Privacy Policy

1. Controller

The controller of your personal data is Larysa Danyuk, ul. Jana III Sobieskiego 1/49, 02-957 Warszawa (Mazowieckie), Poland, NIP 5214137319, REGON 543026074.

Contact in all data protection matters: INFO@vibevox.pro, tel. +48 532 875 937. Support: ai@lingoflow.pro. We have not appointed a Data Protection Officer; requests are handled by the controller.

This Policy applies to the website lingoflow.pro and to the browser extensions and bridges we distribute (the “Products”).

2. What we collect

a) Account and order data: e-mail address; if you sign in with Google — the e-mail address and name provided by Google; licence keys; the products, plans and periods you purchased; promo and referral codes; the payment identifier and status received from the payment provider; the country and currency of the transaction.

b) Licence verification data: the licence key, the product identifier, and a device identifier (device_id) generated in your browser, together with the date of last verification. We use them to enforce the device limit of the plan.

c) Website traffic data: the address of the visited page, UTM parameters, the domain of the referring site, and an irreversible 16-character hash of your browser signature and IP address. This counter sets no cookies, does not identify you and does not follow you across other websites. It is switched off if you decline analytics in the consent banner.

d) Correspondence: the content of e-mails and messages you send us, together with the address you send them from.

e) Technical server logs kept by the hosting provider (IP address, time, request, browser), used for security and diagnostics.

3. What the Products do and do not send

3.1. An interface translator sends to our server only the licence key, the product identifier and the device identifier, in order to verify the licence.

3.2. To translate the interface, the text of interface elements (menus, buttons, tooltips) is sent to Google’s machine translation service. Do not use the Products on pages whose interface elements contain confidential data, because those strings will be transmitted to that service.

3.3. The content of your work — prompts, generated files, documents, source code, chats, canvas content — is not sent to us and is not sent for translation.

3.4. OmniFlow and SeedFlow operate inside your own account on the third-party platform. Task settings, the queue and the local task history remain in your browser and on your disk. The bridge for external assistants listens only on the local address 127.0.0.1 and its token is stored in your home directory. If you use assistant mode, your API key is stored in your browser profile and your requests go directly to the model provider you chose, under that provider’s privacy policy.

3.5. Generations run on the third-party platform under that platform’s own privacy policy. We have no access to your account, your balance or the content you generate there.

4. Purposes and legal bases

a) Concluding and performing the contract — delivery of the licence key, licence verification, account, support: art. 6(1)(b) GDPR.

b) Accounting and tax obligations — art. 6(1)(c) GDPR in connection with the Polish Accounting Act and the VAT Act.

c) Security of the service, prevention of abuse of trials and of licence sharing, establishment and defence of claims — art. 6(1)(f) GDPR (our legitimate interest).

d) Anonymous traffic statistics — art. 6(1)(a) GDPR, on the basis of the consent you give in the banner; you may withdraw it at any time.

e) Answering messages you send us — art. 6(1)(f) GDPR, and art. 6(1)(b) where the message concerns a contract.

f) Sending information about an order, a licence or a change to the terms — art. 6(1)(b) and (c) GDPR. We do not send marketing mailings without a separate consent.

5. Recipients of the data

We use the following categories of recipients, each only to the extent necessary:

• Stripe Payments Europe, Ltd. (Ireland) — payment processing; a separate controller for payment data. We never receive your card number.
• Hostinger International Ltd. (Cyprus / Lithuania) — hosting of the website, the database and outgoing e-mail; a processor.
• Google Ireland Ltd. / Google LLC — the machine translation service used by the extensions, Google sign-in (only if you choose it) and the web fonts used by the website.
• Telegram Messenger — internal notifications to the operator about new orders and system events; such a notification may contain the buyer’s e-mail address and the order details.
• Accounting and legal advisers, and public authorities where required by law.

We do not sell personal data and do not share it for third-party advertising.

6. Transfers outside the EEA

Some recipients may process data outside the European Economic Area, in particular in the United States. Such transfers take place on the basis of the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, or on the basis of the Standard Contractual Clauses adopted by the Commission, together with supplementary safeguards. You may request a copy of the safeguards at the contact address above.

7. Retention periods

• Accounting documents and payment data — 5 years from the end of the tax year in which the payment was made.
• Account, licence and device data — for the duration of the licence and then for the period of limitation of claims (generally 6 years, and 3 years for claims connected with a business activity).
• Correspondence — up to 3 years from the last message, unless it forms part of a case file.
• Traffic counter records — 12 months.
• Server logs — according to the hosting provider’s policy, as a rule up to 12 months.

8. Your rights

You have the right to: access your data and obtain a copy; rectify it; erase it; restrict processing; data portability; object to processing based on our legitimate interest; and withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, write to INFO@vibevox.pro. We reply within one month. Where a request concerns an account or a licence, we may ask you to confirm the e-mail address to which the licence was issued — solely in order not to disclose data to an unauthorised person.

You also have the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

9. Is providing data required?

Providing an e-mail address is a contractual requirement — without it we cannot deliver a licence key. Providing the other data is voluntary; declining consent to analytics has no effect on the operation of the Products.

10. Automated decision-making and profiling

We do not take decisions producing legal effects for you in an automated manner and we do not profile you. Automated verification of the device limit of a licence serves only to enforce the terms of the plan you purchased and does not assess your person.

11. Children

The Products are not addressed to persons under 16. We do not knowingly collect their data. If you find that a child has provided us with data, please notify us and we will delete it.

12. Security

We use TLS encryption, hashed passwords, restricted access to the database, rate limiting on login endpoints and the deletion of data that is no longer needed. No method of transmission over the Internet is completely secure, and we cannot guarantee an absolute level of security.

13. Changes to this Policy

We may amend this Policy. The current version is always published on this page with the date of the version. Material changes affecting the rights of registered users are announced by e-mail or in the account.