Skip to contentOffer: −55% on the Vibe Code Audit Kitends in

Privacy Policy

Last updated: 23 October 2026

This policy explains how we process personal data when you visit www.maximumprotection.online, buy Maximum Protection — Vibe Code Audit Kit (the “Kit”) or book a paid consultation with one of our developers (a “Consultation”). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the other applicable data protection laws.

At checkout you accept this policy together with the Terms and Conditions and the Refund Policy. That acceptance is not consent to the processing of your data: the legal bases we rely on are listed in section 4.

1. Controller

SISU ENTERPRISE LIMITED, Unit 1603, 16/F The L. Plaza, 367-375 Queen’s Road Central, Sheung Wan, Hong Kong, Incorporation No. 77542421. Email: info@maximumprotection.online.

2. Marketing emails

If you buy the Kit, we may send you marketing emails from Maximum Protection about our own products and services similar to the Kit. By completing a purchase, you agree to receive these emails unless you refuse them:

  • at checkout, with the “Don’t send me these emails” link shown under the acceptance box;
  • later, at any time, with the unsubscribe link included in each of these emails, or by writing to info@maximumprotection.online.

Refusing is free and has no effect on your purchase. Your choice at checkout is recorded with your order: the notice you saw, whether you refused and when. We do not send marketing emails to people who do not complete a purchase, unless they have given their separate consent.

Legal basis: our legitimate interest in offering our customers our own similar products and services (Article 6(1)(f) GDPR). The law allows a seller to send these emails to its customers without asking for their consent, as long as they are informed and can refuse at any time, easily and free of charge (Article 13(2) of Directive 2002/58/EC; in Italy, Article 130(4) of the Personal Data Protection Code, Legislative Decree 196/2003). We use your email address and name for this purpose until you object.

3. Data we collect

When you buy the Kit:

  • email address, first name, surname and billing address (and, if you buy as a company, the company name and VAT ID), and the language of the website;
  • the IP address, the browser (the identification string it sends, called user agent, and its language settings) and the country from which you send the purchase form; the country is derived from the IP address by Cloudflare or, for requests that do not pass through Cloudflare, by Netlify;
  • for each acceptance you give at checkout (of the Terms and Conditions, of the Refund Policy and of this Privacy Policy, and the request for immediate delivery with the acknowledgement that you lose the right of withdrawal): the date and time, the exact text of the box you ticked and the version of the document or text it refers to;
  • your choice about marketing emails (section 2);
  • your cookie choice at the time of purchase;
  • the payment status and order details that the payment provider (Whop or Airwallex) sends us, such as order number, amount and currency, and, if there is a refund, a chargeback or another payment dispute, its status, reason, amount and deadlines.

We never receive your card or other payment details: you enter them on the secure payment page of Whop or Airwallex.

When you book a Consultation: the same data as for a purchase of the Kit (including the request for the call to take place on the date you chose, with the acknowledgement that you then lose the right of withdrawal), plus your phone number, the date, time and length of the call, the time zone you chose and your answers to the booking questions, such as what your app does, its address, the tools and services it uses, its stage, number of users and kinds of data, and what you want from the call. Please do not include passwords, API keys or your customers’ personal data in your answers. We also record the emails we send you about the call (confirmation and calendar file) and, if you give us any, notes about the call. During the call, the video-call service processes your image, your voice, the name you join with and, if you choose to share it, your screen (section 5).

When we deliver the Kit: when the email with your download links was sent, the address it was sent to, the identifier our email provider gave it and the files it linked to; the state of your links (expiry date, downloads per file and, if they were deactivated, when and why).

When you use your download links: for every download attempt, the date and time, the file, the IP address, browser and country, and the result (for example file downloaded, link expired or download limit reached).

When you write to us: your messages and contact details.

When you browse: your cookie choice (mp_consent) and, only with your consent, the analytics and marketing data described in section 5 and in the Cookie Policy. Every visit passes through Cloudflare and reaches our hosting provider, Netlify: both process technical data such as the IP address, the page requested and browser and device information. Clerk’s script, which provides sign-in to our admin area, also runs on the website. Some of these services may set strictly necessary cookies, listed in the Cookie Policy. We also derive your country from your IP address to suggest your billing country and to show prices in the currency for your country.

To buy the Kit you need to provide your email address, name and billing address (and, if you buy as a company, the company name) and tick the required boxes; to book a Consultation, your phone number too: without them we cannot process the order. The technical data listed above (IP address, browser, country) are collected automatically when you use the website and the download links. Analytics and marketing consent are optional and never a condition of purchase.

4. Purposes and legal bases

  • Selling and delivering the Kit: creating the checkout, sending the email with your download links, managing the links, sending them again and answering your requests: performance of a contract (Article 6(1)(b) GDPR). Sending you the confirmation of your request for immediate delivery required by consumer protection law is also a legal obligation (Article 6(1)(c)).
  • Booking and holding a Consultation: reserving the time you chose, preparing the call with your answers, sending you the confirmation, the calendar file and the video call link, holding the call and handling changes, cancellations and refunds: performance of a contract (Article 6(1)(b)).
  • Billing details (billing address and, for companies, the company name and VAT ID; for Consultations, the phone too): we ask for them for the order’s tax documents, to contact you if there is a problem with your order and as evidence in payment disputes: performance of a contract and accounting and tax obligations (Article 6(1)(b) and Article 6(1)(c)) and our legitimate interest in establishing, exercising and defending legal claims (Article 6(1)(f)).
  • Proving the contract and the delivery, and answering chargebacks, payment disputes and legal claims: keeping the records of your acceptances, of the delivery and of the downloads described in section 3 and, when needed, sharing them with the recipients listed in section 5: our legitimate interest in establishing, exercising and defending legal claims (Article 6(1)(f)).
  • Preventing fraud and abuse: our legitimate interest in protecting the website, our customers and our business against fraud, the use of payment cards without their holder’s permission, unjustified chargebacks and the unlawful sharing of the Kit (Article 6(1)(f)). This includes the Cloudflare Turnstile check on the purchase form, limits on repeated requests, the download limits, the IP address, browser and country recorded at checkout and at each download, and the use of the records of previous orders to refuse orders from people who have made fraudulent purchases or unjustified chargebacks.
  • Running and protecting the website: delivering the pages through Cloudflare and Netlify, protecting the website against attacks and bots, and securing the sign-in to our admin area with Clerk: our legitimate interest in the operation and security of the website (Article 6(1)(f)).
  • Marketing emails to customers about our own similar products and services: our legitimate interest (Article 6(1)(f)), within the soft opt-in rule described in section 2.
  • Keeping accounting and tax records and complying with other legal obligations, such as requests from competent authorities: legal obligations (Article 6(1)(c)).
  • Analytics (Google Analytics 4, loaded through Google Tag Manager): measuring how the website is used: your consent (Article 6(1)(a)).
  • Advertising measurement and optimisation (Meta Pixel and Meta Conversions API; TikTok Pixel; Whop Pixel): measuring and optimising our ads on Meta’s platforms and on TikTok: your consent (Article 6(1)(a)).
  • Email delivery (opens and clicks recorded by Brevo, section 5): our legitimate interest in knowing that our emails arrive and work (Article 6(1)(f)); for the marketing emails, also in measuring their results.

We record the IP address, browser and country at checkout and at each download whatever your cookie choices, because we need them for the purposes above; we do not use them for analytics or advertising.

5. Service providers and other recipients

We share data only with the providers we need to run the service. Unless stated otherwise, they act as processors on our behalf.

  • Whop (Whop, Inc., United States): checkout, payment processing, refunds and payment disputes. We pass Whop your email address, name and language to prepare the checkout and, if there is a chargeback or payment dispute, the records described in section 3. For the payment and the handling of disputes, Whop may act as an independent controller under its privacy policy.
  • Airwallex (Airwallex group, Hong Kong and its group companies): payment processing for payments made with card, Klarna, Apple Pay or Google Pay, refunds and payment disputes. We pass Airwallex your email address, name and billing address (and company name, if any) and, for Consultations, your phone number, to process the payment and prevent fraud; Airwallex may act as an independent controller for its own anti-fraud and legal obligations, under its privacy policy.
  • Brevo (France): sending our emails, such as the one with your download links, the confirmation of a Consultation and, unless you have refused them, the marketing emails described in section 2. By Brevo’s default, the emails we send you contain a small invisible image that records when you open them, and their links go through a Brevo address that records clicks: we use this information only to check that our emails arrive and work and, for the marketing emails, to measure their results.
  • Google Firebase (Cloud Firestore), a Google Cloud service: database for orders, Consultation bookings and answers, acceptance records, delivery records, download logs and anti-abuse counters.
  • Netlify (United States): website hosting and server functions, including the download of the files.
  • DigitalOcean (DigitalOcean, LLC, United States): storage of the Kit’s files, which you download through temporary signed links. When you download a file, DigitalOcean’s servers receive, like any web server, your IP address and technical browser data, to deliver the file to you. No cookies are used.
  • Cloudflare (United States): DNS, content delivery network and security proxy for the whole website. Every visit passes through Cloudflare, which processes the IP address and the request data (such as the page requested and browser and device information) to deliver and protect the website, tells us the IP address and country of the requests that reach our server, and may set strictly necessary security cookies. Cloudflare also runs the Turnstile anti-bot check on the purchase form, which processes signals such as IP address, TLS fingerprint and user agent; as explained in its Turnstile privacy addendum, Cloudflare also uses them as a controller to improve Turnstile.
  • Clerk (Clerk, Inc., United States): sign-in to our admin area, for admin accounts only. Its script runs only on the admin sign-in page and the admin area, never on the pages visitors and customers use; there, Clerk receives technical data such as the IP address and browser information and sets strictly necessary cookies for session security.
  • Google Meet (Google) or Zoom (Zoom Communications, Inc., United States), depending on the call link we send you: the video-call service of the Consultation, chosen by us. It processes your image and voice, the name you join with and, if you choose to share it, your screen, together with technical data such as your IP address, only to hold the call; if we invite you from our calendar, it also receives your email address. Sharing your screen is optional. We do not record the call unless you agree (in that case we ask you beforehand).
  • Google Analytics 4 and Google Tag Manager (Google Ireland Limited): only with your Analytics consent, to measure how the website is used. Google Tag Manager is loaded only after you accept Analytics or Marketing cookies; Google Consent Mode v2 denies every category by default and tells Google’s tags which ones you accepted, and Google Analytics runs only if you accept Analytics. Google states that Google Analytics does not log or store the individual IP addresses of users in the EU, Switzerland and the UK (details).
  • Meta Platforms (Meta Pixel and Conversions API): only with your Marketing consent, to measure and optimise our ads on Facebook and Instagram. The Pixel runs in your browser, loaded through Google Tag Manager; the Conversions API sends events from our server. We send events such as the start of a checkout or a purchase and its value, with identifiers such as IP address, browser information and the _fbp and _fbc values; with these events we may also send your email address and name in hashed form, so that Meta can match them with its users. A purchase is reported to Meta only if you had given Marketing consent when you started the checkout. Meta may also use this data for its own purposes, as described in its privacy policy.
  • TikTok (TikTok Pixel) (TikTok Technology Limited, Ireland, and TikTok Pte. Ltd.): only with your Marketing consent, loaded through Google Tag Manager, to measure and optimise our ads on TikTok. The Pixel sends TikTok information about your visit and your actions on the website, such as starting a checkout or buying, with identifiers such as the _ttp cookie, the ttclid click identifier, IP address and browser information. TikTok may also use this data for its own purposes, as described in its privacy policy.
  • Whop (Whop Pixel) (Whop, Inc., United States): only with your Marketing consent, to measure which ads and links bring visits and purchases. The Pixel runs in your browser and sends Whop the pages you visit, with a random identifier of your browser, a fingerprint of your browser and device (computed from technical characteristics such as browser, operating system, screen, language and time zone), your IP address and, if present, the values of the _fbp, _fbc, _ga and _ttp cookies. When you type your email address, phone number or name in one of our forms, it also sends them to Whop, in clear text (not hashed), to link your visit to your purchase.

Chargebacks, disputes and legal claims. To answer a chargeback, a payment dispute, a suspected fraud or a legal claim, we may share the records of your purchase, acceptances, delivery and downloads, directly or through the payment provider (Whop or Airwallex), with the card networks and the banks involved, with the competent authorities and courts, and with our legal advisers. These recipients process the data as independent controllers.

We do not sell personal data. We may disclose it to public authorities when the law requires it.

6. Transfers outside the EU

We are based in Hong Kong, and some of our providers are based in, or process data in, countries outside the EU/EEA:

  • Whop, Netlify, DigitalOcean, Cloudflare, Clerk and Zoom are based in the United States;
  • Airwallex processes data in Hong Kong and in other countries of its group;
  • Google may transfer data to Google LLC in the United States, for Firebase, Tag Manager, Analytics and Google Meet;
  • Meta may transfer data to the United States;
  • TikTok states that it stores information on servers in the United States, Malaysia and Singapore.

Where the GDPR requires it, these transfers rely on appropriate safeguards: the EU-U.S. Data Privacy Framework for providers certified under it, such as Google LLC, or the Standard Contractual Clauses approved by the European Commission, as set out in each provider’s terms. Transfers needed to establish, exercise or defend legal claims, for example to answer a chargeback through banks or card networks outside the EU/EEA, may also rely on Article 49(1)(e) GDPR. You can ask us for more information.

7. How long we keep data

  • Orders, payments and evidence records (the order and payment details, the records of your acceptances, the IP address, browser and country recorded at checkout and at each download, the delivery records, the download log and the technical log of the messages Whop and Airwallex send us): 24 months from the purchase, then we delete them, unless a longer period is required by law (for example accounting and tax obligations) or a chargeback, dispute or legal claim is still pending: in that case we keep the records it needs until it has been finally resolved.
  • Accounting records of the order (such as order number, date, amount, currency, your name, phone (for Consultations), billing address and, for companies, the company name and VAT ID): for as long as accounting and tax law requires (currently 7 years).
  • Marketing emails: your email address and name, until you object, and in any case no longer than 24 months from the purchase.
  • Checkouts and bookings started but not paid (the details entered in the form, the acceptances, the IP address, browser and country): to prevent fraud and to answer your requests, for up to 24 months from collection; then we delete them.
  • Your answers to the Consultation questions: for as long as needed to prepare and hold the call and follow up on it, and no longer than 24 months after the call; the acceptance, payment and accounting records of the booking follow the periods above.
  • Your messages: for as long as needed to handle your request.
  • Your cookie choice: 6 months in the mp_consent cookie; the choice recorded with an order is kept with the order.
  • Anti-abuse data (the records that limit repeated requests, stored with the email address pseudonymised with a hash function): for up to 24 months from the last request recorded, then we delete them.

For the cookies of our providers and their duration, see the Cookie Policy.

8. Your rights

You can ask us for access to your data, its rectification or erasure, the restriction of processing and data portability. You can withdraw your consent at any time through the “Cookie settings” link in the footer, without affecting the lawfulness of the processing carried out before.

You can object at any time, free of charge, to marketing emails: we then always stop sending them (Article 21(2) and (3) GDPR).

You can also object at any time, on grounds relating to your particular situation, to the other processing based on our legitimate interest. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims (Article 21(1) GDPR). For this reason, while a chargeback or legal claim about your purchase is possible, we keep the evidence records even if you object or ask for their erasure, and we use them only for that purpose (Article 17(3)(e) GDPR).

To exercise your rights, write to info@maximumprotection.online. We will reply within one month, a period that can be extended in the cases provided for by law, and we may ask you to confirm your identity.

9. Complaints

You can lodge a complaint with the data protection authority of the EU country where you live or work or where the alleged infringement took place. In Italy, this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

10. No automated decisions

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The anti-bot check only serves to block abuse. Download links stop working automatically when they expire, when the download limit is reached or when the payment is refunded or disputed, as set out in the Terms and Conditions; if this happens, you can write to us and a person will review your case.

11. Security

We use appropriate technical and organisational measures, such as encrypted connections, download links that contain a long random code, and an admin area, including the evidence records, restricted to authorised staff. If a personal data breach occurs, we will notify the competent authority and, where required by law, you.

12. Changes

We may update this policy. We will publish the new version on this page with its date and, if the changes are significant, we will inform you by appropriate means.