Privacy Policy

2.1 Account Information

When you register for an account, we collect:

• Name and email address
• Password (stored in hashed form) or SSO provider token (Google/GitHub)
• Organization name (if applicable)
• Billing information (processed and stored by Stripe; Cellpy does not store raw payment card data)

2.2 Usage and Telemetry Data from the VS Code Extension

When you use the VS Code Extension, we collect telemetry data including:

• Block creation and publishing events (timestamps, block IDs, publish destinations)
• Extension feature usage patterns
• Error and crash reports
• Account identifiers associated with extension actions

This telemetry may constitute personal data under GDPR where it can be linked to an identifiable individual (for example, via account ID or IP address). We process this data on the basis of our legitimate interests in operating, securing, and improving the Services. You can disable non-essential telemetry in the extension settings. Security-related telemetry (error and crash reports) may continue regardless of this setting.

This data does not include the HTML/CSS content of your Blocks.

2.3 CDN Request Logs

Our CDN infrastructure (Cloudflare R2) generates logs of requests to serve Blocks. These logs may include:

• IP addresses of requesting clients
• Timestamps and URLs of requested Blocks
• HTTP headers (user agent, referrer)

CDN logs are used for security monitoring, abuse prevention, and performance optimization. They are retained for up to 90 days. Note that CDN requests may originate from end users of third-party websites embedding Cellpy Blocks, not from registered Cellpy users; Cellpy does not use such logs to identify or track those end users.

2.4 Dashboard Usage Data

When you use the Cellpy dashboard, we collect standard web analytics data including page views, session duration, and feature interactions. This data is collected via cookies and analytics tools (see Section 7).

2.5 Communications

If you contact us for support or other inquiries, we retain records of those communications.

4.1 Third-Party Subprocessors

We share data with the following categories of subprocessors who process data on our behalf:

• Cloudflare — CDN, DNS, DDoS protection, edge network infrastructure, and analytics event storage (Cloudflare Analytics Engine, used to store aggregate A/B experiment impression and click data). Cloudflare may process data in the United States and other jurisdictions; Cloudflare relies on Standard Contractual Clauses for EU data transfers.
• Stripe — Payment processing and payouts to Designers via Stripe Connect. Stripe may process data in the United States; Stripe relies on Standard Contractual Clauses for EU data transfers.
• Vercel — Web application hosting and serverless functions. Vercel may process data in the United States; Vercel relies on Standard Contractual Clauses for EU data transfers.
• Google / GitHub — Single sign-on authentication (where you choose to use SSO).
• Analytics providers — Aggregate usage analytics (see Section 7).
• Email service providers — Transactional and marketing emails.
• VibeMeASite service providers — see Section 13.4.

A current list of subprocessors is available on our website. We will notify you of material changes to our subprocessor list with at least 30 days' prior notice where practicable.

4.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Cellpy, our users, or the public.

4.3 Business Transfers

If Cellpy undergoes a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our platform before your information becomes subject to a different privacy policy.

Legal Bases for Processing

Our legal bases for processing your personal data are:

International Data Transfers

Cellpy is based in Canada. Canada benefits from an EU adequacy decision under GDPR Article 45 for commercial organizations subject to PIPEDA, meaning transfers of personal data from the EU/EEA to Cellpy in Canada are permitted without additional safeguards.

However, some of our subprocessors (including Cloudflare, Stripe, and Vercel) may process data in the United States or other jurisdictions that do not benefit from an adequacy decision. In such cases, transfers are governed by Standard Contractual Clauses (SCCs) or other appropriate safeguards as implemented by those subprocessors. We recommend reviewing the privacy policies of these subprocessors for further detail.

EU Representative

Cellpy does not currently maintain a formal EU Representative under GDPR Article 27. We periodically assess whether appointment of an EU Representative is required under GDPR Article 27 and will make the appointment if and when it becomes necessary.

13.1 Site Owners and Clients

When you use VibeMeASite or buy a Website Launch Package, we collect:

• Your email address, used to log you in with a one-time code or link (no password), and your name and business name if you give them
• Your site's content: business details, pages, sections, branding, images, videos, and settings
• Your brief, our correspondence, Quotes, approvals, and delivery records for any Website Launch Package
• Billing details for your subscription or Website Launch Package, processed by Stripe (we receive your payment status and plan; we never receive or store your full card number)
• Encrypted credentials for services you choose to connect — for example, Google or iCloud Calendar for bookings, Square for payments on your site, or your own hosting accounts
• Records of the actions taken on your site through VibeMeASite's tools (which tool was used, when, and on which site), used for support, security, and abuse prevention

13.2 Visitors to Hosted Sites

A Hosted Site may collect personal information from its visitors — for example, names, email addresses, phone numbers, and notes entered in booking forms, contact forms, or shop checkout, and order details. We process this information on behalf of the Site Owner, who decides what the site collects and is responsible for telling visitors about it; we act as a service provider (processor) and use it only to run the site's features, such as sending bookings and form messages to the Site Owner and confirmations to the visitor. Visitors with questions about their data should contact the Site Owner first; we will help the Site Owner respond. Site Owners may request our DPA (Section 11).

13.3 Prospective Clients and Marketing

To find businesses that may benefit from a website, we may collect business contact details that are publicly available (for example, a business's name, website, phone number, and address as listed on public maps or directories) or that you give us (for example, when you register for a webinar or ask for a free draft), and keep notes of our conversations. We use them to contact the business about our services. You can ask us to stop contacting you and delete these details at any time by emailing admin@vibemeasite.com, by using the unsubscribe link in our emails, or by replying STOP to a text message. Mobile numbers and SMS opt-in data are not sold, rented, or shared with third parties for their marketing purposes.

13.4 VibeMeASite Service Providers

In addition to the subprocessors in Section 4.1, VibeMeASite uses:

• Neon — database hosting
• Resend — email delivery (login codes, booking and form notifications, our emails to you)
• Twilio — text messages, only where you have agreed to receive them
• Square — payments that a Site Owner accepts on their own site (for example, booking deposits or shop orders), only where the Site Owner connects it
• Google — Calendar (only if you connect it), Maps (for maps you add to your site), reCAPTCHA (if enabled), and Google Analytics on vibemeasite.com
• Apple — iCloud Calendar, only if you connect it
• Anthropic (Claude) and OpenAI (ChatGPT) — only if you use VibeMeASite through their assistants; what those platforms keep from your conversations is governed by their own privacy policies

VibeMeASite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

13.5 VibeMeASite Retention

• Site content is kept while the site has an active subscription or trial. When a subscription ends, the site goes offline 14 days after the last paid period and may be permanently deleted 30 days after that (see Terms of Service, Section 15.5). An unclaimed free preview may be deleted after its trial ends.
• Credentials for a connected calendar or other service are deleted when you disconnect it.
• Visitor data on a Hosted Site (bookings, form messages, orders) is kept for the life of the site and deleted with it, or earlier at the Site Owner's request.
• Billing, Quote, and transaction records are kept as required by Canadian tax and accounting law (generally 7 years).

You can ask us to delete your VibeMeASite account and data at any time by emailing admin@vibemeasite.com.