Vager Marketing Privacy Notice.

1. Scope and roles

Vager Media operates Vager Marketing. This Notice covers vagermarketing.com, Vager Marketing accounts, the dashboard, and the customer websites Vager Marketing hosts.

For account, trial, billing, support, and product-usage data, Vager Marketing decides why and how the data is used. For a lead submitted on a customer's generated customer website, that customer decides why the lead is collected and used; Vager Marketing stores and delivers the lead on the customer's behalf as a service provider or processor. Lead submitters should contact the business shown on that customer website first. We will help the business respond when required.

2. Data we collect

• Account data: email address, authentication records, profile name if supplied, and account identifiers.
• Business data: your business idea, business name, optional phone number, answers and proof facts you provide, generated content, research, build records, and site configuration.
• Lead data: a lead's email address and, when supplied, phone number, requested service, message, source site, status, user agent, and a one-way hash of the submitting IP address for abuse prevention.
• Billing data: plan, subscription status, billing period, Stripe customer and subscription identifiers, and transaction events. Stripe processes full card details; Vager Marketing does not store them.
• Usage and device data: requests, timestamps, approximate network information, errors, security events, first-party acquisition segment, pages and product features used, client-error category and diagnostic reference, feedback, and related build status.
• Figma connector data: your Figma account identifier; authorized file and page identifiers and names; bounded color-style, font, text-style, and local color-variable metadata and resolved values; identifiers and plugin data for nodes Vager Marketing creates; connection scopes and status; design-job, approval, verification, and recovery receipts; and encrypted OAuth credentials.
• Communications: support requests, product feedback, and emails we send or receive.

Please do not submit government identifiers, payment-card details, health records, or other sensitive personal data in business prompts or lead forms.

Product diagnostics do not intentionally record authentication secrets, prompt or generated-content text, form-field values, raw keystrokes, screen recordings, or full browser error messages and stack traces. Feedback text is stored only when you deliberately submit it.

3. How we use data

• create and secure accounts and authenticate users;
• research, generate, review, publish, and maintain venture deliverables;
• capture leads for the applicable Vager Marketing customer and notify that customer;
• process subscriptions, prevent fraud and abuse, and keep transaction records;
• operate, debug, measure, and improve reliability and product experience;
• communicate about builds, accounts, billing, security, support, and material product changes; and
• comply with law and protect Vager Marketing, our users, and others.

Vager Marketing does not use a customer's captured leads for Vager Marketing's own marketing. We do not sell personal data and do not currently use personal data for cross-context behavioral advertising or profiling that produces legal or similarly significant effects.

4. AI and automated processing

Business prompts, supplied facts, research context, generated pages, and related instructions may be sent to AI and research providers so Vager Marketing can create and evaluate your deliverables. Automated systems classify the type of business, generate content and imagery, and run quality checks. They do not make decisions about employment, credit, housing, insurance, health care, education, criminal justice, or access to basic necessities.

Do not put personal data in a prompt unless it is necessary and you have the right to use it. Review generated output before publishing or relying on it.

Vager Marketing respects your workspace's data-retention policy when selecting models. Some models may be unavailable when their retention requirements do not match your organization's policy. Fable 5 requires a compatible 30-day retention policy and is not available to workspaces that require zero data retention. Vager Marketing will not weaken your policy to make a model available.

5. Google API data

If you connect Gmail, Vager Marketing requests permission to send email and read your mailbox. It uses this access to send the messages you authorize, verify uncertain sends, read replies and delivery reports related to your outreach, and stop follow-ups after replies, bounces, or opt-out requests. It stores your connected email address, granted permissions, encrypted OAuth credentials, saved outgoing messages, provider message and thread identifiers, and bounded reply or delivery-report excerpts. Mailbox access is not used to train a generalized AI model or to build advertising audiences.

If you connect Google Ads, Vager Marketing uses the advertising account access you grant to read accessible accounts, prepare and manage authorized campaigns, verify campaign settings, and retrieve performance and spend. It stores selected account identifiers, campaign configuration, authorization and execution records, encrypted credentials, and reporting observations needed for those features.

If you choose to connect Google Business Profile, Vager Marketing requests the business.manage OAuth permission. The current connection uses that permission to read the Business Profile accounts available to you and verify that the connection works. Vager Marketing stores the selected account identifier and name, the granted scope, verification time, and encrypted OAuth credentials. OAuth credentials are kept in Supabase Vault rather than in the application record. Vager Marketing does not currently read or store your Business Profile listings, reviews, or review replies.

Google user data is used only to provide the connected Google features visible in Vager Marketing that you request. We do not sell it, use it for unrelated advertising or credit decisions, or use it to train a generalized AI model. We disclose it only to service providers needed to operate the connection, when you direct us to do so, for security, or when required by law. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect Google Business Profile from the Integrations page. Vager Marketing then asks Google to revoke the grant, deletes its stored OAuth credentials, and clears the imported account identifier, name, scopes, and verification record. Local credential deletion still occurs if Google's revocation endpoint is temporarily unavailable. Deleting the owning Vager Marketing business or account also deletes the stored credentials. You may also request disconnection or deletion at benjamin@vagermedia.com.

5a. Advertising, social accounts, and automation

When you connect Meta advertising, Facebook Pages, or Instagram, Vager Marketing uses the permissions you grant to identify accessible accounts, prepare and publish authorized work, verify provider results, and retrieve available performance data. It stores selected account and Page identifiers, encrypted credentials, saved content and media, advertising configuration and spend, provider object identifiers, and authorization, publication, and recovery records.

Standing permissions record the accounts, audiences, destinations, and limits you choose. Automation checks these permissions before acting and records its decisions and outcomes. Pausing a permission prevents new dispatches; it does not recall work already accepted by an external service. You can manage connections and permissions in the dashboard and request data deletion at benjamin@vagermedia.com.

6. Figma connector data

If you choose to connect Figma, Vager Marketing uses OAuth 2.0 with PKCE and requests the current_user:read and file_content:read permissions. Those permissions verify your Figma identity and let Vager Marketing independently read back the exact generated node subtree after you approve and run a design job. The companion plugin exchanges a one-use pairing code for a random, revocable Vager Marketing session token; it does not contain a password, OAuth client secret, or Figma OAuth credential.

Vager Marketing stores the Figma account identifier, authorized file and page identifiers and names, bounded color-style, font, text-style, and local color-variable context, generated-node and plugin-data identities, job state, and approval, verification, and recovery receipts in tenant-scoped Supabase Postgres tables. Figma OAuth credentials are encrypted in Supabase Vault. The plugin stores its revocable Vager Marketing session token in figma.clientStorage and stores Vager Marketing target and document identifiers as plugin data only on the authorized page and nodes that Vager Marketing creates.

This data is available to the authenticated Vager Marketing account owner and Vager Marketing's server runtime under tenant-scoped authorization and row level security. Vager Marketing uses it only to plan, authorize, create, verify, reconcile, and support the design work you request. Bounded design context may be sent to the selected AI provider to prepare that work, as described in Section 4. Vager Marketing does not copy or retain your entire Figma file, sell Figma-derived data, or use it for advertising.

You can disconnect Figma from the Integrations page. Vager Marketing then destroys its encrypted Figma OAuth credentials and revokes active plugin sessions and authorized targets. If you also want to remove Figma's remembered authorization, remove Vager Marketing Connector from your connected apps in Figma. Approval, materialization, verification, security, and recovery receipts may remain while your account is active and as reasonably needed to provide, secure, and document the service. Deleting the owning Vager Marketing business or account deletes its connector records, subject to limited backups and legal obligations. You may also request disconnection or deletion at benjamin@vagermedia.com.

6a. Shopify connector data

If you connect Shopify, Vager Marketing requests read access to your product catalog and installed themes. The store view reads product names, statuses, price ranges, and theme names and roles directly from Shopify. This connector does not request orders, customer records, payment information, or permission to change your store. These catalog and theme reads are not sent to AI providers.

Vager Marketing stores your store identifier and name, granted permissions, connection status, verification metadata, and encrypted OAuth credentials. Access is scoped to the Vager Marketing business you choose and its authenticated owner. Temporary approvals awaiting account linking expire after one hour; maintenance removes expired approvals and their encrypted credentials. Product and theme results are read on demand rather than saved as a copy of your catalog.

Disconnecting immediately blocks Vager Marketing from using the connection. Vager Marketing then uninstalls its Shopify app and removes stored credentials, retrying if Shopify is temporarily unavailable. You can also uninstall Vager Marketing in Shopify Settings → Apps and sales channels; Shopify's signed uninstall notice removes the matching grant. Connection and security records may remain as described in Section 9. Contact benjamin@vagermedia.com for support or data deletion requests.

7. When we disclose data

We disclose data only as reasonably needed for the purposes above, including to:

• hosting, browser, and delivery providers, including Cloudflare;
• database and authentication providers, including Supabase;
• workflow providers, including Inngest;
• connected-service providers, including Figma and Google and Meta, when you choose to connect those services;
• email providers, including Resend;
• payment providers, including Stripe;
• AI, research, and image providers, including OpenAI, OpenRouter, Anthropic, Firecrawl, fal.ai, and Krea, depending on the work requested and providers enabled at the time;
• professional advisers and authorities when reasonably necessary to comply with law, enforce agreements, or protect rights and safety; and
• a buyer or successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality protections.

These providers may process data in the United States or other countries where they operate. Their privacy and security practices also govern their processing.

8. Cookies and similar technology

Vager Marketing uses essential cookies for secure authentication and session continuity. Campaign pages also use a first-party vager_seg cookie for up to 30 days to remember whether a visit came from a dreamer- or operator-focused page. We use that value for first-party attribution; it does not follow you across unrelated sites. Stripe and other service providers may use their own technology when you interact with their services.

If you accept optional analytics, we measure page visits, referral sources, campaign labels, device category, and selected actions such as requesting a sign-in link or opening checkout. A random visitor identifier is stored in your browser for up to 90 days; visits are grouped into sessions that end after 30 minutes of inactivity. Your analytics choice is also stored in your browser. You can change it using Analytics settings on the site.

These measurements are sent to Vager Media's collector hosted at designpeach.co. We do not send form contents, authentication tokens, account identifiers, or full URLs with query strings to that collector. Optional analytics do not run before you accept or after you decline.

Customer websites can separately record first-party visits and campaign events for the business that operates the site. The generated measurement script uses random event identifiers, sends requests without browser credentials, and does not set a visitor cookie. This customer-site measurement is separate from the optional application analytics described above. The site owner is responsible for its own notice and any required consent.

9. Retention and deletion

We retain account and business data while your account is active and as reasonably needed to provide the service. We may retain billing, security, dispute, and compliance records for longer where required or justified. Captured lead data is retained on the customer's behalf until the customer deletes it, closes the account, or asks us to delete it, subject to limited backups and legal obligations.

When data is no longer needed, we delete or de-identify it using commercially reasonable processes. Backup copies may remain for a limited period before they are overwritten.

Page, feature, and client-error diagnostic events are ordinarily deleted after 90 days. Deliberately submitted feedback, security records, and build or billing records may be kept longer when needed to operate, improve, secure, or document the service.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal data, including access controls, scoped service credentials, authentication, rate limits, and provider security controls. No internet service can guarantee absolute security. Contact us promptly if you believe data or an account has been compromised.

11. Your choices and privacy rights

Depending on where you live, you may have rights to know whether we process your personal data, access it, correct it, delete it, obtain a portable copy, opt out of certain sale, targeted-advertising, or profiling uses, and appeal a denied request. We do not discriminate against you for exercising a privacy right.

Send a request or appeal to benjamin@vagermedia.com. Tell us the email connected to your account and the request you are making. We may need to verify your identity or authority before acting. An authorized agent may make a request where applicable law permits. Because Vager Marketing does not currently sell personal data or use it for targeted advertising, there is no separate sale or targeted-advertising opt-out to activate today.

12. Children

Vager Marketing is for adults and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child submitted data, contact us so we can investigate and delete it. Users must be at least 18 to create an account under our Terms.

13. Changes and contact

We may update this Notice as the product, providers, or law changes. We will post the new date and give additional notice when a change materially affects how we use personal data.

Privacy questions, requests, or appeals: benjamin@vagermedia.com.