Privacy
Policy.

Vibe89 (“we,” “us,” or “our”) operates vibe89.com from Salt Lake City, Utah. This policy explains what personal information we collect when you visit our website or contact us, how we use that information, who we share it with, how it is transmitted, and how we keep it secure. We wrote this policy to be readable. If anything is unclear, email info@vibe89.com and we will explain.

• 1. Information collected
• 2. How we use it
• 3. Disclosure
• 4. Method of disclosure
• 5. Security
• 6. Cookies
• 7. Your rights
• 8. Retention
• 9. Children
• 10. Changes
• 11. Contact

1. Information we collect

Information you give us directly

When you submit a form on our site (Contact, Book a Call, or Vibe89 Grant application), you choose to provide some or all of the following:

• Identity: full name.
• Contact details: email address, phone number (optional).
• Business details: business name, location, industry, existing website URL.
• Project details: services you are interested in, your message or grant story, and any context you choose to share.

If you book a discovery call, the scheduling step is handled by Calendly and you will provide your name, email, and a meeting time directly to Calendly. See §3 below.

Information collected automatically

When you visit any page on vibe89.com, our hosting and security provider Cloudflare automatically logs standard web request information for security, fraud prevention, and aggregate analytics. This includes:

• IP address and approximate geographic region.
• Browser type, operating system, and device class.
• Referring URL, requested URL, and timestamps.
• Anonymous performance metrics (e.g. page load time) via Cloudflare Web Analytics.

Cloudflare Web Analytics is privacy-first: it does not use cookies, does not fingerprint users, and does not build cross-site profiles. We do not use Google Analytics.

Spam protection

To prevent abuse of our forms, we use Cloudflare Turnstile, a privacy-respecting alternative to traditional CAPTCHA. Turnstile may collect interaction signals (mouse movement, click patterns) and a hashed device challenge to confirm you are not a bot. It does not require solving image puzzles and does not track users across sites.

2. How we use the information

We use the information described above only for the purposes listed below.

• Respond to inquiries: when you contact us or apply for the Vibe89 Grant, we use your information to reply, schedule a call, and follow up on the project you described.
• Deliver services: if you become a client, we use your business and contact information to plan, build, deliver, host, and support your website.
• Operate the website: aggregate, anonymized request logs help us debug issues, monitor uptime, and improve performance.
• Security and fraud prevention: request data is used to detect, block, and investigate abuse, attacks, and bot traffic.
• Legal obligations: when required by law or to protect the rights, property, or safety of Vibe89, our clients, or the public.

We do not sell your personal information. We do not share it with advertisers. We do not use it to send unsolicited marketing.

3. Parties to whom information is disclosed

We use a small set of trusted service providers (sub-processors) to operate the site and respond to your inquiries. Each only receives the data needed to perform its specific function, under that provider’s own security and privacy obligations. We do not share your information with anyone else.

Provider	What it handles	Information disclosed
Cloudflare (hosting, CDN, WAF, analytics, Turnstile)	Serves the website, blocks malicious traffic, runs the form-submission Worker, provides spam protection.	IP address, request metadata, form submission contents in transit, Turnstile challenge data.
Resend (transactional email)	Delivers form submissions to our internal inbox so we can read and reply.	The contents of your form submission (name, email, phone, business, message).
Calendly (meeting scheduling)	Books the discovery call when you choose a time slot on the Contact page.	Name, email address, selected meeting time, and any details you add to the booking form (subject to Calendly’s privacy policy).
Google Fonts	Serves the Inter typeface used across the site.	IP address only, used to deliver the font files. Google does not associate font requests with any signed-in account.

We may also disclose information when legally compelled to do so — for example, in response to a subpoena, court order, or other valid legal process — or when we believe disclosure is necessary to investigate or prevent fraud or harm.

4. Method of disclosure

All disclosure happens electronically over encrypted connections.

• HTTPS / TLS 1.2+ encrypts every request and response between your browser, our website, and the providers listed above. Data submitted through our forms is never transmitted in plain text.
• Server-to-server APIs between Cloudflare Workers and Resend use authenticated HTTPS endpoints with encrypted tokens.
• Calendly hosts the booking widget directly within an HTTPS-secured iframe on our Contact page; data you enter goes straight to Calendly without passing through our servers.
• Email replies we send back to you travel over standard internet email infrastructure. Most major email providers support TLS in transit, but email is not end-to-end encrypted by default. Do not send us highly sensitive information (e.g. financial account numbers, government IDs) by email.

Aggregated, anonymized analytics are accessed by us through Cloudflare’s authenticated dashboard over HTTPS.

5. Security practices

We treat security as a feature, not an afterthought. Concrete measures we take:

• Encryption in transit: HTTPS is enforced site-wide via HSTS, TLS 1.2 or higher. Insecure HTTP requests are automatically redirected.
• Encryption at rest: data stored by our sub-processors (Cloudflare, Resend, Calendly) is encrypted at rest under their respective security programs.
• Cloudflare WAF: a managed Web Application Firewall blocks common attacks (SQL injection, XSS, credential stuffing, malicious bots) at the network edge.
• Content Security Policy (CSP): a strict CSP header restricts which scripts, fonts, and frames the browser is allowed to load — reducing the risk of cross-site scripting and tag injection.
• Bot mitigation: Cloudflare Turnstile guards every form on the site against automated submissions and credential abuse.
• Honeypot fields and timestamp validation: spam-protection fields silently reject bot submissions before they reach our inbox.
• Principle of least privilege: form submissions are routed only to the Vibe89 inbox(es) of staff who need to respond. We don’t store your messages in any third-party CRM.
• No tracking pixels, no third-party advertising tags, no Google Analytics: fewer integrations means fewer attack surfaces and less data exposure.
• Modern, patched stack: the site itself is static HTML/CSS/JS hosted on Cloudflare Pages, an edge platform that is automatically patched and DDoS-protected.

6. Cookies and similar technologies

Vibe89 does not set tracking cookies, advertising cookies, or analytics cookies on its own pages. The only cookie-like data the site may use is:

• A short-lived Cloudflare Turnstile token, set only on pages with a form, used solely to verify you are not a bot.
• Cookies set by Calendly when you interact with the embedded scheduling widget on the Contact page (governed by Calendly’s privacy policy).

Your browser’s “Do Not Track” or Global Privacy Control (GPC) signal is respected automatically because we do not run cross-site tracking or behavioral advertising.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete personal information we hold about you, subject to legal exceptions (e.g. records we must retain for tax or contract purposes).
• Opt out of any future marketing communications, including newsletter or promotional emails.
• Lodge a complaint with your local data protection authority.

California residents have specific rights under the CCPA/CPRA; residents of the EEA, UK, and Switzerland have rights under the GDPR and equivalent laws. To exercise any right, email info@vibe89.com with the subject line “Privacy Request.” We will respond within 30 days, or as required by your local law. We do not discriminate against anyone for exercising a privacy right.

8. How long we keep information

• Form submissions are retained in our email and project tooling for as long as the project relationship is active, plus a reasonable period afterward (typically up to 3 years) for accounting, tax, and legal purposes. Inquiries that don’t result in a project are typically deleted within 12 months.
• Calendly bookings are retained according to Calendly’s retention policy.
• Cloudflare access logs are retained on a short rolling window (typically days, not months) under Cloudflare’s own data-retention policy.

9. Children’s privacy

Our site is intended for businesses and adults. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information through our site, contact info@vibe89.com and we will delete it.

10. Changes to this policy

We may update this policy as our services, providers, or laws change. The “Last updated” date at the top of this page reflects the most recent change. If we make a material change — for example, adding a new sub-processor that receives your personal information — we will note it clearly in this section and, where required, notify affected users by email.

11. How to contact us

For any privacy question, request, or complaint:

• Email: info@vibe89.com (subject line: “Privacy Request”)
• Mail: Vibe89, Salt Lake City, Utah, USA
• Web: vibe89.com/contact

This policy is governed by the laws of the State of Utah, USA.