Privacy policy

Controller

Harith Al-Ani, trading as vybebat (Sole proprietorship (Einzelunternehmen))

Address:
Max-Schwarze-Weg 27a
46236 Bottrop
Germany

Email: hello@vybebat.dev

Send privacy requests to the email address above. No data protection officer is appointed, because none is required by law.

Last updated: 5 October 2026

Visiting this site

This site runs on Cloudflare Workers. When you load a page, Cloudflare processes technical connection data such as your IP address, the time of access, the requested address and browser information, to deliver the page and protect the service from abuse. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

We do not use analytics, advertising or tracking cookies. Fonts, icons and artwork are served from this site, and the homepage animation is drawn locally in your browser.

Links to other websites, including Vybentis, open the separate provider's site only when you choose to follow them. That provider's privacy information applies there.

Quick scan

Your quick scan answers and any store link you paste are processed only in your browser. They are not sent to us or stored, and closing or reloading the page discards them. If you choose to continue to the beta form, the platform and store link are passed to that form in the page address so you do not have to type them again.

Beta requests

When you join the beta we store your name, email address, platform, selected tier and any optional details you give (company, store link, a note about the app), together with the time of the request. We use them to review your request, contact you about it and, if access is unlocked, to run your workspace. The legal basis is taking steps at your request before a possible contract (Art. 6(1)(b) GDPR).

Once email delivery is set up, we send you a confirmation email and send ourselves a notification with the details of your request. Please do not send confidential builds, credentials or source code through the form.

To limit abuse, a hashed form of your IP address and email address is counted for a short time when you submit the form or ask for a sign-in link. The legal basis is our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).

Sign-in and cookies

Sign-in works with a one-time link sent to your email address. Only a hash of the link is stored, and it expires after 15 minutes or on first use.

After you sign in we set one strictly necessary cookie, vb_session, which keeps you signed in for up to 7 days. It is limited to this site, cannot be read by page scripts and is deleted when you sign out. Inside the workspace, toggling the sidebar may set a sidebar_state cookie for seven days to remember the layout. No other cookies are used.

Sample records shown in the workspace are illustrative and do not contain other customers' data.

Email

If you write to hello@vybebat.dev, we process your address and message to answer you. The legal basis is steps at your request before a possible contract, or the contract itself (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).

Incoming email is received by Cloudflare Email Routing and forwarded to a mailbox hosted by Google (Google Ireland Limited, Dublin, Ireland). Outgoing email is sent through Resend.

Service providers

Cloudflare (Cloudflare, Inc., USA, and Cloudflare Germany GmbH) hosts this site, runs its server code, routes incoming email and stores beta requests, sign-in links, sessions and rate limit counters in Cloudflare Workers KV.

Resend (Resend, Inc., USA) delivers our emails, sent from its EU region: replies, beta confirmations, our internal request notifications, sign-in links and access notices.

Google (Google Ireland Limited, Ireland, with possible transfer to Google LLC, USA) hosts the mailbox that receives email sent to us.

These providers act on our behalf as processors. Where data is transferred to the USA, the transfer relies on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and on the standard contractual clauses in the providers' data processing terms.

Client work

App builds, test accounts and findings from assessments are not processed through this website. They are covered by the agreements signed for each engagement. Builds are never uploaded to online scanners or sample-sharing services.

Retention

Pending beta requests are deleted 12 months after our last contact with you unless your access has been approved. Approved accounts are kept while the account is in use and deleted on request. Sign-in links expire after 15 minutes, sessions after 7 days and rate limit counters after at most one hour. Business correspondence is kept for the legal retention periods, up to 8 years where it relates to invoices.

Your rights

Subject to the conditions in the GDPR, you may request access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing based on legitimate interests (Art. 21). You may withdraw consent for the future. You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

You do not have to give us any data. Without an email address, however, we cannot answer a request.

Send requests to hello@vybebat.dev.