Privacy Policy

Last updated: 6 May 2026

Who we are

Vital Nimbus is operated by Damian M. Bronzel as a sole trader based in Basel, Switzerland. For the purposes of European data protection law, Damian M. Bronzel is the data controller. For the purposes of the California Consumer Privacy Act (CCPA/CPRA), Vital Nimbus is the business that processes your personal information.

You can contact the controller for any privacy matter at support@vitalnimbus.store.

What this policy covers

This policy explains what personal data we collect when you visit vitalnimbus.store, sign up for the Identity-First Goal Worksheet, purchase The Science of Goal Setting ebook, message us through Instagram or Facebook, or otherwise interact with the brand. It also explains how we use that data, who we share it with, how long we keep it, and what rights you have over it.

We aim to collect the minimum we need to deliver the product and operate the site responsibly. Where we go beyond that — analytics, advertising attribution — we ask for your consent first.

What we collect and why

When you visit the site. We collect technical data your browser sends automatically: IP address, device type, browser type and version, time zone, referring page, and pages viewed. We use this to operate and secure the site, detect abusive traffic, and — only if you have given consent through the cookie banner — measure aggregate usage.

When you sign up for the worksheet. We collect your email address and the time of signup. We use this to send the worksheet, deliver the welcome email sequence, and provide ongoing brand emails. You can unsubscribe at any time from the link in every email.

When you purchase an ebook. We collect your name, billing address, email address, and payment data through our payment processors. We do not see, store, or transmit your full card number — that goes directly to Stripe. We use this data to process the payment, deliver the product, prevent fraud, send receipts, and keep the records required by Swiss tax law.

When you message us through Instagram or Facebook. Our automation captures the message content, your platform username, and the time of contact. We use this to deliver the requested resource and to operate the conversation. Once you sign up for the worksheet, your interaction history is associated with your subscriber profile.

When you contact us by email. We receive whatever you send. We use it to respond to you and keep a service history.

We do not sell your personal data. We do not share it with advertisers as audience segments. We do not use it to make automated decisions that produce legal or similarly significant effects on you.

Legal bases for processing (EU/UK/Switzerland)

We rely on the following legal bases under GDPR Article 6 and Swiss FADP equivalents:

• Performance of a contract when we deliver the worksheet, send the ebook you bought, or process a refund.

• Consent when we send marketing emails, run analytics cookies, or run advertising pixels.

• Legitimate interest for security, fraud prevention through Stripe Radar, defending legal claims, and maintaining business records.

• Legal obligation for tax records, retention of payment data, and responding to lawful requests from authorities.

You can withdraw any consent at any time without affecting the processing carried out before withdrawal.

Who we share data with

We use the following processors. Each one operates under its own privacy policy and applies appropriate safeguards for international transfers (Standard Contractual Clauses where data leaves the EEA / Switzerland to the United States).

We do not share data with any party not listed above except where required by law.

Stripe fraud prevention

Stripe loads a small invisible iframe on every page of the site that scores device signals — browser type, fonts, and similar — for fraud prevention. We rely on legitimate interest (preventing card fraud against the seller and against you) for this loading. Stripe does not use these signals for advertising, and the data does not leave Stripe. You can read the full description in Stripe’s privacy policy.

Cookies

We use a small number of cookies that fall into three categories:

• Strictly necessary. Keep the site working, the cart functional, and protect against fraud. These do not require consent.

• Analytics. Google Analytics 4. Loaded only after you accept on the cookie banner. Used to count visits, see which pages perform, understand referral sources.

• Advertising. Meta Pixel. Loaded only after you accept. Used to measure ad attribution and build re-engagement audiences if we run ads.

You can change your cookie choices at any time by reopening the cookie banner from the site footer or by clearing your browser cookies for vitalnimbus.store.

How long we keep data

• Subscriber data — until you unsubscribe and request deletion.

• Payment records — ten years, as required by the Swiss Code of Obligations (Article 958f) and US tax record-keeping recommendations.

• Analytics data — fourteen months by default in Google Analytics 4.

• Support correspondence — three years from the last interaction, then deleted.

When the retention window ends, we delete or fully anonymise the record.

Your rights

If you are in the EU, the UK, or Switzerland, you have the right to:

• Access — receive a copy of the data we hold about you.

• Rectification — correct inaccurate or incomplete data.

• Erasure — request deletion (“right to be forgotten”) subject to legal retention obligations.

• Restriction — limit how we process your data while a query is resolved.

• Portability — receive your data in a machine-readable format and transfer it elsewhere.

• Objection — object to processing based on legitimate interest or for direct marketing.

• Withdraw consent — at any time, without affecting prior processing.

• Lodge a complaint with a supervisory authority. In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). In the EU: your local data protection authority. In the UK: the Information Commissioner’s Office (ico.org.uk).

If you are a California resident, you have the right under CCPA/CPRA to know, access, delete, correct, and limit the use of your personal information; the right to opt out of sale or sharing (we do not sell or share for cross-context behavioural advertising in the CCPA sense); and the right to non-discrimination for exercising any of these rights. To exercise these rights, contact us at support@vitalnimbus.store.

If you are a resident of another US state with a comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Texas, and others), the rights above generally apply. Contact us through the same address.

Children

The site and its products are not directed at children under sixteen. We do not knowingly collect personal data from anyone under sixteen. If you believe a child has given us their data, contact us and we will delete it promptly.

International transfers

When we transfer personal data from the EEA, the UK, or Switzerland to the United States, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or — for transfers to Stripe Inc., Kit, ManyChat, and Google — the EU-US Data Privacy Framework where the recipient is certified.

Marketing emails (CAN-SPAM compliance)

Every marketing email we send includes a working unsubscribe link, our brand identity in the from-name, and our physical jurisdiction (Basel, Switzerland) in the email footer, in compliance with the US CAN-SPAM Act. We honour unsubscribe requests within ten business days, well inside the legal requirement.

Security

We use Hostinger’s encrypted infrastructure, HTTPS across the entire site, two-factor authentication on every connected account, and we never store payment card numbers ourselves. No system is perfectly secure. If a breach occurs that affects your data, we will notify you and the relevant supervisory authority within 72 hours of becoming aware, as GDPR Article 33 requires.

Changes to this policy

We update this policy when our processing changes or when the law requires it. The effective date at the top reflects the most recent change. Material changes will be communicated by email to active subscribers.

Contact

For any privacy question, request, or complaint:

Damian M. Bronzel — operating as Vital Nimbus

Basel, Switzerland

support@vitalnimbus.store