Privacy Policy

Data Controller

Vector Vesper provides a library of React motion components. We act as the data controller for the personal information described on this page. For inquiries regarding data protection and compliance, contact support@vectorvesper.dev.

Information We Collect

We collect only the telemetry and account records necessary to provide service functionality and authentication:

• Email address: Used for authentication, receipt delivery, and license entitlement verification.
• Optional profile metadata: Display name, headline, username, website URL, and avatar image. Fully editable and erasable via account settings.
• Component favorites: Identifiers of components saved to your account library.
• CLI telemetry: Timestamps and component identifiers downloaded via the CLI, displayed in your account activity history.
• CLI access tokens: User-defined token labels, creation timestamps, and last-used metadata. Raw tokens are hashed using cryptographic one-way functions prior to storage and cannot be retrieved.
• Transaction records: Transaction amounts, currency codes, order timestamps, and payment provider order references.

Payment Processing and Third-Party Isolation

Payment credentials: Credit card numbers and payment instruments are processed directly by Lemon Squeezy acting as merchant of record. Payment details are entered into their PCI-compliant checkout infrastructure and never traverse or reside on our servers; we receive only the transaction amount, currency code, and external order identifier.

We do not acquire third-party broker data, do not sell or monetize user information, and execute no cross-site advertising trackers.

Cookies and Telemetry

We set essential session cookies only upon authentication. These cookies maintain encrypted session tokens and authentication refreshes; without them, account sessions cannot function. We deploy no tracking, retargeting, or third-party marketing cookies.

Web analytics are cookieless and persist no client-side state. Event telemetry captures page routes, interaction targets, referring domains, and coarse geographic regions (city and country level). Visitors are indexed via rotating anonymous daily hashes rather than persistent tracking identifiers. Raw IP addresses are processed in volatile memory at the edge for geographic derivation and discarded without disk persistence. We do not perform session replay or DOM recording.

Subprocessors and Infrastructure

Vector Vesper engages the following service providers to deliver hosting, authentication, and processing capabilities:

• Supabase: Authentication infrastructure, PostgreSQL database storage, and avatar media storage.
• Vercel: Edge application hosting, serverless execution, and edge-level geographic derivation.
• Resend: Transactional email delivery for signup confirmations, verification links, and password resets.
• PostHog: Cookieless, privacy-preserving product analytics for page views and aggregate navigation flows.
• Lemon Squeezy: Merchant of record handling payment gateway processing, global tax compliance, and billing management.
• Kit: Opt-in newsletter delivery for release announcements. Subscription is decoupled from account registration.

Data Retention and Erasure

Account data persists until account termination. Initiating account deletion executes an immediate, irreversible cascading purge across database profiles, stored avatars, token hashes, favorites, and local transaction references.

Lemon Squeezy retains statutory transaction records independently in accordance with international tax, accounting, and anti-fraud compliance requirements. Deleting your Vector Vesper account does not erase their merchant-of-record ledger entries.

Data Subject Rights

• Access: Inspect all stored account data directly via your account dashboard.
• Rectification: Modify profile metadata, account details, and display parameters at any time.
• Erasure: Trigger immediate, self-service account deletion within Account Settings with no mandatory waiting period.
• Data Portability: Request an export of your account and install history by emailing support.

If holding an active recurring subscription, cancel billing before initiating account deletion to prevent external billing cycles from persisting.

Changes

We may update this policy to reflect operational changes or statutory compliance updates. The revision date at the top of this document indicates the effective date of the current policy.