Privacy Policy

01Data Controller

The "Data Controller" responsible for your personal data under the GDPR and other applicable privacy laws is:

02Scope & Definitions

This Privacy Policy applies to personal data collected through:

• The website exitblueprint.io and any subdomain we operate, hosted on Netlify, Inc.
• Email subscriptions, lead-magnet downloads (free PDF e-book and Notion template), and other forms hosted on the website, managed via MailerLite
• Purchases of our digital products and Top-Up Packs processed through Lemon Squeezy (our Merchant of Record) checkout
• The Vantage Suite at vantagesuite.xyz, our AI-powered web application, including account creation, passwordless magic-link sign-in, Credits and Product Runs, and Fair-Use Tools, with authentication and application data managed via Supabase (database hosted in West US (Oregon), United States, AWS region us-west-2), application servers hosted on Fly.io in Frankfurt, Germany, and AI processing performed by Anthropic
• Automated product and access delivery after purchase, handled via MailerLite
• Invoice creation and accounting records managed via SuperFaktúra
• Email correspondence sent to or from vantage@exitblueprint.io (hosted on Hostinger hMail).

Key terms

• Personal data → any information relating to an identified or identifiable natural person (e.g., name, email, IP address).
• Processing → any operation performed on personal data (collection, storage, use, disclosure, deletion).
• Controller → the entity that determines the purposes and means of processing (us).
• Processor → a third party that processes personal data on our behalf and under our documented instructions (e.g., MailerLite, Supabase, Netlify).
• DPA → Data Processing Agreement, a written contract between us and a processor specifying responsibilities, security measures, and sub-processor rules, required by Art. 28 GDPR.
• SCC → Standard Contractual Clauses, standard clauses adopted by the European Commission (Decision 2021/914) used to lawfully transfer personal data to non-EEA countries.
• DPF → EU-US Data Privacy Framework, an adequacy decision adopted by the European Commission on 10 July 2023 (Decision C(2023) 4745) that allows transfers to certified US organisations without additional safeguards.
• You → any visitor, subscriber, or customer interacting with our website or services.

03Data We Collect

We collect only the data we need to operate the website, deliver our products, and communicate with you. We do not buy email lists, scrape data, or process special categories of personal data (e.g., health, religion, biometrics).

3.1 What the Vantage Suite stores, table by table

So you can see exactly what exists about you, this is the complete inventory of the Vantage Suite application database (hosted on Supabase, in the West US (Oregon) region of the United States, AWS us-west-2):

We do not store payment-card data, passwords, or IP addresses in this database. Authentication is passwordless, based on one-time magic links sent to your email address.

3.2 What is sent to our AI provider, and what is not

When you run a generation, the text you typed into the input fields is transmitted to Anthropic so the AI model can produce your Output. To keep this minimal:

• Your account email address is not sent to Anthropic. Neither is your Account identifier, your Tier, your Credit balance, your billing data, or your payment information. The AI provider receives the content of your brief, not your identity.
• Only the specific fields relevant to the generation you requested are transmitted, together with our own system instructions.
• Input fields are length-limited, ranging from roughly 600 to 30,000 characters depending on the field, which caps how much text can ever leave our systems in a single request.
• Anthropic processes this data as our processor under its commercial terms and does not use it to train its models.

04How We Use Your Data

We use your personal data only for the specific purposes listed below. We do not sell your data, and we do not use it for purposes incompatible with the original purpose of collection.

4.1 Delivering the lead magnet

When you submit your email to receive the free PDF e-book, the Notion template or MODULE ZERO, we use your email address for one thing: to send you the file you asked for, via a MailerLite automation.

What happens next depends on that second box:

• If you did not tick it, we simply send the file. There is no confirmation step, because there is no subscription to confirm, and we add you to no marketing audience.
• If you ticked it, we first send a double opt-in confirmation message. Only after you click the link in it do we send the file and add you to the newsletter audience.

4.2 Email marketing & product education

If you gave marketing consent and confirmed it via double opt-in, we send you:

• Educational and onboarding emails about our digital products and the topics they cover.
• Promotional offers, discounts, launches, and announcements.
• Occasional newsletter content related to faceless digital business, content systems, and product creation.

Every marketing email contains a one-click unsubscribe link. You can withdraw consent at any time, free of charge, with no negative consequences. Withdrawing marketing consent does not take away any file you already received, and it does not affect your Vantage Suite Account, your Tier, or your Credits.

Because these are two different audiences held separately in MailerLite, unsubscribing from marketing does not delete your record where we still need it for something else (for example your Tier entitlement). If you want your data erased outright rather than just unsubscribed, use your Art. 17 right in Section 11.

4.3 Selling and delivering digital products

When you purchase a product or Top-Up Pack, we use your data to process the payment via Lemon Squeezy (our Merchant of Record), trigger the automated product and access delivery email via MailerLite, provide customer support, generate invoices via SuperFaktúra, and meet our tax and accounting obligations under Slovak and EU law.

4.4 Operating the Vantage Suite

When you use the Vantage Suite, we process your Account data to (a) create and authenticate your Account via passwordless magic-link sign-in (Supabase), (b) determine your Tier and the features available to you, (c) track and enforce your Credit balance, Product Runs, and Fair-Use Tool limits, (d) store and return the work you save, and (e) provide customer support. This processing is necessary to perform our contract with you (Art. 6(1)(b) GDPR).

Your entitlement Tier is determined by your record in MailerLite, which is our source of truth for what you purchased. When you sign in, the Suite checks your email address against that record to establish whether you hold FREE, CORE, or MASTER access. This is why your Suite email address must be the same address you purchased with.

Creating a Vantage Suite Account does not by itself subscribe you to our marketing emails. Suite users and newsletter subscribers are kept as separate audiences in MailerLite. We will only send you marketing emails if you give a separate, double opt-in marketing consent, and you can withdraw it at any time via the unsubscribe link.

4.5 AI-powered features

When you use an AI-powered feature, the text you submit is sent to Anthropic, which processes it on our behalf to generate the requested Output and return it to you. We use this data only to provide the feature to you. We do not use your inputs or Output to train or fine-tune AI models, and Anthropic processes the data as our processor under its commercial terms, which do not use submitted data to train its models. Your account email address is not sent to Anthropic. The legal basis is performance of our contract with you (Art. 6(1)(b) GDPR). See Section 3.2 for the full detail of what is and is not transmitted.

4.5a AI-generation marking

Assets generated by the Suite carry a machine-readable marking in their file metadata identifying them as artificially generated, in line with Article 50(2) of Regulation (EU) 2024/1689 (the EU AI Act). This marking describes the file, not you. It does not contain your email address, your Account identifier, or any other personal data about you.

4.6 Operating, securing, and improving the website

We use technical data from Netlify server logs, our security and delivery layer (Cloudflare), and, where you consent, Google Analytics 4 to keep the site running, prevent fraud and abuse, mitigate attacks, fix bugs, and understand which content is most useful so we can improve it.

4.7 Legal compliance

We process and retain certain data to comply with applicable Slovak and EU laws, including the Accounting Act, VAT Act (EU OSS for cross-border digital sales), and consumer-protection rules.

05Legal Basis for Processing (GDPR)

Under Article 6 of the GDPR, we rely on the following legal bases:

06Sharing & Third-Party Processors

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We share data only with carefully selected service providers acting as processors under written Data Processing Agreements (see Section 07).

6.1 Processor overview

6.2 Other disclosures

We may also disclose personal data:

• To tax authorities, accountants, or legal advisors where required by law or to defend our legal rights.
• To law enforcement or courts in response to a valid, documented legal request.
• To a successor entity in the event of a sale, merger, or acquisition, in which case you will be notified and your rights preserved.

07Data Processing Agreements, SCCs & DPF

Under Article 28 of the GDPR, every processor we engage must sign a Data Processing Agreement (DPA) that obliges them to process data only on our documented instructions, maintain appropriate technical and organisational security measures, assist us in fulfilling data-subject rights, delete or return data upon termination, and make available all information necessary to demonstrate compliance.

For transfers of personal data to countries outside the European Economic Area (EEA), we rely on one or more of the following legally recognised transfer mechanisms:

• EU-US Data Privacy Framework (DPF) → adequacy decision adopted by the European Commission on 10 July 2023 (C(2023) 4745), allowing transfers to certified US organisations without further safeguards. The DPF list is maintained by the US Department of Commerce at dataprivacyframework.gov.
• Standard Contractual Clauses (SCCs) → module-specific clauses adopted by the European Commission via Implementing Decision (EU) 2021/914 of 4 June 2021. We use Controller-to-Processor (Module 2) SCCs with all non-EEA processors.
• Adequacy decision → where the European Commission has determined that a third country provides an essentially equivalent level of protection (e.g., UK under the adequacy decision of 28 June 2021).

7.1 DPA and transfer mechanism per processor

7.2 UK residents

For residents of the United Kingdom, the UK adequacy regulations recognise the EU as providing adequate protection (and vice versa under the EU-UK adequacy decisions of 28 June 2021). Transfers from the UK to processors in the US are covered by the UK International Data Transfer Agreement (IDTA) and/or UK Addendum to EU SCCs, incorporated into the relevant processor DPAs. The UK's equivalent of the DPF is the UK Extension to the DPF, for certified US organisations.

7.3 Swiss residents

Switzerland is recognised as providing adequate protection under EU Commission adequacy decisions. For transfers from Switzerland to the US, we rely on SCCs adapted for Switzerland per the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the Swiss-US Data Privacy Framework.

08International Transfers, Summary

The following processors involve transfers of personal data outside the EEA:

Hostinger (hMail) and SuperFaktúra process data within the EU only. Our Vantage Suite application servers on Fly.io are pinned to Frankfurt, Germany, so that processing takes place inside the EEA, although Fly.io is a US-incorporated company and SCCs cover any US administrative access.

We continuously monitor changes to transfer mechanisms and update our arrangements as required. If the legal basis for any transfer is invalidated by a court or supervisory authority, we will suspend the transfer and notify you.

09Retention Periods

We keep personal data only as long as necessary for the purposes described in this policy, and then either delete it or anonymise it.

9.1 Why Suite data is kept for as long as your Account exists

We deliberately do not auto-delete your Vantage Suite work after a fixed period. The reason is that your Account is your library. You paid a one-off price for access, your Credits never expire, and the guides, ideas, and assets you have generated are the thing you bought. Deleting them on a timer would destroy the value of the purchase and would surprise you in a way that is worse, not better, for your rights.

Retention is therefore tied to your decision, not to a clock. Your data stays for as long as you keep the Account, and goes the moment you delete it. This satisfies the storage-limitation principle in Art. 5(1)(e) GDPR, because the retention period is defined by the purpose (giving you continued access to what you purchased) and you can end it yourself at any time in one click.

9.2 Self-service export and deletion

You do not need to email us or wait 30 days to exercise these rights. Both are built into the Suite, under Account:

9.3 Backups, restoration, and the honest state of it

Article 32(1)(c) GDPR asks us to have "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident." Article 32(1) also says the measures we take must be appropriate to the risk, judged against the state of the art, the costs of implementation, and the nature and scope of what we process. This section sets out our position against that standard, plainly, including the part that is not flattering.

What we currently do and do not have

Our Supabase project currently runs on a plan that does not include restorable snapshot backups or point-in-time recovery. The database itself runs on our provider's managed, redundant infrastructure, so it is not sitting on a single unprotected disk, but to be exact about the distinction that matters: we do not presently hold a backup we could restore your Account from if the database were destroyed or corrupted. We are a newly launched sole-trader business and this reflects what we can currently fund, not a view that backups are unnecessary.

The two consequences, one good and one not

• In your favour. When a record is deleted it is deleted from the only copy that exists. There is no nightly snapshot and no archive in which your data quietly survives for weeks after you asked us to erase it. Your Article 17 erasure is genuinely immediate and complete, which is more than many services can honestly say.
• Against you. We cannot restore your work if you delete it by mistake, and we could not reconstruct it after a catastrophic failure at our provider. There is no recycle bin and no support ticket that recovers it.

How we compensate for this in the meantime

• You hold the restorable copy. EXPORT VAULT gives you, at any time and free of charge, a complete zip of everything you have created in readable Markdown. Restoration capability exists, it simply sits with you rather than with us. Run an export periodically, not only before deleting, and keep it somewhere you control.
• There is very little to lose. We deliberately hold no passwords, no payment-card data and no IP addresses in this database, and your invoices, purchase records and Tier entitlement live outside it, with Lemon Squeezy, SuperFaktúra and MailerLite. A total loss of the Suite database would not expose or destroy your financial or identity records, and would not erase proof of what you purchased.
• Encryption and access control as described in Section 14 continue to apply to the live database.
• Availability of the Service itself is a separate commitment and is unaffected, see Section 11.7 of our Terms & Conditions.

If this position is not acceptable to you, that is a legitimate reason not to create an Account, and we would rather you knew before you paid than after. If you have already purchased and this changes your mind, contact us at vantage@exitblueprint.io.

10Cookies & Similar Technologies

A cookie is a small text file placed on your device by a website. We also use web storage (localStorage) for non-tracking purposes such as storing your consent preferences. Below is a complete list of all cookies and web storage items we use.

10.1 Strictly necessary, web storage

These are required for the core functioning of the site and our consent management system. They are set without consent and cannot be disabled without preventing the site from working as intended.

Vantage Suite local storage

The Suite keeps some working data in your own browser rather than on our servers. This data never leaves your device unless and until it is synced to your Account. It is strictly necessary for the Suite to function and is not used for tracking.

You can clear all of this at any time by clearing your browser's site data for the Suite. Doing so will sign you out and discard any locally held work that has not yet synced to your Account.

10.2 Analytics cookies, requires consent

These cookies are set by Google Analytics 4 (GA4) and are loaded only after you click "Accept All" or enable Analytics in Cookie Settings. If you click "Reject All", none of these cookies are ever set.

10.3 No marketing or advertising cookies

We currently set no advertising, retargeting, or cross-site tracking cookies (e.g., Meta Pixel, TikTok Pixel, Google Ads). If we add any such cookies in the future, they will appear in this table, require explicit opt-in via the cookie banner, and be loaded only after you consent.

10.4 Managing your cookie preferences

You can change your cookie and tracking preferences at any time using the following methods:

• Cookie banner → shown on your first visit. Use "Accept All", "Reject All", or "Settings" for granular control.
• Cookie Settings link → available in the footer of every page. Clicking it reopens the Settings modal so you can update your choices at any time.
• Browser settings → you can block or delete all cookies via your browser settings. Note: blocking strictly necessary items (like localStorage) may prevent consent preferences from being remembered.
• Google Analytics opt-out → you can also install the Google Analytics Opt-out Browser Add-on as an additional layer of control.

Refusing non-essential cookies does not affect your ability to access or use the website or purchase our products.

11Your Rights Under the GDPR

If the GDPR applies to you (e.g., you are in the EEA, UK, or Switzerland), you have the following rights:

• Right of access (Art. 15) → to know what personal data we hold about you and to receive a copy.
• Right to rectification (Art. 16) → to correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17) → to request deletion of your data, subject to legal retention obligations (e.g., invoices must be kept 10 years).
• Right to restriction of processing (Art. 18) → to limit how we process your data in certain situations.
• Right to data portability (Art. 20) → to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) → including the absolute right to object to direct marketing at any time, without needing to give a reason.
• Right to withdraw consent (Art. 7(3)) → at any time, without affecting prior lawful processing.
• Right not to be subject to automated decision-making (Art. 22) → see Section 15.
• Right to lodge a complaint with a supervisory authority, see Section 17.

To exercise any other right, email vantage@exitblueprint.io with the subject line "GDPR request". We will respond within 30 days, free of charge in most cases (Art. 12 GDPR). We may ask for proof of identity to make sure the request is genuine and to protect your data.

12California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"):

• Right to know → what categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we share it with.
• Right to delete → request deletion of personal information we hold about you, subject to legal exceptions.
• Right to correct → request correction of inaccurate personal information.
• Right to opt out of sale or sharing → we do not sell personal information and we do not share it for cross-context behavioural advertising. There is therefore nothing to opt out of. If this changes, you will be notified and provided with a "Do Not Sell or Share My Personal Information" link.
• Right to limit use of sensitive personal information → we do not collect sensitive personal information as defined under the CCPA.
• Right to non-discrimination → we will not deny services, charge different prices, or provide a lesser quality of service because you exercised your rights.

Categories collected in the last 12 months (CCPA disclosure)

• Identifiers (name, email, IP address)
• Commercial information (purchase history)
• Internet / network activity (browsing, page views, interactions, analytics only with consent)
• Geolocation (approximate, country/region only)
• Inferences drawn from the above (e.g., topic interests for email segmentation)

To exercise your California rights, email vantage@exitblueprint.io with the subject line "CCPA request". You may also designate an authorised agent to make a request on your behalf, subject to verification. We respond within 45 days (extendable by a further 45 days with notice).

13Children's Privacy

Our website and products are intended for adults pursuing entrepreneurial and professional goals. We do not knowingly collect personal data from children under 16 years of age (or the equivalent minimum age under your local law, e.g., 13 under COPPA in the US). If you believe a child has provided us with personal data, contact us at vantage@exitblueprint.io and we will delete it promptly.

14Data Security

We apply technical and organisational measures appropriate to the risk, including:

• HTTPS / TLS encryption for all data transmitted between your browser and our website (enforced by Netlify's infrastructure).
• Strong, unique passwords and two-factor authentication on all critical accounts (Netlify, Cloudflare, Supabase, MailerLite, Lemon Squeezy, SuperFaktúra, Google, Hostinger).
• Passwordless authentication for the Vantage Suite via Supabase magic-link sign-in, no passwords are created or stored.
• Reputable processors with industry-standard certifications, Lemon Squeezy (PCI-DSS compliant payment partners), Supabase (SOC 2 Type II), Cloudflare (SOC 2 Type II, ISO 27001), MailerLite (SOC 2 Type II), Netlify (SOC 2 Type II), Google (ISO 27001, SOC 2, SOC 3), Hostinger (ISO 27001), Anthropic (SOC 2 Type II), Fly.io (SOC 2 Type II).
• Pinned hosting regions → the Vantage Suite backend runs on Fly.io machines pinned to the Frankfurt, Germany region, and our Supabase database is pinned to the West US (Oregon) region (AWS us-west-2). Neither floats between regions, so we can always tell you where your data is. See Section 08.
• Encryption at rest → the Suite database is encrypted at rest by Supabase, and all traffic between your browser, our application servers, and the database travels over TLS.
• Data minimisation by design → we do not store passwords, payment-card data, or IP addresses in the Suite database, and your account email address is never transmitted to our AI provider.
• Input length limits → Suite input fields are capped at between roughly 600 and 30,000 characters, limiting how much data can ever be submitted in a single request.
• Access control → access to personal data is limited to the controller and authorised processors on a strict need-to-know basis.
• Regular review of access rights, software updates, dependency patches, and security practices.

Despite these measures, no method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by Art. 33 GDPR, and notify you without undue delay where required by Art. 34 GDPR.

15Automated Decision-Making & Profiling

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing (Art. 22 GDPR). Basic automation used in our operations includes:

• Sending the lead-magnet email automatically when you confirm your subscription via double opt-in (MailerLite).
• Triggering the product delivery email automatically after a confirmed purchase (MailerLite).
• Segmenting subscribers by topic interest or purchase status in MailerLite to send relevant content.
• Generating AI Output in the Vantage Suite (via Anthropic) in response to inputs you submit. This produces content for you to review and use at your discretion, it does not make any decision about you, your rights, or your access.
• Granting your Tier and Credits automatically when a purchase webhook is received from Lemon Squeezy, and automatically deducting Credits when you run a generation. These are arithmetic entitlement calculations based on what you paid for, not an assessment of you as a person.
• Automatically applying fair-use and free-tier limits when a counter is reached.

These automations are used for operational efficiency and content relevance only. They do not evaluate, profile, or score you in any way that affects your legal rights, access to services, or price paid.

15.1 Decisions about your Account are reviewed by a human

Where we warn, throttle, suspend, or terminate an Account for suspected misuse, the decision is not made solely by automated means. Automated signals may flag unusual usage for review, but the decision to restrict an Account is taken by a person. You also have an express right to contest any such decision and obtain human re-review, set out in Section 16.4 of our Terms & Conditions.

15.2 You are interacting with an AI system

In accordance with Article 50(1) of Regulation (EU) 2024/1689 (the EU AI Act), we inform you clearly that the Vantage Suite is an artificial-intelligence system and that the assets it produces are generated by AI, without human review. Assets are also marked as artificially generated in their file metadata under Art. 50(2), see Section 4.5a.

16Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other reasons. The "Last updated" date at the top of this page indicates when the policy was last revised.

If changes are material, we will notify you in advance, for example, by email to subscribers or via a prominent notice on the website, and, where required by GDPR, ask for fresh consent. Your continued use of the website after the effective date constitutes acceptance of the updated policy.

17Contact & Complaints

For any privacy-related question, request, or complaint, contact us first, we aim to resolve all concerns directly and will respond within 30 days:

Right to lodge a complaint

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with a data protection supervisory authority at any time, you do not need to contact us first, though we encourage it. The competent authority for our establishment is:

EEA residents may alternatively lodge a complaint with the supervisory authority in their country of habitual residence or place of work (Art. 77 GDPR).

UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

California residents may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov or the California Attorney General's Office.