Privacy Policy
How we collect, use, and protect your personal information.
{/* Template starting point, not legal advice; have counsel review before launch. */}
Last updated: July 2026
This Privacy Policy describes how Vibecarbon ("we", "us", or "our") collects, uses, and shares your personal information when you use our service.
Information We Collect
Information You Provide
- Account information: Email address, name, and password when you create an account.
- Billing information: Payment details processed securely through our payment provider. We do not store credit card numbers.
- Organization data: Organization names, member roles, and settings you configure.
- Content: Any data, files, or content you create or upload through the service.
- Communications: Messages you send to us through contact forms or email.
Information Collected Automatically
- Usage data: Pages visited, features used, and actions taken within the service.
- Device information: Browser type, operating system, and device identifiers.
- Log data: IP addresses, access times, and referring URLs.
- Cookies: Essential cookies for authentication and session management. We do not use advertising or tracking cookies.
How We Use Your Information
We use your information to:
- Provide, maintain, and improve the service
- Process transactions and send billing-related communications
- Send service-related notices (security alerts, updates, support messages)
- Respond to your requests and provide customer support
- Detect, prevent, and address technical issues and security threats
- Comply with legal obligations
We do not use your content or personal information to train AI models.
Legal Bases for Processing
Where the GDPR or similar laws apply, we process your information on the following bases:
- Contract: Providing the service you signed up for, including your account, billing, and support.
- Legitimate interests: Securing the service, preventing abuse, and improving features.
- Legal obligation: Complying with tax, accounting, and other legal requirements.
- Consent: Optional communications you opt in to. You may withdraw consent at any time.
Data Sharing
We do not sell your personal information. We may share your information with:
- Service providers: Payment processors, email delivery services, and hosting providers that help us operate the service.
- Legal requirements: When required by law, subpoena, or to protect our rights and the safety of our users.
- Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.
Data Security
We implement industry-standard security measures including:
- Encryption in transit (TLS/HTTPS) and at rest
- Row-level security (RLS) for database access control
- Rate limiting and brute force protection
- Regular security audits and monitoring
- Account lockout after repeated failed login attempts
If we become aware of a breach affecting your personal data, we will notify you and, where required, the relevant authorities without undue delay.
Data Retention
- Account data: Retained while your account is active. Deleted within 30 days of account closure, subject to legal retention requirements.
- Backups: Database backups are retained for 30 days and then permanently deleted.
- Logs: Server logs are retained for 90 days for security and debugging purposes.
Your Rights
Depending on your jurisdiction, you may have the right to:
- Access: Request a copy of the personal information we hold about you.
- Correction: Request correction of inaccurate personal information.
- Deletion: Request deletion of your personal information.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing of your personal information.
- Complaint: Lodge a complaint with your local data protection authority.
To exercise these rights, contact us at the email address below. We will never discriminate against you for exercising any privacy right, and we do not sell or share personal information as those terms are defined under California law.
International Data Transfers
Your data may be processed in countries other than your country of residence. Where we transfer personal data internationally, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.
Children's Privacy
Our service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date.
Contact Us
If you have questions about this Privacy Policy, please contact us at b@hyperformant.co.