Privacy Policy
Last updated: June 13, 2026
This policy explains how VibeWin collects, uses, and protects your personal data, in accordance with the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD), and — to the extent applicable — US state privacy laws.
1. Who is responsible (data controller)
Leandro Leonel Utz Torrisi (Spain). Contact: hello@vibewin.app. Full identification details are in the Legal Notice.
2. What data we collect
| Category | Data | Source |
|---|---|---|
| Account | Email address, first name, password (stored only as a secure hash by our auth provider), or your Google account identity if you sign in with Google | You / Google |
| Preferences | Country, region, city, postal code, prize interests, effort preference | You (onboarding) |
| Activity | Giveaways you save, mark as entered (with dates and entry counts), set reminders for, and your daily picks | Your use of the Service |
| Billing | Subscription plan and status, Stripe customer and subscription identifiers. We never see or store your card number — payment details go directly to Stripe | You / Stripe |
| Waitlist | Email address and signup source, if you join the launch waitlist | You (landing page) |
| Technical | IP address, browser user-agent, and request logs used for security, rate limiting, and abuse prevention | Automatic |
We do not collect special-category data, and we do not buy data about you from anyone.
3. Why we use it (purposes and legal bases)
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Providing the Service: your account, saved/entered lists, personalized picks | Performance of a contract (6.1.b) |
| Processing subscriptions and payments; keeping invoicing records | Contract (6.1.b) and legal obligations (6.1.c, tax law) |
| Security: rate limiting, abuse and fraud prevention, IP blocking | Legitimate interest (6.1.f) in protecting the Service |
| Service emails you request (e.g. deadline reminders for giveaways you track) | Contract (6.1.b); you can switch reminders off anytime |
| Waitlist and launch emails — giveaway picks and product updates you signed up for on the landing page | Consent (6.1.a) given when joining; unsubscribe anytime via the link in any email or by writing to us |
We do not use your data for automated decisions with legal or similarly significant effects. Scores apply to giveaways, not to you; personalization simply matches giveaways to the preferences you chose.
4. Who we share it with (processors)
We share data only with the providers that run the Service, under data-processing agreements:
- Supabase — database, authentication, and hosting of user data;
- Stripe — payment processing and subscription billing;
- Resend — transactional email delivery;
- Google — only if you choose “Continue with Google” for sign-in;
- Vercel — website hosting, content delivery, and cookieless analytics (aggregate page-view statistics with no cookies and no cross-site tracking).
Some providers process data in the United States. Where they do, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses. We never sell your personal data, and we don’t share it with advertisers.
5. How long we keep it
- Account and activity data: for as long as your account exists. Deleting your account (account page → “Delete account”) permanently removes your profile, preferences, saved/entered lists, and reminders.
- Billing records: kept after deletion only as long as tax and commercial law requires.
- Security logs (IP, rate-limit events): kept briefly and rotated automatically.
6. Your rights (EU/EEA)
You can exercise your GDPR rights — access, rectification, erasure, restriction, portability, and objection — by emailing hello@vibewin.app, and two of them are self-serve on your account page: “Download my data” exports everything we store about you as JSON (portability), and “Delete account” erases it. We respond to emailed requests within one month. You can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority of your own EU country.
7. US residents
VibeWin does not currently meet the thresholds that make the California Consumer Privacy Act (CCPA/CPRA) or similar state laws applicable to it. We nevertheless honor the same core rights for all users — to know, correct, delete, and obtain a copy of your data — via hello@vibewin.app. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use targeted advertising.
8. Cookies and local storage
We use only strictly necessary cookies: the session cookies our authentication provider (Supabase) sets to keep you signed in securely. Under the ePrivacy rules and the Spanish AEPD’s cookie guidance, strictly necessary cookies do not require consent — which is why you don’t see a cookie banner.
sb-*cookies — authentication session; essential; deleted on sign-out or expiry.- Browser local storage — small technical values for the interface; nothing used to track you.
- If you pay, Stripe sets cookies on its own checkout pages under Stripe’s policy — not on ours.
For analytics we use Vercel Web Analytics, which is cookieless — it measures aggregate page views without setting any cookies, without cross-site tracking, and without collecting personal data, so it needs no consent banner. We use no advertising or cross-site tracking cookies. If we ever add analytics that do use cookies, we will ask for your consent first.
9. Security
Data is encrypted in transit; passwords are hashed; database access is enforced row-by-row so each account can only ever read its own data; secret keys are confined to the server; and the site runs rate limiting and abuse protection. No system is 100% secure, but if a breach affects your data we will notify you and the authorities as the GDPR requires.
10. Children
The Service is for adults (18+). We do not knowingly collect data from minors; if you believe a minor has an account, contact us and we will delete it.
11. Changes and contact
We will post any changes here and, for material changes, notify you in the app or by email. Questions: hello@vibewin.app. See also the Terms of Service and the Legal Notice.