Privacy Policy

Effective Date: September 17, 2026 Entity: Adam Matar d/b/a VibeHard Scope: Commercial B2B Services

This Privacy Policy describes how Adam Matar, doing business as VibeHard ("VibeHard", "we", "us", or "our"), collects, uses, processes, and protects information in connection with our website (https://vibehard.ai), automated discovery instruments, commercial communications, and enterprise software engineering and hosting services (collectively, the "Services").

1. Commercial Business-to-Business Scope

VibeHard provides autonomous departmental workflow engineering, dedicated server orchestration, and ongoing Site Reliability Engineering (SRE) maintenance services exclusively to commercial business entities. We do not market or sell services to individual consumers, and we do not knowingly collect personal consumer data for marketing or behavioral advertising purposes.

2. Information We Collect

We collect information necessary to evaluate commercial requirements, deliver engineering services, process billing, and maintain system health:

A. Information You Provide Directly

Commercial Inquiries & Contact Details: When you submit an inquiry, request technical scoping, or communicate with us via email or web chat, we collect your business name, business email address, corporate telephone number, title, and operational system details.
Billing and Financial Records: Payment processing is handled directly through our PCI-DSS Level 1 certified payment processor (Stripe, Inc.). VibeHard does not process, store, or have access to raw credit card numbers or banking passwords. We receive transaction metadata (e.g., payment confirmation, billing address, and transaction IDs) for accounting and invoice reconciliation.

B. Information Collected Automatically Through Operations

Operational Telemetry & System Logs: When operating dedicated instances and private container environments, our monitoring systems automatically record diagnostic metadata, including system resource consumption, uptime logs, error recovery traces, and API response latencies. This telemetry is collected solely to maintain system availability, ensure security, and fulfill our SRE maintenance commitments.
Website & Technical Usage Data: When you access our public website, standard web server logs may automatically record your IP address, browser user-agent, operating system, and timestamp data for site security and rate-limiting purposes.

3. How We Use Information

We use commercial and technical information strictly for legitimate business purposes:

To engineer, stage, deploy, and maintain custom workflow automation architectures as agreed under applicable Statements of Work.
To monitor infrastructure performance, resolve technical exceptions, and maintain system availability under our SRE retainer.
To process invoices, milestone payments, and maintain statutory corporate tax and accounting records.
To communicate with Customer personnel regarding project milestones, architectural updates, and technical notifications.
To detect, prevent, and mitigate security threats, fraud, and unauthorized system access.

4. Data Processing Architecture & Artificial Intelligence APIs

4.1 Customer Data Sovereignty. Customer maintains full ownership of all business records, transaction ledgers, database entries, and customer communications processed within Customer's dedicated execution environment ("Customer Data").

4.2 Zero Public Model Training. VibeHard does not sell, rent, monetize, or disclose Customer Data to third parties. Customer Data submitted to dedicated customer instances is never used by VibeHard to train or fine-tune public foundation artificial intelligence models.

4.3 Third-Party Artificial Intelligence APIs. To perform automated document extraction, text summarization, or computational reasoning, automated workflows may route payload data to independent third-party model providers (e.g., OpenAI LLC, Anthropic PBC, Google LLC, DeepSeek AI) via enterprise Application Programming Interfaces (APIs). All API transmissions occur over encrypted Transport Layer Security (TLS 1.3). Data processed via these APIs is subject to the respective provider’s enterprise developer terms and data retention policies.

5. Disclosure of Information

We share information only with trusted third parties necessary to deliver our Services:

Payment Processors: Stripe, Inc., for secure credit card and ACH direct debit transaction processing.
Cloud Infrastructure Providers: Independent cloud data centers (e.g., Hostinger KVM VPS, Hetzner, AWS) and network routing platforms (Cloudflare) that provide the underlying compute, storage, and networking hardware for dedicated customer instances.
Professional Advisors: Legal counsel, certified public accountants, and financial auditors as necessary to comply with legal, tax, and regulatory obligations.
Legal & Compliance Disclosures: We may disclose information if required to do so by applicable federal or state law, subpoena, court order, or official governmental inquiry.

6. Data Security and Technical Safeguards

We enforce rigorous technical and organizational security measures to protect commercial data:

Perimeter and Runtime Isolation: Deployments utilize single-tenant Linux container virtualization with isolated internal networking, preventing cross-tenant data commingling.
Encryption Standards: All data in transit across public networks is encrypted using TLS 1.3. Credentials, access tokens, and sensitive keys are encrypted at rest using industry-standard cryptographic tools (such as Mozilla SOPS and age X25519 cryptography).
RAM-Centric Execution: Transactional payloads, parsed PDFs, and temporary extraction artifacts are processed in volatile memory and purged upon completion of the workflow execution cycle.

7. Data Retention

We retain commercial contact details, billing transaction logs, and operational relationship records only for as long as necessary to fulfill the commercial purposes outlined in this Privacy Policy, satisfy our contractual obligations under active Master Services Agreements, and comply with mandatory United States statutory accounting and tax retention periods.

8. Geographic Scope & Regulated Data Restrictions

8.1 United States Commercial Jurisdiction. VibeHard provides services exclusively within the United States under standard United States commercial law. We do not market or offer services to individuals located in the European Economic Area (EEA), European Union, or United Kingdom, and our services are not intended to process personal data subject to the General Data Protection Regulation (GDPR).

8.2 Prohibited Data Categories. Clients are contractually prohibited from submitting Protected Health Information (PHI) under HIPAA, unredacted payment cardholder data under PCI-DSS, or defense technical data under ITAR through our automated workflows, unless expressly governed by a separate, fully executed compliance agreement.

9. Your Rights and Choices

Customer business representatives may request access to, correction of, or deletion of their commercial contact information by contacting us in writing. Upon termination of active services, Customer may request a complete export of Customer Data stored within Customer’s dedicated environment in standard open formats (such as SQL dumps or JSON exports) pursuant to the terms of the applicable Master Services Agreement.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications in our operational practices, infrastructure architecture, or legal requirements. Updated versions will be posted to our public website with a revised Effective Date. Continued use of our website or services after any modification constitutes acknowledgment of the updated policy.

11. Contact Information

If you have any questions, comments, or notices regarding this Privacy Policy or our data handling practices, please contact:

Entity: Adam Matar d/b/a VibeHard
Email: adam@vibehard.ai
Website: https://vibehard.ai
Jurisdiction: State of Oregon, United States