Who controls your data
The data controller for VibeDeck and getvibedeck.com is INVENTIVE HILL DANIEL POLAK, NIP 5272898325, Kolska 9A/107, 01-045 Warsaw, Poland. Contact: [email protected].
We process only the information needed to provide and secure VibeDeck, validate licenses, deliver updates, answer support requests, meet legal obligations, understand aggregate website performance, and, if you separately opt in, send VibeDeck offers and discount codes. The specific legal bases and retention periods are set out below.
License checks
Activation, validation, and deactivation contact api.inventivehill.com. Requests include your license key, an activation identifier after activation, and a random per-request nonce. Activation also sends the computer hostname as a recognizable device name. Validation normally runs at startup and roughly every 24 hours. A signed offline lease keeps a previously validated installation working for up to 72 hours when the service cannot be reached.
Signed updates
VibeDeck contacts api.inventivehill.com with a short-lived, installation-scoped update token to check for and download signed plugin updates. The token does not contain your license key and is not stored on disk. The updater verifies the manifest signature, file sizes, and file hashes before installation.
Dictation audio
Dictation is opt-in and off by default. In Local mode, speech is transcribed on your computer without uploading recordings or falling back to an API. You download the speech engine and model from components.getvibedeck.com through VibeDeck Setup; the download exposes normal network metadata such as your IP address, but sends no audio or transcript. In API mode, recordings go to the OpenAI or compatible endpoint you configure. Inventive Hill does not receive, store, or process this audio. VibeDeck attempts to delete the temporary local recording after each attempt; recordings may remain if deletion fails.
Project and vocabulary hints stay with the local engine by default. Choosing Local + API also sends those hints to your configured transcription provider; hints can be turned off. A session key's transcript is inserted into that terminal for review. Submitting it sends the text to your chosen agent under that provider's privacy terms. A Dictate Anywhere key's transcript is written to the system clipboard and pasted into the application that is frontmost without pressing Return: this replaces whatever was on the clipboard, VibeDeck does not restore the previous contents, and the transcript can persist in the operating system's clipboard history.
Local data
Settings such as agent configuration, terminal identity, sounds, dictation preferences, and your license key are stored locally by Stream Deck. The license key, activation instance ID, and signed offline lease are also mirrored to a user-only local file so activation survives app updates; update bearer tokens are memory-only. The installed VibeDeck plugin contains no analytics, telemetry, or advertising SDK. The public website uses Cloudflare Web Analytics for aggregate page-view and performance measurement.
Free trial requests
Requesting a 14-day trial at getvibedeck.com/trial sends your email address to our licensing service. We use it to email a one-hour confirmation link, then—only after you confirm the address—the trial key and service messages about that trial, including a notice shortly before your trial access ends and one when it has ended. No payment card is required for the trial.
To prevent trial abuse, we store keyed, pseudonymous HMAC digests of your normalized email address and IP address; your raw IP address is never stored. These digests remain personal data protected under this policy. The signed confirmation token is stored in encrypted form and becomes unusable after it expires or is used. The trial form uses Cloudflare Turnstile, which checks that your browser is not automated. See Cloudflare's privacy notice for details.
Optional offers. You can separately ask to receive VibeDeck offers and discount codes by email from Inventive Hill. The checkbox is off by default, and your trial works without it. If you select it, we record the delivery email address, consent wording and version, signup source, request and confirmation dates, and any withdrawal. The confirmation email explains this choice; marketing consent becomes active only after you confirm the address. We do not add existing trial or paid-license addresses automatically.
You can withdraw at any time by emailing [email protected] from the address you used. Withdrawing does not affect your trial, license, or necessary service email.
Billing data
Paddle.com Market Ltd or Paddle.com Inc., as applicable (“Paddle”), processes checkout and acts as Merchant of Record. We share the personal data needed for payment processing with Paddle. Paddle processes your payment details, billing address, tax information, and transaction, and may provide Inventive Hill with buyer contact details and transaction identifiers needed to fulfill the order, provide support, and maintain access. Inventive Hill does not receive your complete payment-card number.
Paddle's Buyer Terms and Privacy Notice apply to checkout. Our Refund Policy explains how refunds are handled.
Legal bases and retention
We process trial, purchase, license-validation, key-delivery, and support data because it is necessary to provide the service or take steps you request before purchase (Article 6(1)(b) GDPR). We rely on our legitimate interests (Article 6(1)(f)) to secure the service, prevent duplicate trials and fraud, diagnose delivery failures, measure aggregate website performance, and establish or defend legal claims. Where law requires records or cooperation with authorities, processing is based on Article 6(1)(c). See the GDPR.
Paid licenses. Your email address and the customer, license, activation, and transaction identifiers needed to operate and support a paid license are kept while that license remains active. The $19 license is perpetual and normally has no expiry date. If it ends following a refund, chargeback, material breach, or your request, we keep only the information needed for legal obligations and claims for up to six years, then delete or anonymize it.
Trials. If a trial is not converted into a paid license, its email address, license record, and pseudonymous email/IP digests are kept for three years after the 14-day trial ends, then deleted or anonymized. An unconfirmed request and its pseudonymous digests are kept for up to 90 days for confirmation, rate limiting, and delivery diagnostics. The confirmation link expires after one hour.
Optional marketing. We rely on your consent (Article 6(1)(a) GDPR) for VibeDeck offers and discount codes. Consent is valid for up to three years from email confirmation unless you withdraw earlier. Unconfirmed marketing requests are removed during weekly retention checks once they are older than seven days, so they may be kept for up to 14 days. After withdrawal, the record is excluded from marketing; we retain the minimal consent and withdrawal evidence for up to three years to establish or defend legal claims, based on Article 6(1)(f). Withdrawing does not affect the lawfulness of earlier processing. Marketing retention is separate from trial and licensing records above.
Operational records. Raw provider webhook content and transactional-email delivery records containing contact details are kept for up to 90 days. Support correspondence is kept for up to three years after the last contact, and internal operator audit entries for up to 365 days after the related license ends. Disaster-recovery backups use a rolling 30-day window; the newest complete restorable backup may be kept until a valid replacement exists and is used only for recovery.
If a claim, investigation, or legal duty is still active at the end of a period above, the strictly necessary records may be kept until that matter ends. Trial and license email addresses are not used for newsletters or promotional email unless you separately opt in.
Service providers and international transfers
We use Supabase for the EU-region licensing database, Cloudflare for website delivery, the API, Turnstile, aggregate web analytics, and encrypted backups, Resend for transactional trial and license email, and OVHcloud for our support and reply mailbox. These providers process data on our instructions. Paddle acts as Merchant of Record and as a separate controller for checkout, payment, tax, and billing data under its own Privacy Notice.
Some providers or their approved subprocessors may process data outside the European Economic Area. Where required, those transfers are protected by an adequacy decision, the EU–US Data Privacy Framework, Standard Contractual Clauses, or equivalent safeguards. We do not sell personal data.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal data we hold about you, and to object to or withdraw consent for certain processing. You may also complain to the data-protection authority available to you.
To exercise a right, email [email protected]. We may need to verify your identity before responding. Paddle handles requests concerning data it controls through the contact routes in its Privacy Notice.
Contact
Privacy questions: [email protected].
INVENTIVE HILL DANIEL POLAK
NIP 5272898325
Kolska 9A/107
01-045 Warsaw, Poland
Never send API keys, license keys, payment-card details, passwords, or other credentials by email.