# Privacy policy > What we collect, what we do not, retention, sub-processors and your rights. Source: https://vibedasher.com/privacy # Privacy Policy **Last Updated:** September 30, 2026 ## Introduction At Vibedasher, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Business Intelligence platform. ### Which role we are in Two different kinds of data pass through Vibedasher, and we are not in the same role for both. A reviewer needs the distinction before anything else on this page means what it seems to: - **Your account data** — name, email, company, billing details, and how you use the product. We decide why and how it is processed, so for this we are the **controller**, and this policy is the notice for it - **The data you connect or upload**, and the dashboards built from it. We process it on your instructions, for your purposes; for this we are a **processor** and you are the controller. We do not use it for our own purposes and we do not decide what is in it Our contact details are at the end of this page, and the contracting entity's postal address — which is not yet published on the site, and which you can request — is in the contact block of our [Terms of Service](https://vibedasher.com/terms). **We do not publish a standard Data Processing Agreement today.** If your organisation needs one signed, email [legal@vibedasher.com](mailto:legal@vibedasher.com) and we will agree one with you, rather than point you at a page that does not exist. ## Information We Collect ### Personal Information We collect information that you provide directly to us, including: - **Account Information**: Name, email address, password, and company details - **Profile Information**: Job title, department, and preferences - **Payment Information**: Billing address and payment method details (processed securely through Stripe) - **Communication Data**: Messages, feedback, and support requests ### Usage Information We automatically collect certain information when you use our platform: - **Log Data**: IP address, browser type, operating system, and access times - **Usage Analytics**: Features used, dashboards created, and interaction patterns. We use PostHog, including **session replay**, which records your interactions with the application interface. - **Device Information**: Device type, unique device identifiers, and mobile network information - **Cookies and Similar Technologies**: We use cookies to enhance your experience and analyze usage ### Data You Upload When using Vibedasher, you may upload or connect your data sources: - **Database Connections**: Connection strings and credentials (encrypted at rest) - **Uploaded Files**: CSV, Excel, and other data files - **Query Results**: Cached query results for performance optimization - **Visualizations**: Charts, dashboards, and reports you create ## How We Use Your Information We use the information we collect to: - **Provide Services**: Operate, maintain, and improve our platform - **Process Transactions**: Handle billing and payment processing - **Communicate**: Send service updates, security alerts, and support messages - **Personalization**: Customize your experience and provide relevant features - **Analytics**: Analyze usage patterns to improve our services - **Security**: Detect, prevent, and address security incidents and fraud - **Compliance**: Meet legal obligations and enforce our terms ## Data Storage and Security ### Security Measures We implement industry-standard security measures to protect your data: - **Encryption**: Data is encrypted in transit (HTTPS, TLS 1.2 minimum and TLS 1.3 with modern clients) and at rest (AES-256) - **Access Controls**: Role-based access control, with account isolation enforced server-side on every request (multi-factor authentication for end users is on our roadmap, not yet available) - **Monitoring**: structured application logging in AWS CloudWatch - **Infrastructure**: hosted on AWS, whose own infrastructure holds SOC 2 Type II and ISO 27001 certifications (these are AWS's certifications, not Vibedasher's) - **Breach notification**: we notify affected users of a confirmed breach without undue delay, and within 72 hours where the GDPR requires it. Our [Security](https://vibedasher.com/security) page states this commitment in full, together with what our monitoring does and does not do today ### Data Retention - **Account Data**: Retained while your account is active and for 90 days after deletion - **Application Logs**: Retained 3 to 30 days depending on the service - **Backups**: Point-in-time recovery on our primary datastores, with a rolling 35-day window - **Legal Holds**: Data may be retained longer if required by law ## Data Sharing and Disclosure ### Third-Party Services We share data with trusted third-party service providers: - **Cloud Infrastructure**: AWS (data hosting and processing) - **Payment Processing**: Stripe (payment transactions) - **Product Analytics**: PostHog (usage analytics and session replay) - **Email**: **Resend** delivers account email (invitations, address verification, password reset) and the email the product sends on your behalf — alert notifications and dashboard subscriptions. Those last two carry **rendered dashboard content**: the alert's values in the body, and the dashboard capture inline and as an attachment. Resend is therefore a sub-processor that can see business data, not only addresses - **AI Services**: **OpenRouter**, which routes your prompts to the underlying model provider you select (Anthropic, Google, Mistral, DeepSeek, Meta, xAI and others). This applies only when you use AI-powered features, and OpenRouter is a sub-processor for every such request. All third parties are contractually obligated to protect your data and use it only for specified purposes. **This list is the authoritative one.** Our [Security](https://vibedasher.com/security) page names the same vendors from an infrastructure angle; if the two ever disagree, rely on this list and tell us at [privacy@vibedasher.com](mailto:privacy@vibedasher.com). ### Legal Requirements We may disclose your information if required by law or in response to: - Valid legal processes (subpoenas, court orders) - Requests from law enforcement or government agencies - Protection of our rights, property, or safety - Investigation of fraud or security issues ### Business Transfers In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. ## Your Rights and Choices ### Data Access and Control You have the right to: - **Access**: Request a copy of your personal data - **Correction**: Update or correct inaccurate information - **Deletion**: Request deletion of your account and data — available self-serve in the product - **Portability**: Export your data in a machine-readable format - **Objection**: Opt out of certain data processing activities - **Restriction**: Limit how we process your data Account deletion is built into the product. The other rights are **not yet self-serve** — email [privacy@vibedasher.com](mailto:privacy@vibedasher.com) and we will action them for you. ### Cookies, analytics and session replay The honest answer here is not the reassuring one, so: - **We do not present a cookie consent banner today.** Analytics start when the page loads. A consent gate is on our roadmap; until it ships, this section is the notice - The cookies we set ourselves are the ones the product needs in order to work — your signed session, which account you are in, and your language and theme. Blocking those stops you logging in - **PostHog** sets its own identifiers and runs **session replay** on the application. Replay records what happens in the interface, so it can capture the dashboards and figures on your screen. Credential-shaped URL parameters are stripped before anything is sent, and replay is switched off on the shared dashboard viewer, the OAuth callback and the password-reset page. It is active on the rest of the application - The marketing site at vibedasher.com loads no analytics and is not replayed - To be excluded from analytics and replay, email [privacy@vibedasher.com](mailto:privacy@vibedasher.com) and say so; blocking PostHog in your browser or extension also works ### Marketing Communications You can opt out of marketing emails by clicking the unsubscribe link or updating your preferences in your account settings. ## On-Premise Deployment For customers using our on-premise or self-hosted solution: Self-hosting is an Enterprise engagement scoped with us rather than a self-serve download. Where we deploy into your infrastructure: - **Data Sovereignty**: Your data remains on your infrastructure - **No Cloud Storage**: We don't store or access your data unless you explicitly grant access for support - **Local Processing**: Analytics run on your infrastructure. AI features still require an API key for a hosted AI provider — we do not ship a bundled local model. - **Audit Logs**: Full control over access logs and monitoring ## Children's Privacy Vibedasher is not intended for users under 16 years of age. We do not knowingly collect personal information from children. ## International Data Transfers If you're accessing Vibedasher from outside the region where our servers are located, your data may be transferred internationally. We ensure appropriate safeguards are in place, including: - Standard Contractual Clauses (SCCs) approved by the European Commission - Data processing agreements with third parties We run in AWS `us-east-1` (North America) and `eu-central-1` (Europe), and the split between them is not something you choose: - **Identity and account records are held in `us-east-1` (United States) for every account, wherever you are.** Your email address, credentials and account membership therefore leave the EU by design, on every sign-in - **Dashboards, datasets and query results are processed and stored in `eu-central-1` (Frankfurt).** That is the only data-plane region running today - **There is no region selector in the product.** If a data-residency requirement means this does not work for you, tell us at [privacy@vibedasher.com](mailto:privacy@vibedasher.com) before you upload anything ## Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of material changes by: - Email notification to your registered email address - Prominent notice on our website or platform - In-app notification upon login Continued use of Vibedasher after changes constitutes acceptance of the updated policy. ## Contact Us If you have questions or concerns about this Privacy Policy or our data practices: - **Email**: [privacy@vibedasher.com](mailto:privacy@vibedasher.com) - **Data Protection Officer**: [dpo@vibedasher.com](mailto:dpo@vibedasher.com) For EU residents, you have the right to lodge a complaint with your local data protection authority. ## Regional-Specific Information ### California Residents (CCPA) California residents have additional rights under the California Consumer Privacy Act: - Right to know what personal information is collected - Right to know if personal information is sold or disclosed - Right to opt out of the sale of personal information (Note: We do not sell personal information) - Right to non-discrimination for exercising CCPA rights ### European Residents (GDPR) For users in the European Economic Area, UK, and Switzerland: - **Legal Basis**: We process data based on consent, contract performance, legal obligations, and legitimate interests - **Data Protection Officer**: Contact [dpo@vibedasher.com](mailto:dpo@vibedasher.com) - **Right to Object**: You can object to processing based on legitimate interests - **Automated Decision-Making**: We don't make automated decisions that significantly affect you without human review * * * This policy is effective as of September 30, 2026. Please review it periodically for updates.