Legal · GDPR / AVG
Privacy policy.
Last updated 18 October 2026
Draft. This text is a draft pending legal review and may change. It is not legal advice.
This policy explains which personal data FixMyVibe processes when you use fixmyvibe.dev, why, and what rights you have under the General Data Protection Regulation (GDPR, in Dutch: AVG).
1. Who is responsible
The controller is Mosselaer Holding B.V., trading as FixMyVibe, Oostwijk 41, 5406 XT Uden, The Netherlands. Chamber of Commerce (KvK) 59637293. For privacy questions: privacy@fixmyvibe.dev.
2. What we process
| Data | Purpose | Legal basis |
|---|---|---|
| Email address (optional for a website scan) | Sending your report, payment and scan notifications | Performance of a contract (art. 6(1)(b)) |
| Repository URL and source code | Running the audit you requested | Performance of a contract |
| Website address (website scan) and your confirmation that you own the site or may scan it | Running the passive website check you requested, and a record of that permission | Performance of a contract |
| Payment details (order id, amount, status) | Processing payments and refunds, bookkeeping | Contract; legal obligation (art. 6(1)(c)) |
| How you found us when you start a scan: the campaign tags in the link you arrived with (utm_source, utm_medium, utm_campaign), the page you landed on and the referring website's domain | Counting which channels lead to scans | Legitimate interest (art. 6(1)(f)) |
| Technical logs (IP address, request times) | Security, abuse prevention, troubleshooting | Legitimate interest (art. 6(1)(f)) |
| Messages you send us | Answering your question | Legitimate interest / contract |
Source code may incidentally contain personal data (for example seed data or credentials). We only process it to produce your report. We do not use your code to train AI models.
3. Retention
- Cloned source code is processed in a temporary working directory and deleted as soon as the scan finishes (also when the scan fails).
- Reports and scan records (including your email address) are deleted after 7 days, unless you have an active subscription such as Live Verified, for as long as it runs.
- Daily counts of scans per source (campaign tags, landing page, referring domain), without email address, repository or job id, are kept for statistics.
- Payment and invoice records are kept for 7 years, as required by Dutch tax law.
4. Processors and recipients
We use carefully selected service providers that process data on our behalf:
- Vercel for website hosting and cookieless Web Analytics (aggregated page views and anonymous landing and scan-form events only; see §5).
- Hosting of the scan infrastructure.
- AI model providers (such as Anthropic or OpenAI) for the AI review step, via their APIs, under terms that exclude training on submitted data.
- PayPal and Stripe (card, iDEAL, Apple Pay, Google Pay) for payments. Each is an independent controller for the payment data you give to them; we never see your full card details.
- Resend for sending transactional email.
- GitHub, when you connect a private repository through our read-only GitHub App.
Some of these providers are based outside the European Economic Area. Where that is the case, transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. We never sell your data.
5. Cookies and analytics
The website does not use tracking or advertising cookies. The site itself sets no cookies. Page views are counted with Vercel Web Analytics, which is cookieless: visitors are not identified with cookies, and the data is used only as aggregated statistics (for example page views, referrers, and coarse device or location info). It does not build personal profiles or track you across other sites or days. See Vercel's Web Analytics privacy documentation. During checkout, the payment provider (PayPal or Stripe) may use its own technically necessary cookies. To count which links lead to scans, the site keeps the campaign tags of the link you arrived with, the landing page and the referring domain in your browser's session storage until you close the tab, and sends them with a scan request. This is not a cookie and contains no identifier. A separate session-storage marker records that the landing event below was already sent; it is never sent anywhere. When you arrive through a link with campaign tags, the site sends one anonymous "landing" event per browser tab session to Vercel Web Analytics, with only the campaign name and ad variant from those tags. The scan form also sends two anonymous events to Vercel Web Analytics: "scan started" (with only whether you entered a website or a GitHub repo, and the campaign tag) and "scan not started" (with only the reason, such as a missing tick box or a server error, and the campaign tag). They never include your site address or email.
6. Your rights
You can ask for access to, correction, deletion or restriction of your data, object to processing, and ask for data portability. Email privacy@fixmyvibe.dev; we reply within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
7. Security
Website scans only fetch public pages and files of the site you enter (your homepage, the scripts and stylesheets it links to, robots.txt, sitemap.xml and security.txt). The fetched content is not stored; only the findings in your report are kept. Repo scans run on a temporary copy of your repository, cloned with read-only access and deleted when the scan finishes. Data is encrypted in transit. Access to stored data is limited to what is needed to run the service.
8. Changes
We may update this policy. The date at the top shows the latest version.