Privacy
Policy.

Vibe89 (“we,” “us,” or “our”) operates vibe89.com from Salt Lake City, Utah. This policy explains what personal information we collect when you visit our website or contact us, how we use that information, who we share it with, how it is transmitted, and how we keep it secure. We wrote this policy to be readable. If anything is unclear, email info@vibe89.com and we will explain.

• 1. Information collected
• 2. How we use it
• 3. Disclosure
• 4. Method of disclosure
• 5. Security
• 6. Cookies
• 7. Your rights
• 8. Retention
• 9. Children
• 10. Changes
• 11. Text messaging
• 12. Contact

1. Information we collect

Information you give us directly

When you submit a form on our site (Contact, Book a Call, or Vibe89 Grant application), you choose to provide some or all of the following:

• Identity: full name.
• Contact details: email address, phone number (optional).
• Business details: business name, location, industry, existing website URL.
• Project details: services you are interested in, your message or grant story, and any context you choose to share.

If you book a discovery call, the scheduling step is handled by Calendly and you will provide your name, email, and a meeting time directly to Calendly. See §3 below.

Information collected automatically

When you visit any page on vibe89.com, our hosting and security provider Cloudflare automatically logs standard web request information for security, fraud prevention, and aggregate analytics. This includes:

• IP address and approximate geographic region.
• Browser type, operating system, and device class.
• Referring URL, requested URL, and timestamps.
• Anonymous performance metrics (e.g. page load time) via Cloudflare Web Analytics.

Cloudflare Web Analytics does not use cookies, does not fingerprint users, and does not build cross-site profiles.

Google Analytics and Google Ads measurement

We use Google Analytics 4 to understand how visitors use the site and which pages lead to inquiries, and Google Ads conversion measurement to see whether our own advertising leads to contact requests. These tools use cookies and similar identifiers and collect:

• Pages viewed, time on page, scroll depth, and the link or button you clicked.
• Approximate location (city level), device, browser, and the site or ad that referred you.
• That a form was submitted, a call was booked, a phone or email link was clicked. We do not send your name, email, phone number, or message contents to Google.

Google processes this data under the Google Privacy Policy. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on and control ad personalization at My Ad Center.

Spam protection

To prevent abuse of our forms, we use Cloudflare Turnstile, a privacy-respecting alternative to traditional CAPTCHA. Turnstile may collect interaction signals (mouse movement, click patterns) and a hashed device challenge to confirm you are not a bot. It does not require solving image puzzles and does not track users across sites.

2. How we use the information

We use the information described above only for the purposes listed below.

• Respond to inquiries: when you contact us or apply for the Vibe89 Grant, we use your information to reply, schedule a call, and follow up on the project you described.
• Deliver services: if you become a client, we use your business and contact information to plan, build, deliver, host, and support your website.
• Operate the website: aggregate, anonymized request logs help us debug issues, monitor uptime, and improve performance.
• Security and fraud prevention: request data is used to detect, block, and investigate abuse, attacks, and bot traffic.
• Legal obligations: when required by law or to protect the rights, property, or safety of Vibe89, our clients, or the public.
• Measure and improve our marketing: aggregated Google Analytics and Google Ads measurement data tells us which pages, searches, and ads lead to inquiries.

We do not sell your personal information. We do not use it to send unsolicited marketing; newsletter emails go only to people who sign up and include an unsubscribe link.

3. Parties to whom information is disclosed

We use a small set of trusted service providers (sub-processors) to operate the site and respond to your inquiries. Each only receives the data needed to perform its specific function, under that provider’s own security and privacy obligations. We do not share your information with anyone else except as described here.

Provider	What it handles	Information disclosed
Cloudflare (hosting, CDN, WAF, analytics, Turnstile)	Serves the website, blocks malicious traffic, runs the form-submission Worker, provides spam protection.	IP address, request metadata, form submission contents in transit, Turnstile challenge data.
Resend (transactional email)	Delivers form submissions to our internal inbox so we can read and reply.	The contents of your form submission (name, email, phone, business, message).
Calendly (meeting scheduling)	Books the discovery call when you choose a time slot on the Contact page.	Name, email address, selected meeting time, and any details you add to the booking form (subject to Calendly’s privacy policy).
Google Analytics & Google Ads (measurement)	Measures site usage and whether our ads and pages lead to inquiries.	Cookie identifiers, pages viewed, interactions, approximate location, device and referrer data. No form contents. See §1 and §6.
Stripe (payments)	Processes payments when you buy a service or pay an invoice online.	Name, email, billing details and card data entered directly into Stripe when you pay an invoice we send you. Card numbers never touch our servers (subject to Stripe’s privacy policy).
Google Fonts	Serves the Inter typeface used across the site.	IP address only, used to deliver the font files. Google does not associate font requests with any signed-in account.

We may also disclose information when legally compelled to do so, for example in response to a subpoena, court order, or other valid legal process, or when we believe disclosure is necessary to investigate or prevent fraud or harm.

4. Method of disclosure

All disclosure happens electronically over encrypted connections.

• HTTPS / TLS 1.2+ encrypts every request and response between your browser, our website, and the providers listed above. Data submitted through our forms is never transmitted in plain text.
• Server-to-server APIs between Cloudflare Workers and Resend use authenticated HTTPS endpoints with encrypted tokens.
• Calendly hosts the booking widget directly within an HTTPS-secured iframe on our Contact page; data you enter goes straight to Calendly without passing through our servers.
• Email replies we send back to you travel over standard internet email infrastructure. Most major email providers support TLS in transit, but email is not end-to-end encrypted by default. Do not send us highly sensitive information (e.g. financial account numbers, government IDs) by email.

Aggregated analytics are accessed by us through Cloudflare’s and Google’s authenticated dashboards over HTTPS.

5. Security practices

We treat security as a feature, not an afterthought. Concrete measures we take:

• Encryption in transit: HTTPS is enforced site-wide via HSTS, TLS 1.2 or higher. Insecure HTTP requests are automatically redirected.
• Encryption at rest: data stored by our sub-processors (Cloudflare, Resend, Calendly) is encrypted at rest under their respective security programs.
• Cloudflare WAF: a managed Web Application Firewall blocks common attacks (SQL injection, XSS, credential stuffing, malicious bots) at the network edge.
• Content Security Policy (CSP): a strict CSP header restricts which scripts, fonts, and frames the browser is allowed to load, reducing the risk of cross-site scripting and tag injection.
• Bot mitigation: Cloudflare Turnstile guards every form on the site against automated submissions and credential abuse.
• Honeypot fields and timestamp validation: spam-protection fields silently reject bot submissions before they reach our inbox.
• Principle of least privilege: form submissions are routed only to the Vibe89 inbox(es) of staff who need to respond. We don’t store your messages in any third-party CRM.
• Minimal third-party scripts: beyond Google Analytics and Google Ads measurement (§6), we load only what the site needs to work. Fewer integrations means fewer attack surfaces and less data exposure.
• Modern, patched stack: the site itself is static HTML/CSS/JS hosted on Cloudflare Pages, an edge platform that is automatically patched and DDoS-protected.

6. Cookies and similar technologies

The site uses the following cookies and similar technologies:

• Google Analytics cookies (for example _ga and _ga_*), which distinguish visits and sessions so we can measure site usage. They last up to 2 years.
• Google Ads conversion cookies (for example _gcl_*), set when you arrive from one of our ads, used to count inquiries that came from that ad. They last up to 90 days.
• A short-lived Cloudflare Turnstile token, set only on pages with a form, used solely to verify you are not a bot.
• Cookies set by Calendly when you interact with the embedded scheduling widget on the Contact page (governed by Calendly’s privacy policy).

If your browser sends a Global Privacy Control (GPC) signal, the site automatically tells Google not to use advertising storage, ad user data, or ad personalization for your visit; basic analytics still runs without advertising features. You can also block or delete cookies in your browser settings, and the site will keep working.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete personal information we hold about you, subject to legal exceptions (e.g. records we must retain for tax or contract purposes).
• Opt out of any future marketing communications, including newsletter or promotional emails.
• Lodge a complaint with your local data protection authority.

California residents have specific rights under the CCPA/CPRA; residents of the EEA, UK, and Switzerland have rights under the GDPR and equivalent laws. To exercise any right, email info@vibe89.com with the subject line “Privacy Request.” We will respond within 30 days, or as required by your local law. We do not discriminate against anyone for exercising a privacy right.

8. How long we keep information

• Form submissions are retained in our email and project tooling for as long as the project relationship is active, plus a reasonable period afterward (typically up to 3 years) for accounting, tax, and legal purposes. Inquiries that don’t result in a project are typically deleted within 12 months.
• Calendly bookings are retained according to Calendly’s retention policy.
• Cloudflare access logs are retained on a short rolling window (typically days, not months) under Cloudflare’s own data-retention policy.

9. Children’s privacy

Our site is intended for businesses and adults. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information through our site, contact info@vibe89.com and we will delete it.

10. Changes to this policy

We may update this policy as our services, providers, or laws change. The “Last updated” date at the top of this page reflects the most recent change. If we make a material change, for example adding a new sub-processor that receives your personal information, we will note it clearly in this section and, where required, notify affected users by email.

11. Text Messaging (SMS)

When you call Vibe89 at (385) 341-8189, we collect your phone number, the time of your call, and any text messages you exchange with Vibe89. We use this information only to confirm your call, answer your questions, and schedule a callback.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

Message frequency varies. Message and data rates may apply. You can reply STOP to stop receiving texts from Vibe89 at any time, or reply HELP for help. See our SMS Terms for details, and how text message consent works for exactly what callers hear and agree to.

12. How to contact us

For any privacy question, request, or complaint:

• Email: info@vibe89.com (subject line: “Privacy Request”)
• Mail: Vibe89, Salt Lake City, Utah, USA
• Web: vibe89.com/contact

This policy is governed by the laws of the State of Utah, USA.