Privacy policy
This policy explains what personal data we process when you visit this website, sign up for our free checklist or our emails, download or buy our digital products (printable planners, checklists, spreadsheets and prompt packs), contact us, or interact with our social media profiles. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and also covers US (CAN-SPAM) and Canadian (CASL) email rules.
1. Who we are (controller)
The controller is Seweryn Bałchan, a sole proprietor running a business registered in Poland (CEIDG) under the name GreenGastro Seweryn Bałchan, Tax ID (NIP) 5170419982, trading under the brand VibeToolsAI (“we”, “us”, “our”).
- Correspondence address (also for all personal data / GDPR matters): P.O. Box 419, ul. Asnyka 9, 35-001 Rzeszów, Poland
- Email for all privacy matters: hello@getvibetoolsai.com
We have not appointed a Data Protection Officer because the law does not require it for a business of our size and type. Write to the email or the correspondence address above with any question or request.
2. What you write in our planners never reaches us
Our products are downloadable files: PDFs you print and fill in by hand, and spreadsheets (.xlsx) you open in your own Excel, Google Sheets or similar software.
- Everything you write in a checklist, planner or spreadsheet stays with you. We do not receive, store or see it. The files contain no tracking, no forms that send data and no connection to us.
- Some of what you write may be sensitive (for example health information). Because we never receive it, we are not its controller. Keep your filled-in copies safe and share them only with people you trust.
- Please never email us a filled-in page or a photo of one. If you need help, describe the problem in words or send a screenshot of an empty page. If you send filled-in content anyway, we will delete it and not keep it.
- Our planners never ask for passwords, PINs or full account numbers, and we recommend that you never write them down.
3. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Showing you this website | IP address, date and time, page requested, browser type, recorded by our hosting provider in server logs | Art. 6(1)(f): our legitimate interest in delivering the website securely and protecting it from abuse |
| Delivering the free checklist you asked for (sign-up form, confirmation email, download link) | Email address, first name (optional), date and time of sign-up and confirmation, the form used, technical data MailerLite records for the sign-up (for example IP address), clicks on the link in the delivery email | Art. 6(1)(b): providing the free checklist you requested. Keeping proof that the sign-up and confirmation were genuine: Art. 6(1)(f), our legitimate interest in preventing abuse and demonstrating compliance. Links in the delivery email are tracked by our email provider to confirm delivery: Art. 6(1)(f); no profiling and no marketing use |
| Marketing emails (welcome series, a practical weekly email, news about our products, occasional offers) | Email address, first name (if given), consent record (date, time, form, wording version), unsubscribe status, clicks on links in these emails | Art. 6(1)(a): your consent, given by ticking the separate, unticked box on the form and confirming your email. Consent to electronic marketing is also required by Art. 398 of the Polish Electronic Communications Law and, for recipients in Canada, by CASL |
| Selling and delivering paid products on Gumroad (and Etsy, if we open a shop there) | Name (if given), email, country, product, price, order ID, date, refund status, as made available by the platform | Art. 6(1)(b): performance of a contract |
| Tax and accounting | Order and payout records | Art. 6(1)(c): legal obligation under Polish tax and accounting law |
| Answering your messages | Email address, name, content of your message, order details you give us | Art. 6(1)(f): our legitimate interest in answering inquiries; Art. 6(1)(b) where it concerns your order |
| Legal claims | Data from the categories above relevant to a claim | Art. 6(1)(f): establishing, exercising or defending legal claims |
| Social media profiles (Pinterest, X, Instagram) | Public profile name, comments, messages, and aggregated statistics from the platform | Art. 6(1)(f): our legitimate interest in presenting our brand and replying to people who contact us |
Link clicks in marketing emails. If you ticked the box, our email provider records which links you click in our marketing emails; this is covered by your consent (Art. 6(1)(a)), and you can withdraw it at any time by unsubscribing. We do not track whether emails are opened.
Do you have to give us data? To get the free checklist you need to give and confirm your email address; your first name is optional. Marketing consent is voluntary: you get the checklist whether or not you tick the box. To buy a product, the sales platform needs your email to deliver it.
4. Double opt-in, unsubscribing, withdrawing consent
- Double opt-in. After you submit the form, you receive a confirmation email. You are added only after you click the confirmation link. If you do not confirm, we send nothing else, and the unconfirmed sign-up is removed from our list within 30 days after sign-up and permanently erased by our email provider within a further 30 days (section 8).
- Unsubscribing. Every marketing email has an unsubscribe link that works in one click. You can also reply “unsubscribe” or write to hello@getvibetoolsai.com. We act on it promptly; under CASL and CAN-SPAM, within 10 business days at the latest.
- Withdrawing consent is free and possible at any time. It does not affect emails sent before, and you keep the checklist and anything you bought.
5. This website, our sign-up page and cookies
- This website (getvibetoolsai.com) is a static site hosted by GitHub Pages. It sets no cookies, uses no analytics, advertising or social media tracking and loads no fonts, scripts or images from other companies. GitHub records the technical data listed in section 3 in its server logs to deliver and secure the site.
- Our sign-up page and form are hosted by MailerLite on a MailerLite web address. MailerLite may use cookies or similar technologies that are strictly necessary to display the page, submit the form and protect it from spam and abuse. These do not require consent under EU rules. Details: MailerLite’s privacy policy (see “Tracking technologies”).
- We do not add analytics, advertising or social media tracking (no Google Analytics, no Meta or Pinterest pixel) to this website or the sign-up page. If we ever do, we will ask for your consent first with a cookie banner and update this policy.
- Links to products include a label (for example
utm_source=getvibetoolsai) that tells Gumroad the visit came from this website. It contains no personal data. - Product pages and checkout are hosted by Gumroad (and Etsy, if used), whose own cookie policies apply there.
6. Who receives your data
We share data only as far as needed for the purposes above.
- GitHub, Inc. (USA) – hosts this website (GitHub Pages) and processes server log data under the GitHub General Privacy Statement.
- MailerLite – our email service provider, acting as our processor. It hosts the sign-up page and form, sends the confirmation, delivery and marketing emails, and stores our subscriber list and consent records on our behalf under its Data Processing Addendum. Contracting entity for customers in the EEA, according to MailerLite’s privacy policy: MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland. Sub-processors listed in Annex 4 of the DPA (updated 10 July 2026): Google Cloud EMEA Ltd (Ireland; data centers in Germany and the Netherlands) and Vercom S.A. (Poznań, Poland).
- OVH – provider of our mailbox hello@getvibetoolsai.com and of this website’s domain name. Emails you send us are stored there. OVH SAS, Roubaix, France.
- Notion Labs, Inc. (USA) – we use Notion for internal notes; earlier versions of this policy were published there.
- Gumroad, Inc. (USA) – sales platform. Independent controller as merchant of record (payments, tax, fraud prevention: gumroad.com/privacy) and our processor for hosting and delivering files and for our customer list (gumroad.com/dpa).
- Etsy – only if we open an Etsy shop; Etsy acts under its own privacy policy for purchases made there.
- Buffer, Inc. (USA) – tool we use to schedule social media posts; processor for data shown in Buffer.
- Pinterest, X and Meta (Instagram) – independent controllers of data processed on their platforms, under their own privacy policies. For Instagram “Insights” statistics, Meta treats the processing as joint controllership with us under Meta’s Page Insights Controller Addendum; Meta handles requests about Insights data, and we forward any we receive.
- Accountants or tax advisers, if we use them, and public authorities where the law requires.
We do not sell or rent your personal data, and we do not “share” it for cross-context behavioral advertising.
7. Transfers outside the European Economic Area (including the USA)
Some recipients are in, or may access data from, the United States. We transfer data outside the EEA only with safeguards under Chapter V GDPR: the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for certified recipients, and/or the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914).
To our knowledge on 14 November 2026:
- GitHub: GitHub, Inc. states that it participates in the EU-U.S. Data Privacy Framework and offers Standard Contractual Clauses in its Data Protection Agreement.
- MailerLite: subscriber data is stored in the EU. MailerLite’s DPA includes Standard Contractual Clauses (controller to processor, Annex 3) with MailerLite, Inc. (USA) as data importer, and MailerLite, Inc. states that it is certified under the EU-U.S. Data Privacy Framework.
- Notion Labs, Inc.: listed on the Data Privacy Framework List; Notion’s DPA also incorporates the EU and UK Standard Contractual Clauses.
- Gumroad: Standard Contractual Clauses in its DPA.
- Buffer: EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
- OVH: EU provider (France); no transfer expected.
- Pinterest, X and Meta choose their own transfer mechanisms as independent controllers.
You can ask us for more information about these safeguards at hello@getvibetoolsai.com.
8. How long we keep your data
- Website server logs: kept by GitHub for as long as its own policy states for security purposes; we do not access or store them ourselves.
- Unconfirmed sign-ups (confirmation link not clicked): removed from our list within 30 days after sign-up and permanently erased by our email provider within a further 30 days.
- Checklist-only sign-ups (confirmed, no marketing consent): removed from our list within 30 days after confirmation and permanently erased by our email provider within a further 30 days.
- Marketing subscribers: until you unsubscribe or withdraw consent. After that we keep a minimal record (email, dates of consent and withdrawal, wording version) to show we respected your choice and to make sure we don’t email you again, for no longer than the limitation period for claims (generally up to 6 years under Polish law).
- Orders and delivery data: as long as needed to provide the product and support, then until claims become time-barred (generally up to 6 years; 3 years for claims related to business activity).
- Tax and accounting records: as required by Polish tax law, generally 5 years from the end of the calendar year in which the tax payment deadline fell.
- Your emails to us: up to 3 years after our last contact, unless needed longer for a claim or legal obligation.
- Social media interactions: as long as the content stays on the platform; the platform’s own rules apply.
9. Your rights
Under the GDPR you have the right to: access your data and get a copy (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); data portability for data processed on the basis of consent or contract by automated means (Art. 20); object to processing based on our legitimate interests (Art. 21(1)), and at any time to direct marketing (Art. 21(2)); withdraw consent at any time, without affecting earlier processing (Art. 7(3)).
To use your rights, write to hello@getvibetoolsai.com. We reply within one month (extendable in the cases in Art. 12(3) GDPR). We may ask for information needed to confirm it is you, for example the email address you signed up with.
Complaint. You can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the supervisory authority in the EU/EEA country where you live or work, or where the alleged infringement took place.
10. Recipients in the United States and Canada
- United States (CAN-SPAM Act). Our commercial emails identify us as the sender, have honest subject lines, include our postal address (P.O. Box 419, ul. Asnyka 9, 35-001 Rzeszów, Poland) and a working unsubscribe link, and we honor opt-outs within 10 business days. Emails that only deliver what you asked for (the confirmation and the checklist download) are transactional.
- California. We do not sell or share personal information; requests are handled as in section 9.
- Canada (CASL). We send commercial emails to recipients in Canada only with your express consent, which we record (date, time, form, wording). Each email identifies us, gives our postal address and email, and has an unsubscribe link that works for at least 60 days after sending; we act on unsubscribes within 10 business days.
11. Automated decisions, children, security
- No automated decision-making with legal or similarly significant effects (Art. 22 GDPR).
- Children. Our products and emails are for adults. We do not knowingly collect data from children under 16. If you think a child has signed up, contact us and we will delete the data.
- Security. We use strong unique passwords and two-factor authentication on our accounts where available, limit access, and keep only the data we need. This website is served only over an encrypted connection (HTTPS).
12. Changes to this policy
We will update this policy if we start using new tools or change how we process data. The current version and its date are always at getvibetoolsai.com/privacy. If a change is significant and you are subscribed, we will tell you by email.
13. Contact
Seweryn Bałchan, sole proprietor, business registered in Poland (CEIDG) under the name GreenGastro Seweryn Bałchan, Tax ID (NIP) 5170419982, trading under the brand VibeToolsAI. Correspondence address (including personal data / GDPR matters): P.O. Box 419, ul. Asnyka 9, 35-001 Rzeszów, Poland · hello@getvibetoolsai.com
Our checklists, planners and prompt packs are informational and organizational material only, not legal, tax or financial advice.