Privacy Policy

Who is responsible

[Operator legal name and address — to be completed before launch] is responsible for personal data processed to run VibingView. Questions and requests: support@vibingview.com.

Data we process

We collect only what we need to run, bill and protect the service:

• Account data: display name, email address, a bcrypt hash of your password, email-verification state, encrypted two-factor secrets and hashed recovery codes.
• Sessions and security: hashed session and API tokens, a hashed IP address and browser user-agent for sessions, rate-limit counters and audit events for security-relevant actions.
• Billing data: wallet transactions, payment attempts, amounts, currency and the payment provider's reference. Card and crypto payment details are entered with the payment provider and are not stored by us.
• Service data: workspaces, applications, build settings, deployment and runtime logs, resource metrics, domains and DNS verification state. Environment variables, database credentials and connected GitHub tokens are encrypted at rest.
• Support and abuse data: the content of support tickets and, for abuse reports, the reporter's email address, the reported URL and the description provided.

Why we use it

We use this data to provide the service you ordered, to take payments and keep accurate wallet records, to secure accounts and prevent fraud and abuse, to answer support requests, and to meet legal and accounting obligations. [Legal bases for each purpose to be confirmed during legal review.]

Providers that help us

We share data with service providers only as needed for these purposes. Depending on which features are enabled, they are:

• Cloud infrastructure providers that host the control plane and customer VPS workspaces.
• DNS providers that publish generated application hostnames.
• Payment processors for card and cryptocurrency top-ups.
• A transactional email provider for verification, password-reset and service emails.
• A source-control provider, only if you connect your GitHub account.
• A bot-protection provider (Cloudflare Turnstile) on sign-up, support and abuse forms, when enabled.
• A web-analytics provider on public marketing pages only, when enabled. The dashboard and admin areas never load analytics.

Cookies

The dashboard uses one essential, HTTP-only session cookie to keep you signed in. If the operator enables analytics, the analytics provider may set its own cookies on public pages; it is not loaded in the dashboard. [Consent handling for analytics to be confirmed before it is enabled in regions that require it.]

Retention

Account data is kept while your account is open. Logs are bounded and rotated. Financial records are kept as long as accounting law requires. Data stored on a workspace is destroyed when that workspace is cancelled. [Exact retention periods to be finalised.]

Your choices and rights

You can update your profile, revoke sessions and tokens, and delete applications and databases from the dashboard. Depending on where you live you may also have rights to access, correct, export, restrict or delete your data and to complain to a data-protection authority. Contact support@vibingview.com to make a request.

Security

We use TLS, hashed credentials, AES-256-GCM encryption for stored secrets, scoped tokens, rate limits and audit logs. No system is perfectly secure; please report vulnerabilities to support@vibingview.com.