Who we are
MB Vervidus (“we”, “us”, “our”) operates vervidus.com and is the data controller for the personal information described in this policy.
Contact us for privacy questions: click here.
We are established in the [EU/EEA], and we sell to customers in the United States, United Kingdom, Canada, the European Union and elsewhere.
What we collect
Information you give us
When you buy a digital product:
- First name and last name
- Email address (required — this is how your download link and receipt are delivered)
- Billing country (required for tax purposes — see section Why we collect it)
- Payment details
We do not see or store your full card number. Card details are entered directly into Stripe’s payment form and processed by Stripe. We receive only a confirmation, the last four digits, the card brand, and a transaction reference.
When you subscribe to our newsletter:
- First name (required)
- Email address
You can unsubscribe at any time using the link at the bottom of every email. Once you unsubscribe, we stop sending you marketing emails. We keep a minimal suppression record (your email address and the fact that you opted out) so that we do not accidentally email you again.
When you contact us:
- Your name, email address, and whatever you choose to include in your message.
Information collected automatically
When you visit the site, our analytics providers and we may collect:
- IP address (truncated/anonymised by Google Analytics 4 before storage)
- Browser type, device type, operating system, screen size
- Pages viewed, time on page, referring website, search terms that led you here
- General location inferred from IP (country, region, city level — not a precise location)
- Cookies and similar identifiers (see section Cookies and tracking)
We do not use this information to identify you personally.
What we do not collect
- We do not knowingly collect information from anyone under 16.
- We do not collect special category data (health, religion, political opinions, biometrics, etc.).
- We do not ask for or store your postal address, phone number, or date of birth.
Why we collect it, and our legal basis
| What we do | Why | Legal basis (GDPR / UK GDPR) |
| Process your order and deliver your download | To give you the product you paid for | Performance of a contract |
| Send your receipt and download link | Same as above | Performance of a contract |
| Record your name, email, and billing country on an invoice | Tax and accounting law requires it | Legal obligation |
| Determine the correct VAT/sales tax based on your country | Tax law requires it | Legal obligation |
| Send you our newsletter | So you receive the content and offers you signed up for | Consent (you can withdraw it any time) |
| Answer your emails and provide support | To help you | Legitimate interests/performance of a contract |
| Analytics and site improvement | To understand what is useful and fix what isn’t | Consent (for cookies) and legitimate interests |
| Detect and prevent fraud and abuse | To protect the business and our customers | Legitimate interests / legal obligation |
Note on billing country: we are legally required to collect and keep evidence of the country where you are located when you buy a digital product. This is not optional, and we cannot remove it from checkout.
Who we share it with
We share personal information only with service providers who process it on our behalf, under contract, and only for the purposes described above. Each is listed here with a link to their own privacy policy.
| Provider | What they do for us | What they receive | Their policy |
| Stripe | Payment processing | Name, email, billing country, payment details, transaction data | stripe.com/privacy |
| Easy Digital Downloads (EDD) | Store, checkout, order records, file delivery — runs on our own website | Name, email, billing country, order history | easydigitaldownloads.com/privacy-policy |
| Omnisend | Email marketing and automated emails | Name, email, subscription status, email opens, and clicks | omnisend.com/privacy |
| Google Analytics 4 / Google Tag Manager | Website analytics and tag management | Anonymised IP, device and browsing data, cookie identifiers | policies.google.com/priv |
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months. We do not rent, trade, or hand over your email address to any third party for their own marketing.
We may disclose information if legally required to do so — for example in response to a court order, a tax authority request, or a lawful request from a public authority.
International data transfers
We are based in the [EU/EEA]. Some of our service providers — including Stripe and Google — store or process data in the United States and other countries outside the EEA and UK.
Where personal information leaves the EEA or UK, it is protected by one or more of the following:
- The EU–US Data Privacy Framework and its UK extension, where the provider is certified;
- Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum where relevant);
- Additional technical and organizational safeguards applied by the provider.
You can request a copy of the relevant safeguards by emailing info[at]vervidus.com.
Cookies and tracking
Cookies are small files stored on your device. We use:
Strictly necessary cookies — required for the site and checkout to work (for example, keeping items in your cart and completing payment through Stripe). These cannot be switched off.
Analytics cookies — set by Google Analytics 4 through Google Tag Manager, to tell us how many people visit, which pages they read, and where they came from. These are only set where you have given consent, or where consent is not legally required in your jurisdiction.
We do not use advertising or retargeting cookies.
You can delete or block cookies through your browser settings at any time. Blocking strictly necessary cookies may break checkout.
How long we keep it
| Data | Retention period |
| Order and invoice records (name, email, country, transaction) | 10 years, as required by tax and accounting law in Lithuania, EU |
| Newsletter subscriber data | Until you unsubscribe, a minimal suppression record is kept indefinitely so we don’t email you again |
| Inactive newsletter subscribers (no opens or clicks) | Reviewed and removed after 24 months |
| Support and contact emails | 24 months after the conversation ends |
| Google Analytics data | 14 months (set in your GA4 data retention settings) |
| Server logs | 60 days |
Your rights
If you are in the EU/EEA or the UK
Under the GDPR and UK GDPR you have the right to:
- Access — get a copy of the personal information we hold about you
- Rectification — have inaccurate information corrected
- Erasure — have your information deleted, where we are not legally required to keep it
- Restriction — ask us to pause processing while a dispute is resolved
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — at any time, without affecting processing done before you withdrew it
- Complain — lodge a complaint with your national data protection authority. Ours is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), Lithuania. UK residents may complain to the ICO.
Please note: we cannot delete invoice records we are legally required to retain for tax purposes, even if you ask us to. We can delete everything else.
If you are in California
Under the CCPA/CPRA, you have the right to know what personal information we collect and why, to request deletion, to request correction, to opt out of sale or sharing, and not to be discriminated against for exercising these rights.
We do not sell or share personal information, so there is no opt-out to exercise. We do not use or disclose sensitive personal information for purposes requiring an opt-out.
If you are elsewhere in the US, Canada, or another country
We extend the same access, correction, and deletion rights to all our customers, regardless of where you live.
How to exercise your rights
Email info[at]vervidus.com with your request. We will respond within 30 days. We may ask you to confirm the email address associated with your account or subscription so that we do not disclose someone else’s data to the wrong person. Exercising your rights is free.
Security
We protect your information with:
- HTTPS/TLS encryption across the entire website
- Payment processing handled entirely by Stripe (PCI DSS Level 1 certified) — we never store card numbers
- Access limited to the site owner
- Strong authentication on all administrator accounts
- Regular software and plugin updates
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant supervisory authority as required by law.
Children
Our products and website are intended for adults running a business. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, email info[at]vervidus.com and we will delete it.
Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Our email tool records opens and clicks and may group subscribers by interest, but this only affects which emails you receive.
Changes to this policy
We may update this policy as our tools or legal obligations change. The “Last updated” date at the top shows the most recent version. If we make a material change, we will notify newsletter subscribers by email.
Contact
Questions about this policy or your data: click here.