Privacy Policy

1. Controller

CPI Technologies GmbH
Brüsseler Straße 1-3
60327 Frankfurt am Main
Phone: +49 6131 4909028
Email: info@cpitech.io

2. Data processing when accessing the website

When you access vibecodingbuch.de, technically necessary data is processed on the server side (IP address, timestamp, page requested). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation).

3. Members area

When you register, we store your name, email address, the date of registration and, if you provide them, your company and phone number. Purpose: provision of the members area and sending of update notifications (Art. 6(1)(b) GDPR). Once you have confirmed your email address, we also create a contact for you in our customer management (section 9) and get in touch with you once in person about two weeks later, by phone if you gave us a number, otherwise by email, to hear how you are getting on with the book. The legal basis for this is our legitimate interest in looking after our readers (Art. 6(1)(f) GDPR). You can object at any time, for example with an informal email to info@cpitech.io; we will then not contact you. The phone number is optional and can also be added later in the members area.

4. Orders and payment processing (Stripe)

When you order the book through this website, we process the data required for the order (name, email address, phone number, shipping and billing address, and for certain offers also the company) to fulfil the contract (Art. 6(1)(b) GDPR). The phone number is required for every order: we use it for questions about your order and for a one-time personal call about two weeks after the purchase in which we ask how you are getting on with the book (Art. 6(1)(f) GDPR, legitimate interest in looking after our customers). You can object to the call at any time, also in advance by email to info@cpitech.io. Payment is processed by Stripe (Stripe Payments Europe Ltd., Ireland; Stripe Inc., USA — certified under the EU-US Data Privacy Framework), which receives the data required for the payment. We retain order and invoice data for the statutory commercial and tax retention periods. The order confirmation and, where applicable, the ebook are sent to you by email.

5. Cookies and consent

We use technically necessary cookies without consent (e.g. for the members-area login and to store your cookie choice in the "ads_consent" cookie, 180 days). Marketing and analytics services only run if you consent via the cookie banner (Art. 6(1)(a) GDPR); you can withdraw your consent at any time by deleting the "ads_consent" cookie in your browser. The exception is our website analytics with X3, which works without cookies when you have not consented (section 6). If you reach the site via an ad, we additionally store campaign parameters from the URL (UTM parameters and click IDs such as gclid, li_fat_id or ttclid) in the first-party cookies "vcb_attr" (30 days) and "_vc_gcl" (90 days) to attribute a later order to the campaign (Art. 6(1)(f) GDPR — measuring our own advertising). These cookies are read only by us, not by third parties.

6. Website analytics with X3 Growth Intelligence (without cookies)

To understand through which channels and campaigns visitors reach vibecodingbuch.de and vibecodingbook.com, which content is read, which buy buttons are used and how many visits lead to an order, we use the analytics platform X3 Growth Intelligence. Without your consent, X3 sets no cookies and stores nothing on your device; it only reads your choice in the cookie banner (cookie "ads_consent") and an objection you have set up yourself (see below). Random identifiers for the page view and the visit exist only in your browser's memory.

We record the pages you view (without URL parameters and anchors) and their order within a visit; time, duration and active time on the page; scroll depth and which page sections were visible and for how long; clicks with their label (at most 80 characters) and link target – never the content of input fields; whether a form (registration, login) was started, submitted or abandoned, without the values entered; clicks on buy buttons, the start of the checkout with the chosen format and price, clicks on the Amazon offers and a successful registration for the members area; campaign parameters (UTM parameters and click IDs from Google, Meta, LinkedIn, Microsoft and TikTok); the domain of the referring website and the source derived from it (for example a Google ad or a direct visit); coarse device information (device type, browser and operating system family, rounded window size) and the country derived from the IP address.

Your browser loads the measurement script from our own domain (path "/n3") and sends the measurement data there. Our server at Vercel forwards it without cookies, together with your IP address, browser identifier (user agent) and country, to the X3 server. To group the page views of one day into a visit, X3 derives a pseudonymous hash from the IP address and browser identifier together with a random value that changes daily and is then deleted; the IP address and browser identifier themselves are not stored, and visits cannot be linked across days this way. A visit ends after 30 minutes of inactivity.

If you chose "Accept" in the cookie banner, X3 additionally stores a random visit ID in your browser's session storage under the key "x3_tsid", which is deleted when you close the tab. Our server then sets the cookie "x3_vid" (a random identifier of your browser, readable only by our server, lifetime 13 months), and X3 sets the cookie "x3_clk" (ad click IDs with the time of the first visit, lifetime 90 days). X3 then also reads the screen size as well as the cookies "_fbp" and "_fbc" of the Meta Pixel and "_ttp" of the TikTok Pixel (see section 7); if they are missing and reporting to Meta or TikTok via X3 is active, X3 creates them with a lifetime of 90 days. This lets us group several visits of the same browser and attribute a later order to the ad through which you came. If you decline or withdraw your consent, X3 deletes these entries and the cookies it created and stops sending them.

If you order through this website, our server reports the order to X3 after successful payment: order value, currency, format (hardcover or e-book) and offer, Stripe's order ID, the order's campaign parameters and – so that we can attribute the order to your visit – the random visit ID that your browser passes to our server when the checkout starts. The measurement data itself remains pseudonymous. For customer management (section 9) we additionally transmit to X3 the name, email address, phone number and, where provided, company of the order or registration; from this, X3 creates a contact on our behalf that contains these details in plain text. Only if you consented to marketing cookies do we additionally transmit IP address, browser identifier and the values of the Meta cookies (_fbp, _fbc); X3 deletes these as soon as they are no longer needed for reporting to advertising platforms, at the latest after seven days. Forwarding these orders from X3 to advertising platforms is currently not active; if it is activated, it takes place within the scope and under the conditions of section 8.

X3 Growth Intelligence is operated on our behalf by good vibes GmbH, Gartenstrasse 7, c/o excent AG, Zweigniederlassung Zug, 6300 Zug, Switzerland, as a processor (Art. 28 GDPR); we remain the controller. Switzerland is covered by an adequacy decision of the EU Commission (Art. 45 GDPR). The X3 server runs at Vercel Inc. in a data center in Frankfurt am Main, and the data is stored in a database of Neon Inc., also in Frankfurt am Main (Amazon Web Services, region eu-central-1); both are sub-processors. Insofar as data reaches the USA, the transfer is based on the EU-US Data Privacy Framework or the EU Commission's standard contractual clauses. Measurement data is deleted automatically after 180 days; aggregated daily figures without reference to individual visits are kept for up to three years. The daily random value is deleted after one day.

The legal basis for measurement without consent and for reporting orders to X3 is Art. 6(1)(f) GDPR; our legitimate interest lies in data-minimising measurement of the reach and success of our offering and our advertising. The legal basis for the entries and cookies after "Accept" and for transmitting IP address, browser identifier and Meta cookies is your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). You can object to the measurement at any time (Art. 21 GDPR) by opening https://vibecodingbook.com/?x3_notrack=1 or https://vibecodingbuch.de/?x3_notrack=1: at your request, the entry "x3_notrack" is stored in your browser's local storage, which switches off measurement in this browser; "?x3_notrack=0" removes it again. Alternatively, an informal email to info@cpitech.io is sufficient.

6a. Heatmaps and session recordings (X3)

Through X3 Growth Intelligence (processor: good vibes GmbH, Gartenstrasse 7, c/o excent AG, Zweigniederlassung Zug, 6300 Zug, Switzerland; see section 6) we also evaluate how our pages are used: clicks (target and position), scroll depth, visible sections, mouse movements, the use of form fields (only focus and abandonment per field, never content) and a coarse location (country, region, city from the network node, without storing the IP address). This results in aggregated heatmaps. In addition, a visit can be stored as a session recording: page structure, scrolling, clicks, mouse movements and page changes, so that the course of the visit can be reviewed later; we can also view ongoing visits in real time with the same information.

All inputs in form fields, your selections in forms, passwords and texts that look like personal data (for example e-mail addresses or phone numbers) are masked in your browser before anything is transmitted; the general texts of our pages remain readable. Checkout, login, registration and the members area are never recorded. X3 sets no cookies for heatmaps and recordings; the script is loaded via our own domain (path "/n3") and sends the data there.

Only some recordings are kept (for example visits with an order, with noticeable usability problems, or a random sample); X3 deletes the others after 48 hours at the latest. Kept recordings are deleted automatically after 30 days, click and scroll paths of individual visits after 90 days. Data is stored in Frankfurt am Main (see section 6).

The evaluation starts with the first page view and ends as soon as you choose "Decline" in the cookie banner; X3 then deletes what has already been captured during this visit. It also does not take place if you have objected via "?x3_notrack=1" or your browser sends the "Global Privacy Control" signal. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in finding errors and obstacles on our pages and making them easier to understand. If you chose "Accept", the processing is based on your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). You can object at any time (Art. 21 GDPR).

7. Analytics and advertising services (only with consent)

With your consent, we use the following services to understand how the site is used and to measure the success of our ads. Data may be transferred to the USA; the providers are certified under the EU-US Data Privacy Framework.

Google Ads & Google Analytics 4 (Google Ireland Ltd., Dublin) — conversion measurement for our ads and pseudonymous usage analytics. We use Google Consent Mode v2: no advertising cookies are set before you consent.

Meta Pixel (Meta Platforms Ireland Ltd., Dublin) — measurement of orders placed via Facebook/Instagram ads and creation of advertising audiences.

LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Dublin) — measurement of orders placed via LinkedIn ads and creation of retargeting audiences. The tag only loads after you consent.

TikTok Pixel (TikTok Technology Limited, Dublin) — measurement of orders placed via TikTok ads and creation of advertising audiences. The pixel is only loaded after your consent. When you place an order, we additionally transmit the order value, currency, order number and your email address solely as a SHA-256 hash. TikTok may transfer data to countries outside the EU (including the USA, Singapore and China); TikTok is not certified under the EU-US Data Privacy Framework, transfers are based on EU Standard Contractual Clauses.

8. Server-side conversion measurement

If an order results from one of our ads, we transmit the order value, currency and a SHA-256-hashed (pseudonymised) form of your email address server-side to the respective ad network (Google Ads API or LinkedIn Conversions API) to count the ad as successful. Ad click IDs (e.g. li_fat_id) are only transmitted if you consented to marketing cookies. Legal basis: Art. 6(1)(f) GDPR (measuring the success of our advertising); you can object at any time via info@cpitech.io. For Meta (Facebook/Instagram, Conversions API) the following additionally applies: only if you consented to marketing cookies, we transmit the order value, currency and product as well as SHA-256-hashed email address, phone number, first and last name, postal code, city and country, plus in clear text your IP address, browser identifier (user agent) and the Meta cookie IDs (_fbp, _fbc). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.

9. Customer management (X3 Sales Engine)

When you place an order and when you register in the members area, we store your contact details (name, email address, phone number, company where provided), the origin (order or members area, campaign parameters) and the date of the order or registration as a contact in the customer management X3 Sales Engine. Like X3 Growth Intelligence (section 6), it is operated on our behalf by good vibes GmbH, Gartenstrasse 7, c/o excent AG, Zweigniederlassung Zug, 6300 Zug, Switzerland, as a processor (Art. 28 GDPR), with servers and database in Frankfurt am Main. Purposes: order handling and questions about orders (Art. 6(1)(b) GDPR) and planning the one-time personal call or email about two weeks after the order or registration (Art. 6(1)(f) GDPR, legitimate interest in looking after our customers and readers). If you object (an informal email to info@cpitech.io is sufficient), we mark your contact as "do not contact" and will not get in touch again. We keep the contact details for as long as the customer relationship exists and delete them on request unless statutory retention obligations apply. Until 31 October 2026 we used the CRM system HubSpot (HubSpot Ireland Ltd.; data hosted in the EU) for this; older contact details are stored there and are no longer added to.

10. Your rights

You have the right at any time to access, rectification, erasure, restriction, data portability and objection. Please send requests to the email address stated above.

11. Right to lodge a complaint

You may lodge a complaint with the competent supervisory authority — for us: the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit).

This privacy policy is updated whenever the services we use change — the version date above is authoritative.