Signed updates
VibeDeck contacts api.inventivehill.com with a short-lived, installation-scoped update token to check for and download signed plugin updates. The token does not contain your license key and is not stored on disk. The updater verifies the manifest signature, file sizes, and file hashes before installation.
Dictation audio
Push Dictation is opt-in and off by default. When you use it, the recorded audio goes only to the transcription or translation endpoint you configure yourself — your own OpenAI API key, or a local Whisper-compatible server. Inventive Hill does not receive, store, or process this audio. The temporary local recording is deleted after each attempt.
Local data
Settings such as agent configuration, terminal identity, sounds, dictation preferences, and your license key are stored locally by Stream Deck. The license key, activation instance ID, and signed offline lease are also mirrored to a user-only local file so activation survives app updates; update bearer tokens are memory-only. The installed VibeDeck plugin contains no analytics, telemetry, or advertising SDK. The public website uses Cloudflare Web Analytics for aggregate page-view and performance measurement.
Free trial requests
Requesting a 14-day trial at getvibedeck.com/trial sends your email address to our licensing service. We use it to email a one-hour confirmation link, then—only after you confirm the address—the trial key and service messages about that trial. No payment card is required for the trial.
To prevent trial abuse, we store keyed, pseudonymous HMAC digests of your normalized email address and IP address; your raw IP address is never stored. These digests remain personal data protected under this policy. The signed confirmation token is stored in encrypted form and becomes unusable after it expires or is used. The trial form uses Cloudflare Turnstile, which checks that your browser is not automated. See Cloudflare's privacy notice for details.
Billing data
Paddle.com Market Ltd or Paddle.com Inc., as applicable (“Paddle”), processes checkout and acts as Merchant of Record. We share the personal data needed for payment processing with Paddle. Paddle processes your payment details, billing address, tax information, and transaction, and may provide Inventive Hill with buyer contact details and transaction identifiers needed to fulfill the order, provide support, and maintain access. Inventive Hill does not receive your complete payment-card number.
Paddle's Buyer Terms and Privacy Notice apply to checkout. Our Refund Policy explains how refunds are handled.
Legal bases and retention
We process trial, purchase, license-validation, key-delivery, and support data because it is necessary to provide the service or take steps you request before purchase (Article 6(1)(b) GDPR). We rely on our legitimate interests (Article 6(1)(f)) to secure the service, prevent duplicate trials and fraud, diagnose delivery failures, measure aggregate website performance, and establish or defend legal claims. Where law requires records or cooperation with authorities, processing is based on Article 6(1)(c). See the GDPR.
Paid licenses. Your email address and the customer, license, activation, and transaction identifiers needed to operate and support a paid license are kept while that license remains active. The $19 license is perpetual and normally has no expiry date. If it ends following a refund, chargeback, material breach, or your request, we keep only the information needed for legal obligations and claims for up to six years, then delete or anonymize it.
Trials. If a trial is not converted into a paid license, its email address, license record, and pseudonymous email/IP digests are kept for three years after the 14-day trial ends, then deleted or anonymized. An unconfirmed request and its pseudonymous digests are kept for up to 90 days for confirmation, rate limiting, and delivery diagnostics. The confirmation link expires after one hour.
Operational records. Raw provider webhook content and transactional-email delivery records containing contact details are kept for up to 90 days. Support correspondence is kept for up to three years after the last contact, and internal operator audit entries for up to 365 days after the related license ends. Disaster-recovery backups use a rolling 30-day window; the newest complete restorable backup may be kept until a valid replacement exists and is used only for recovery.
If a claim, investigation, or legal duty is still active at the end of a period above, the strictly necessary records may be kept until that matter ends. Trial and license email addresses are not used for newsletters or promotional email unless you separately opt in.
Service providers and international transfers
We use Supabase for the EU-region licensing database, Cloudflare for website delivery, the API, Turnstile, aggregate web analytics, and encrypted backups, Resend for transactional trial and license email, and OVHcloud for our support and reply mailbox. These providers process data on our instructions. Paddle acts as Merchant of Record and as a separate controller for checkout, payment, tax, and billing data under its own Privacy Notice.
Some providers or their approved subprocessors may process data outside the European Economic Area. Where required, those transfers are protected by an adequacy decision, the EU–US Data Privacy Framework, Standard Contractual Clauses, or equivalent safeguards. We do not sell personal data.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal data we hold about you, and to object to or withdraw consent for certain processing. You may also complain to the data-protection authority available to you.
To exercise a right, email [email protected]. We may need to verify your identity before responding. Paddle handles requests concerning data it controls through the contact routes in its Privacy Notice.
Contact
Privacy questions: [email protected].
INVENTIVE HILL DANIEL POLAK
NIP 5272898325
Kolska 9A/107
01-045 Warsaw, Poland
Never send API keys, license keys, payment-card details, passwords, or other credentials by email.