Privacy Policy

This policy covers the personal data VibeForMe.ai collects through the platform at vibeforme.ai, what we do with it, who else touches it, and what you can require of us. It applies whether you have an account or are only reading.

VibeForMe.ai is the data controller for that data. For anything in this policy, email privacy@vibeforme.ai.

Two related documents sit alongside this one: the Cookie Policy and the GDPR page, which sets out your rights in more detail and how to exercise them. Where this policy and that page describe the same right, they are meant to say the same thing; tell us if they do not.

What you give us when you sign up. Your email address and name, and whether you are here as a developer or a business. If you sign in with Apple or Google, we receive the email address and name on that account — and if you use Apple's Hide My Email, the address we receive and store is the relay address Apple generates rather than your own. We never receive your password: authentication is handled by Clerk.

What you write. Your profile — headline, bio, skills, rates, availability, location, portfolio projects, certifications, links to accounts elsewhere. For a business: industry, team size, location, and the description of your company. Everything in a project brief. Every pitch and every message you send. Any file you upload.

Billing data, if you subscribe. Which plan, when it started, its status, and the payment history — held by Stripe and referenced by us. We never see or store your card number.

What the platform records as you use it. Who viewed which profile and when, which pitches were sent, accepted or declined, saved searches and saved developers, your notification preferences, and timestamps on all of it. This is the data behind the analytics we show you about your own profile.

Technical data. The IP address, user agent and requested page that reach our host with any web request, and the cookies described in the Cookie Policy. The cookies the platform requires are for signing you in (Clerk), for payment (Stripe), and — only if you start connecting a GitHub account — two short-lived cookies of our own (github_oauth_state and github_oauth_return) that carry you back to the right page afterwards and expire within minutes.

We do not ask for and do not want special-category data — health, beliefs, politics, anything of that kind. Do not put it in a profile or a brief.

Under the GDPR we rely on four bases, which are the four on our GDPR page:

• Contract — to give you the marketplace you signed up for: your account, your profile, the matching, the pitches, the messages, the subscription.
• Legitimate interest — to keep the platform safe and working: preventing spam and fraud, investigating reports, fixing faults, and improving the product.
• Consent — for marketing email. Every marketing email has an unsubscribe link, and you can turn each kind of notification off in Settings.
• Legal obligation — tax and accounting records, and responding to lawful requests.

We do not sell your personal data. We do not share it with advertisers. We do not use it to build profiles of you for anybody else's purposes.

We use a small number of providers to run the platform. Each acts on our instructions, for the purpose in the table and no other. This is the complete list of providers we send your data to.

One thing sits outside that table because it works differently. If you connect a GitHub or Stack Overflow account, we call api.github.com and api.stackexchange.com using the access token you authorised, to read the public profile we show on your VibeForMe profile. Those services receive your token and the request — they do not receive your VibeForMe data, and none of this happens unless you connect an account.

These providers are based in the United States, so using the platform involves transferring your data there. Where that transfer is from the UK or the EEA we rely on the transfer terms in each provider's data processing agreement.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If VibeForMe is ever sold or merged, data moves with the business, and this policy continues to apply to it until you are told otherwise.

Several features are built on a large language model: suggesting developers for a project, turning a sentence into a structured brief, and drafting pitches, messages and profile copy. The model is Claude, made by Anthropic, and we reach it through Anthropic's API.

When you use one of those features, the content it needs is sent to Anthropic — the brief you are writing, the profile and project being matched, the message you asked for help with. It is sent to produce that one result. We do not send your email address, your billing data, or the identity of an anonymous business.

We do not train any model on your data, and we have no model of our own to train. Anthropic processes what we send under its API terms as our processor.

You are not required to use these features. Writing a brief, a pitch or a message yourself sends nothing to Anthropic.

Some of what you write is meant to be seen, and it helps to be exact about which parts.

• A developer profile is public. It has its own URL, anybody can open it, and search engines can index it. Your email address and billing data are not part of it.
• A business is anonymous by default. Developers browsing projects see the brief, industry, team size, location, budget range and timeline. They do not see your company name, website or logo — the queries that serve briefs do not read those fields. That changes when you accept a pitch or start a conversation yourself, which reveals your identity to that one developer.
• Pitches and messages are visible to the people in that conversation. We can access them where we need to — a report, a dispute, a legal obligation — and not otherwise.
• For the first 24 hours after an account is created, what it publishes is not shown to anybody else.

While your account is open, we keep your data so the platform can work. When you close it, from Settings, several things happen at once:

• the messages you sent are deleted outright
• your sign-in is deleted at Clerk, so the account cannot be used again
• an active subscription is cancelled
• your developer profile stops being visible, pitches awaiting an answer are expired, open projects are closed, and conversations are archived
• your account record is marked deleted and stripped of what identifies you: the email address is replaced with a placeholder and the name becomes "Deleted User"

So closure is not total erasure, and we would rather say so than imply otherwise. The records your account was attached to — a brief you posted, a pitch you sent, the conversation it started — survive in that de-identified state, because they are equally the other side's record of their own work. We also keep what the law requires us to keep, in particular billing and tax records.

If that is not enough for you, you can ask for more. Section 8 explains how, and what we may have to retain even then.

If the GDPR applies to you, you have the right to:

• get a copy of the personal data we hold about you
• have it corrected when it is wrong or incomplete
• have it erased
• receive it in a structured, machine-readable format so you can take it elsewhere
• have us restrict processing while a complaint or a correction is being worked out
• object to processing for marketing
• withdraw a consent you gave, without that affecting what was lawful before you withdrew it

Our GDPR page sets out each of these in full. In practice:

• To get a copy of your data, use Settings → Data & Privacy, which exports it as a JSON file: your account, profile, portfolio, projects, pitches, conversations, messages, matches and subscription records.
• To correct something, edit it — most of it is editable in the product.
• To turn off notifications, use Settings, or the unsubscribe link in any email.
• For anything else, including erasure beyond what closing your account does, email privacy@vibeforme.ai.

We respond to a request within 30 days. We may ask you to confirm who you are first, which is a protection for you rather than an obstacle. If we have to refuse part of a request — because a record is one we are required to keep, or because it is as much somebody else's as yours — we will say which part and why.

If you think we have handled your data badly, tell us and we will try to put it right. You also have the right to complain to your data protection authority without going through us first.

Passwords and sign-in are handled by Clerk; card details by Stripe. Traffic to the platform is encrypted in transit, data is stored in managed infrastructure with access limited to what operating the service requires, and access to your messages is limited to the reasons in section 6. No system is perfectly secure, and we will not pretend otherwise: if a breach affects your data, we will tell you and the relevant authority as the law requires.

The platform is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, email privacy@vibeforme.ai and we will delete it.

We will update this policy as the platform changes — a new provider, a new feature, a different retention period. The date at the top says when it last changed, and we will tell you about a change that materially affects you rather than leaving you to notice it.

For any question about this policy, or to exercise a right in section 8, email privacy@vibeforme.ai. For anything else, support@vibeforme.ai.