Privacy Policy
This policy explains how personal data is processed when you visit vindeo.io (the “Website”) and when you join the Vindeo waitlist. It is written to meet the information requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Polish Electronic Communications Law (Prawo komunikacji elektronicznej).
1. Who is responsible for your data
The controller of your personal data is Mateusz Siwek, who runs Vindeo from Poland (“we”, “us”).
For anything related to your data, write to vindeo.studio@gmail.com. We have not appointed a data protection officer, as the law does not require one for the processing described here.
2. What we process, why, and on what legal basis
Joining the waitlist
- Data: your email address and first name, the date and time you signed up, and a record of your consent.
- Purpose: to hold your place on the waitlist, to work out your bonus credits from that place, to invite you in one of the early-access waves, and to email you about early access, changes to our launch plans and the launch of Vindeo.
- Legal basis: your consent (Art. 6(1)(a) GDPR), which also covers receiving these emails as required by Art. 398 of the Polish Electronic Communications Law. You can withdraw it at any time — use the unsubscribe link in any email or write to us. Withdrawal does not affect anything we did lawfully before it.
Contacting us by email
- Data: your email address, name and whatever you choose to include in your message.
- Purpose: to read and answer your message.
- Legal basis: our legitimate interest in responding to people who contact us (Art. 6(1)(f) GDPR).
Visiting the Website
- Data: technical data your browser sends with every request — IP address, date and time, the page or file requested, the referring page, browser and device type, and error information. These are recorded in server logs by our hosting provider.
- Purpose: to deliver the Website, keep it secure and fix problems.
- Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
Displaying our typeface
- Data: to show the Roca typeface, your browser requests it from Adobe Fonts, which receives your IP address and the address of the page. Adobe states that it does not set cookies to serve fonts and uses this information only to deliver fonts and account for their use. All our other fonts are hosted on our own server.
- Legal basis: our legitimate interest in presenting the Website in its brand typeface, which its licence allows only through Adobe Fonts (Art. 6(1)(f) GDPR).
Measuring visits to the Website (analytics)
- Data: the pages you view and when, the page you came from, your browser, operating system, device type and screen size, your approximate location (country or city, worked out from your IP address) and, for Google Analytics, a random identifier stored in a cookie that recognises your browser on later visits.
- Tools: Google Analytics 4 (Google) and Vercel Web Analytics (Vercel). Vercel Web Analytics sets no cookies: it recognises a visit by a hash of the request that it discards after 24 hours, and reports only aggregate figures.
- Purpose: to count visits and see which pages and sources bring people to the Website, so we can improve it.
- Legal basis: our legitimate interest in understanding how the Website is used (Art. 6(1)(f) GDPR).
Measuring our advertising (Meta)
- Data: through the Meta Pixel, the pages you view, the time, your IP address, browser details and, if you arrived from one of our Meta ads, the click identifier. When you join the waitlist we also send Meta, from our server through its Conversions API, a “Lead” event with an irreversible hash (SHA-256) of your email address, the Meta cookies described in section 3, your browser’s user agent, the time and the page address. Meta uses the hash only to match the sign-up to a Meta account, if there is one; we never send your email address in readable form.
- Purpose: to find out whether our ads on Facebook and Instagram lead to sign-ups, and to show them to people more likely to be interested.
- Legal basis: our legitimate interest in measuring and improving our advertising (Art. 6(1)(f) GDPR). Meta Platforms Ireland Limited and we are joint controllers for collecting and sending this data (Art. 26 GDPR); what Meta does with it afterwards is governed by Meta’s Privacy Policy.
Legal claims
Where necessary, we may keep data to establish, exercise or defend legal claims, based on our legitimate interest (Art. 6(1)(f) GDPR).
4. Who receives your data
We do not sell your data or share it for others’ marketing. We use the following service providers, who process data on our behalf and under our instructions:
- Vercel Inc. (USA) — hosting of the Website and its server logs.
- Vercel Inc. (USA) — also Vercel Web Analytics, the cookie-free visit statistics described in section 2.
- Google Ireland Limited (Ireland), with Google LLC (USA) — Google Analytics.
- Meta Platforms Ireland Limited (Ireland), with Meta Platforms, Inc. (USA) — the Meta Pixel and Conversions API, as a joint controller for collecting and sending the data (see section 2).
- Adobe Inc. (USA) — delivery of the Roca typeface (Adobe Fonts).
- Fillout (USA) — the waitlist sign-up form; it receives the details you enter in it.
- Google (Gmail) — our email inbox, for messages you send us.
- An email delivery provider — for sending waitlist emails. We will name it here before the first waitlist email is sent.
We may also disclose data to public authorities where the law requires us to.
5. Transfers outside the European Economic Area
Some of the providers above are based in the United States, so your data may be transferred there. Vercel, Adobe, Google and Meta are certified under the EU–U.S. Data Privacy Framework, which the European Commission found to provide an adequate level of protection (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). Where a transfer is not covered by that framework, it relies on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the relevant safeguards at vindeo.studio@gmail.com.
6. How long we keep your data
- Waitlist data — until you withdraw consent or unsubscribe, and in any case no longer than 3 years from when you signed up. The record of your consent is kept for as long as we need to be able to show it was given.
- Emails you send us — for as long as needed to deal with your message, then only as long as necessary for any legal claims.
- Server logs — for the short period set by our hosting provider for security and troubleshooting.
- Google Analytics — visit data for the retention period set in our Google Analytics account, at most 14 months; the cookies on your device for 2 years unless you delete them.
- Vercel Web Analytics — the hash that recognises a visit is discarded after 24 hours; only aggregate figures are kept.
- Meta — the cookies on your device for 90 days unless you delete them; data Meta receives is kept under Meta’s own retention rules.
- Your cookie choice and the note that you joined — on your device until you change the choice or clear your browser data.
7. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict how we process it (Art. 18);
- receive data you gave us on the basis of consent in a portable format (Art. 20);
- object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21) — we will then stop unless we have compelling legitimate grounds or need the data for legal claims;
- withdraw your consent at any time, without affecting earlier processing (Art. 7(3)).
To use any of these rights, write to vindeo.studio@gmail.com. We reply within one month, which we may extend by two further months for complex requests, telling you why. We may ask you to confirm your identity first.
You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or the authority in the EU country where you live or work.
8. Do you have to give us your data?
No. Joining the waitlist is voluntary, but we cannot hold a place for you without an email address and a first name. Browsing the Website does not require you to give us any personal data; what is collected automatically while you browse is described in sections 2 and 3.
9. Automated decisions and profiling
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Art. 22 GDPR). Who is invited in each early-access wave is decided by us, not by an automated system.
10. How we protect your data
The Website is served only over an encrypted connection (HTTPS/TLS). Access to personal data is limited to the people who need it, our software is kept up to date, and we choose providers that apply recognised security measures. No method of transmission or storage is completely secure, but we work to protect your data and will act promptly on any incident, including notifying the supervisory authority and you where the law requires.
11. Children
The Website and the waitlist are not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We will update this policy when the way we process data changes, and the date at the top will show when that happened. If a change significantly affects you, we will also tell you by email if you are on the waitlist.