Legal
Initial document for MVP pilots. It must be reviewed by a legal professional before the product is sold publicly.
For questions about how your data is processed or to exercise your rights, email privacy@vibesup.app.
We store the information needed to manage bookings: business name, services, opening hours, professionals, customers, phone numbers, email addresses, internal notes and appointments. Sensitive fields are encrypted or stored as secure hashes when used for safe lookup.
We use this information to create public business profiles, manage schedules, avoid overlaps, maintain customer history, respond to support requests and prepare customer-service automations.
CSV or XLSX files used by the importer are read on the device and the original file is not uploaded to VibesUp. Temporary rows are encrypted and deleted when the process is completed or cancelled, or after 24 hours if an unfinished preparation is abandoned. The subject and description of support requests are encrypted, and closed requests are deleted after one year.
If you joined during the early-access phase, we retain your email under the consent you provided so we can manage the opening notice and your unsubscribe preference. We store the email in encrypted form, a secure fingerprint to prevent duplicate registrations and limited information about the originating page or campaign. We do not store the complete URL or include your email in Analytics. You can unsubscribe using the link in the email or request deletion by writing to privacy@vibesup.app. The waiting-list form is now closed and account registration is open.
The MVP AI agent currently works as an internal simulator. When real WhatsApp connectivity is introduced, every conversation must remain isolated by business, customer and channel so that information is not mixed between customers.
The backend uses Convex with authentication, business-level access controls and encryption for sensitive information. Private queries must not accept an arbitrary business without verifying that it belongs to the authenticated user.
You may request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent, by writing to privacy@vibesup.app. You may also lodge a complaint with the Spanish Data Protection Agency.
On public pages, VibesUp may use Google Analytics 4 to understand general visits and journeys when the visitor accepts it. Advertising measurement and ad personalisation remain disabled. The choice is stored in the browser and can be changed using the Cookies link in the homepage footer. For voluntary registration attribution, we keep the entry page and limited campaign values during the session; they are only sent to VibesUp when the form is completed. We do not include email addresses, phone numbers, complete URLs or business data in analytics events.
We use Vercel Speed Insights to understand aggregated technical metrics such as loading time, responsiveness and visual stability. When error diagnostics are enabled, Sentry will be configured in its European region with strict data minimisation: no session recording, form content, cookies, authorisation headers, email addresses, phone numbers or complete URL parameters. These tools are used to maintain the security, stability and performance of the service, not for advertising or commercial profiling.