Privacy

Roles (GDPR)

• For data you upload and manage within your organization in the VM application, VM typically acts as a data processor on your behalf.
• For data related to our website, billing administration, and customer support (e.g., contact requests), VM may act as a data controller.

Data we process

• Account and access data: Email address, (optional) name, organization membership/roles, and authentication/session identifiers.
• Application data you provide: Organization-related reporting data, packaging/product data, LUCID XML exports, and related audit/activity records used to provide traceability of changes.
• Billing and subscription data (if applicable): Subscription status, plan/price information, and billing-related identifiers. Payment card details are processed by our payment provider (Stripe) and are not stored by VM.
• Support and communications: Messages submitted via our contact form and email communications (e.g., name, company, email address, message content). For support and abuse-prevention purposes, contact requests may also include technical data such as IP address in the support message.
• Technical data and functional preferences: Necessary technical logs and security records, plus UI preferences and state (e.g., language, theme, onboarding state, checkout state) stored via cookies or browser storage.

Why we process data

• Provide and operate the service (accounts, organizations, exports, audit traceability)
• Secure the service and prevent abuse
• Provide support and communicate with users
• Manage subscriptions and billing (if applicable)
• Improve reliability and product quality using internal technical signals and logs

Hosting and service providers (sub-processors)

Our application, blog/CMS, and PostgreSQL database are hosted on our infrastructure in Frankfurt, Germany (Hostinger VPS).

• Hostinger (VPS hosting, Frankfurt, Germany): infrastructure hosting for the VM application, database, and blog/CMS.
• Stripe: subscription billing, billing portal, and payment-related events (webhooks).
• Resend: sending transactional and contact/support emails.
• Google Fonts: loading fonts on the web application (your browser connects to Google’s font CDN to download fonts).
• We do not use product analytics tools, session replay, or similar marketing tracking SDKs within the VM application based on the current implementation.

Cookies and local storage

• Maintain authentication sessions and security
• Store language and UI state (e.g., sidebar, theme)
• Maintain technical checkout state during payment flows

Data retention

We retain data only as long as necessary to provide the service and comply with legal obligations. After service termination, data is typically deleted or anonymized within a reasonable period unless longer retention is required (e.g., accounting or tax obligations).