Privacy Policy

Vahlbruch Media, LLC
Operating brands: Smart Artistics · Smart Scientistics · Smart Touristics · Smart Working Bytes · Jennifer Vahlbruch Art (DBA)
Effective Date: 2026-05-12 · Last Updated: 2026-05-11 | (Year-Month-Day)

1. Scope of This Policy

This Privacy Policy (“Policy”) applies to all websites, domains, and digital properties owned and operated by Vahlbruch Media, LLC (“we,” “us,” or “VLBM”), including but not limited to:

• vahlbruchmedia.com and all associated subdomains
• smartartistics.comand all associated subdomains
• smartscientistics.com and all associated subdomains
• smarttouristics.com and all associated subdomains
• smartworkingbytes.com and all associated subdomains
• jennifervahlbruch.com (operated under Vahlbruch Media, LLC; Jennifer Vahlbruch Art is a registered DBA) and all associated subdomains
• thehydrants.com and all associated subdomains
• Any future domains or brand websites added under Vahlbruch Media, LLC

This Policy explains what data we collect, why we collect it, how we use it, and your rights regarding that data. It covers all visitors, clients, subscribers, and contacts who interact with any of our websites or communications.

This Policy does not apply to third-party websites linked from our sites. We recommend reviewing the privacy policies of any third-party sites you visit.

2. We Do Not Sell or Share Your Data

We do not sell, rent, trade, or share your personal data with any third party for commercial or advertising purposes. Your data is never used for targeted advertising, behavioral profiling, or cross-context behavioral tracking.

Any third-party tools we use (analytics, payment processing, email delivery, cookie management) receive only the minimum data necessary to perform their specific function, and are contractually prohibited from using your data for any other purpose.

3. Notice Concerning Children

Our websites are directed at adults and business professionals only. We do not knowingly collect personally identifiable information from anyone under the age of 18. Our services are not intended for use by minors.

If you are a parent or guardian and believe a child under 18 has provided personal information through any of our websites, please contact us immediately at the address listed in Section 18. We will promptly delete any such information upon verification.

This Policy is designed to comply with the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. §6502), COPPA Rule (16 CFR Part 312), and GDPR Article 8.

California Minor Eraser Law: If you posted content on any of our websites while under the age of 18, you have the right to request its removal. Contact us to make such a request. Please note that removal from our site does not guarantee removal from archival services such as the Wayback Machine or Google’s cache.

4. Data We Collect

4A. Personal Data You Provide Directly

We only collect personal data that you actively submit through our websites. We do not collect data passively beyond what is described in Sections 4B and 4C below. Users are not permitted to upload files or content to our websites.

Data categories collected through forms include:

• Contact Data: name, email address, phone number (where provided)
• Commercial Data: company name, job title, business context (for consultation inquiries)
• Financial Data: name, billing address (street, ZIP, city, state, country), email address — collected only in connection with purchase transactions. We do not store payment card details. All card data is handled directly and exclusively by our payment processors (see Section 9).
• Shipping Data: name and physical delivery address — collected only on jennifervahlbruch.com for artwork orders requiring physical shipment.
• Newsletter Subscription Data: name and email address, collected when you subscribe to one of our newsletters.
• Survey or Feedback Data: preferences, ratings, or other feedback submitted through forms.

We do not collect sensitive categories of personal data (such as health data, racial or ethnic origin, political opinions, or biometric data).

4B. Usage and Traffic Data (Collected Automatically)

When you visit our websites, we automatically collect the following technical information:

• IP addresses (anonymized where technically possible)
• Browser type and version
• Operating system
• Pages visited, time and date of visit, time spent on pages
• Referring URLs (how you arrived at our site)
• Device identifiers and screen resolution

This data is collected in aggregate and does not personally identify you. It is used to improve website performance, monitor usage patterns, and generate anonymized analytics reports.

4C. Cookie and Tracking Data

We use a cookie consent management tool (CookieYes) on all our websites. Non-essential cookies are only placed after you provide explicit consent through the cookie consent banner. You may update or withdraw your cookie preferences at any time by clicking the cookie settings link available on each website.

See Section 7 for details on cookies used on our websites.

5. How We Use Your Data

We use personal data only for the specific purposes for which it was collected:

• To respond to inquiries and messages submitted through our contact forms.
• To process and fulfill orders, including sending order confirmations, receipts, and shipping updates (jennifervahlbruch.com).
• To send newsletters and marketing communications — only to subscribers who have explicitly opted in via our double opt-in process.
• To process payments securely via our payment processors (Stripe, Square, PayPal).
• To conduct cold email outreach to researched, hand-selected B2B contacts under Legitimate Interest (see Section 6C).
• To analyze website traffic and improve our websites and services using anonymized analytics data.
• To comply with legal obligations, resolve disputes, and enforce our agreements.

We do not run advertising campaigns, display ads on our websites, or use your data for any form of behavioral advertising or retargeting.

6. Legal Bases for Processing (GDPR)

For visitors and contacts in the European Economic Area (EEA), the United Kingdom (UK), and other jurisdictions with similar data protection laws, we process personal data under the following legal bases:

6A. Contract Performance (Article 6(1)(b) GDPR)

Processing is necessary to fulfill a contract with you, including responding to service inquiries, processing orders, and delivering purchased services or products.

6B. Consent (Article 6(1)(a) GDPR)

We rely on consent for newsletter subscriptions and for placing non-essential cookies. Consent is obtained through:

• Double opt-in for email newsletters: you must confirm your subscription via a confirmation email before we send you any marketing communications. Your consent record is maintained in Mailerlite.
• Explicit cookie consent: non-essential cookies are only placed after you actively consent through the CookieYes consent banner.

You may withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. To unsubscribe from newsletters, use the unsubscribe link in any email we send. To withdraw cookie consent, update your preferences via the cookie settings link on any of our websites.

6C. Legitimate Interest (Article 6(1)(f) GDPR)

We rely on Legitimate Interest for our B2B cold email outreach program. Our process is as follows:

• We only contact hand-selected, individually researched business contacts at organizations that have a plausible, demonstrable interest in our services.
• We only use professional or business email addresses. We do not contact individuals on personal email addresses under Legitimate Interest.
• Before initiating any outreach campaign, we conduct a Legitimate Interest Assessment (LIA) and maintain written documentation of that assessment.
• Every outreach email clearly identifies us, includes our contact information, and provides a simple, prominent opt-out mechanism.
• Opt-out requests are honored immediately and the recipient’s contact details are suppressed from all future outreach without delay.
• We maintain a suppression list of all opt-out recipients and apply it to all future campaigns.

Our legitimate interest is in promoting our consulting services to relevant business professionals. This interest does not override the rights and interests of the individuals we contact, given the B2B nature of all outreach, the individual research applied to each contact, and the immediate and permanent opt-out mechanism provided.

6D. Legal Obligation (Article 6(1)(c) GDPR)

We process data where required to comply with applicable laws, including tax, financial reporting, and data protection obligations.

7. Cookie Consent Management

We use CookieYes as our cookie consent management platform. Upon your first visit to any of our websites, a consent banner is displayed. Non-essential cookies are not placed until you provide explicit consent. You may update your preferences at any time via the cookie settings link on each website.

Cookies used on our websites fall into the following categories:

• Strictly Necessary: Required for the website to function. These are set without consent as they are essential to deliver the service you have requested.
• Analytics: Used to collect anonymized information about how visitors use our websites. We currently use Google Analytics (GA4) for this purpose. Google Analytics cookies include _ga, _ga_*, and _gid.
• Analytics — Planned (Facebook / Meta): We plan to activate the Meta Pixel on selected websites for analytics purposes only. It will not be used for advertising or retargeting. This policy will be updated when activated.
• Analytics — Planned (LinkedIn): We plan to activate the LinkedIn Insight Tag on selected websites for analytics purposes only. It will not be used for advertising or retargeting. This policy will be updated when activated.

Cookies used on this website

Consent Preferences

You can modify your cookie settings anytime by clicking the 'Consent Preferences' link above. This will allow you to revisit the cookie consent banner and update your preferences or withdraw your consent immediately.

For the full and current list of cookies in use on a specific website, please refer to the CookieYes consent panel on that website.

8. Advertising

We do not run paid advertising campaigns on or through any of our websites. No advertising networks, ad exchanges, demand-side platforms, or advertising cookies are used on any Vahlbruch Media website.

Where we use analytics tools that are also capable of supporting advertising (such as Google Analytics or the Meta Pixel), we have configured these tools for analytics use only. Advertising features, remarketing lists, and interest-based advertising audiences are disabled.

9. Payment Processing

Payments on our websites are processed exclusively by the following PCI-DSS compliant third-party processors:

• Stripe (stripe.com) — used on applicable brand websites
• Square (squareup.com) — used on applicable brand websites
• PayPal (paypal.com) — used on applicable brand websites

We do not store, process, or have access to your payment card details. All card data is entered directly into the payment processor’s secure environment and is governed by their respective privacy policies. We retain only your name, billing address, email address, and order information for bookkeeping and legal compliance purposes.

10. Third-Party Service Providers

We share personal data with third-party service providers only to the extent necessary for them to perform specific functions on our behalf. All providers are contractually bound to process data only as instructed and to maintain appropriate security measures.

Current and planned service providers:

• Google Analytics — Web analytics. Processes: Usage & Traffic Data (anonymized). Privacy Policy
• Mailerlite — Email marketing and newsletter delivery. Processes: Name, Email Address. Privacy Policy
• Stripe — Payment processing. Processes: Name, Address, Email, Payment Data. Privacy Policy
• Square — Payment processing. Processes: Name, Address, Email, Payment Data. Privacy Policy
• PayPal — Payment processing. Processes: Name, Address, Email, Payment Data. Privacy Policy
• CookieYes — Cookie consent management. Processes: Cookie consent preferences. Privacy Policy
• Meta / Facebook (planned) — Analytics only, not used for advertising or retargeting. Privacy Policy
• LinkedIn (planned) — Analytics only via LinkedIn Insight Tag, not used for advertising or retargeting. Privacy Policy

11. User Content and Uploads

Our websites do not permit visitors or users to upload files, post content, or submit user-generated content of any kind. Any content submitted through our contact or inquiry forms is treated as personal data and handled in accordance with this Policy.

12. Data Retention

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by law:

• Contact and inquiry data: retained for up to 3 years from last contact, or as required to resolve any disputes.
• Order and financial data: retained for 7 years for tax and bookkeeping compliance (IRS requirements).
• Newsletter subscriber data: retained for as long as you remain subscribed. Upon unsubscription, your email is moved to our suppression list and no further communications are sent. Suppression records are retained indefinitely to prevent re-contact.
• Cold outreach opt-out records: retained indefinitely on our suppression list.
• Cookie consent records: retained for 12 months, or until you update your preferences.
• Analytics data: retained in accordance with the default retention settings of the relevant analytics platform (typically 14 months for GA4).

13. Information Security

We implement commercially appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or disclosure. These include SSL/TLS encryption for all data transmitted through our websites, access controls, and secure hosting environments.

We do not store financial or payment card data on our own systems. Payment data is handled exclusively by our PCI-DSS compliant payment processors.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you and any applicable supervisory authority as required by law.

If your payment information is lost, stolen, or used without authorization, please notify us immediately so we can take appropriate action.

14. Your Data Protection Rights

14A. Rights Under GDPR (EEA and UK Residents)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete data.
• Right to Erasure (‘Right to be Forgotten’): You may request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances.
• Right to Data Portability: You may request your data in a structured, machine-readable format.
• Right to Object: You may object to processing based on Legitimate Interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right Not to be Subject to Automated Decision-Making: We do not use automated decision-making or profiling that produces legal or similarly significant effects.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence. In the EU, this is your national Data Protection Authority (DPA). In the UK, this is the Information Commissioner’s Office (ICO) at ico.org.uk.

14B. Rights Under California Law (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• The right to know what personal data we collect, use, disclose, or share.
• The right to delete your personal data, subject to legal exceptions.
• The right to correct inaccurate personal data.
• The right to opt out of the sale or sharing of your personal data. Note: We do not sell or share your personal data for advertising or commercial purposes.
• The right to non-discrimination for exercising your privacy rights.

14C. How to Exercise Your Rights

To exercise any of your rights under this Section, please contact us using the details in Section 18. We may ask you to verify your identity before responding. We will respond within 30 days, or within the timeframe required by applicable law.

15. CAN-SPAM Act Compliance

All commercial email communications we send comply with the CAN-SPAM Act (15 U.S.C. §7701 et seq.). Specifically:

• Every commercial email clearly identifies Vahlbruch Media, LLC as the sender and includes our physical mailing address.
• Every commercial email includes a clear, functional unsubscribe mechanism.
• Opt-out requests are honored within 10 business days of receipt. In practice, we process all opt-out requests immediately.
• We do not use deceptive subject lines or misleading sender information.
• Transactional emails (order confirmations, receipts) are exempt from CAN-SPAM opt-out requirements but are still clearly identified.

16. ePrivacy and PECR Compliance

For communications directed at recipients in the EEA, we comply with the EU ePrivacy Directive (2002/58/EC) and applicable national implementations. For recipients in the United Kingdom, we comply with the Privacy and Electronic Communications Regulations (PECR).

• We only place non-essential cookies after obtaining prior informed consent through our CookieYes consent tool.
• Our newsletter communications are sent only to individuals who have explicitly subscribed via our double opt-in process.
• Our B2B cold outreach is directed only at business contacts where we have identified a genuine legitimate interest, and we provide a clear opt-out in every communication.
• We do not send unsolicited commercial electronic communications to individuals without a lawful basis.

17. General Provisions

17A. Areas Beyond Our Control

Our websites may contain links to third-party websites. We have no control over the content, privacy practices, or policies of those sites. We encourage you to review the privacy policies of any third-party sites you visit before providing personal data.

17B. Sale of Business

In the event that Vahlbruch Media, LLC or any of its brands is sold, merged, or transferred to a new owner, your personal data may be included as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

17C. Changes to This Policy

We may update this Policy at any time. The updated version will be posted on all applicable websites with a revised ‘Last Updated’ date at the top of this document. We recommend checking this page periodically. Your continued use of our websites after changes are posted constitutes acceptance of the updated Policy. You may reject updates by discontinuing use of our websites.

17D. Governing Law

This Policy is governed by the laws of the State of Texas, USA, without regard to conflict of law principles, except where superseded by applicable GDPR, UK GDPR, or other mandatory local law.

18. Contact and Data Controller

The data controller for all personal data collected through Vahlbruch Media, LLC websites is:

Vahlbruch Media, LLC
Heinz R. Vahlbruch, Owner & Data Controller
Houston, Texas, USA
Email: privacy [at] vahlbruchmedia [DOT] com

For all data subject requests, privacy inquiries, opt-out requests, or complaints, please contact us at the email or phone number above. You may also use the contact form on the relevant website.

We will acknowledge your request within 5 business days and respond fully within 30 days, or within the timeframe required by applicable law.