Privacy Policy

At VBedits we treat your data with respect and collect only what's strictly necessary to run the Store. This policy explains what we collect, why, how long we keep it, and who we share it with.

1. Data controller

VBedits, based in Spain, is the controller of the personal data collected through the Store. Contact: jjvilbe@gmail.com.

2. Data we collect

• Purchase data: name, email, amount and country (needed to issue the license and any invoice).
• Payment data: handled directly by Stripe and PayPal. We never store full card numbers on our servers.
• Technical data: IP address, a short hardware fingerprint (16-char hash) and the URL of the site where you activate the license. Used to prevent key abuse and issue signed downloads.
• Essential cookies: session, language preference (vbe_lang) and cart. No marketing or third-party tracking cookies.
• Communications: if you write to us, we keep the email as long as needed to reply.

3. Purposes

• Process your purchase and deliver the license and downloads.
• Notify you by email when we publish a new version of a Product you bought.
• Let you manage your licenses and activations from /cuenta.
• Comply with our tax and accounting obligations.
• Prevent fraud and key misuse.

4. Legal basis

• Contract performance (art. 6(1)(b) GDPR) for data strictly necessary to deliver the license.
• Legal obligation (art. 6(1)(c) GDPR) for data required by Spanish tax law.
• Legitimate interest (art. 6(1)(f) GDPR) for activation control and fraud prevention.
• Consent (art. 6(1)(a) GDPR) for optional communications (newsletter, etc.), only if explicitly given.

5. Recipients and transfers

We share data strictly with providers needed to run the Store:

• Stripe and PayPal (payment processors).
• Transactional email provider (SMTP) for confirmations and notifications.
• Hosting provider where these servers live.

When any of these providers is outside the European Economic Area, transfers rely on Standard Contractual Clauses approved by the European Commission.

6. Retention period

Purchase data is kept for the minimum legal period required by Spanish tax law (currently 6 years from the transaction). Activation technical data is kept while the license is valid. Communications are kept as long as needed to resolve the inquiry.

7. Your rights

Under the GDPR you may exercise access, rectification, erasure, objection, restriction and portability rights at any time by writing to jjvilbe@gmail.com. You may also lodge a complaint with the Spanish Data Protection Agency.

8. Security

We apply reasonable technical and organisational measures: mandatory HTTPS, encryption-at-rest for sensitive fields, bcrypt password hashing, security headers (CSP, HSTS), admin-panel access control and audit logs for critical actions.

9. Changes to this Policy

We may update this Policy to reflect legal or technical changes. The "Last updated" date above reflects the current version.