Privacy Policy

1. Who we are and how to reach us

Vibely is operated by Mana Intelligence Private Limited, incorporated in India. For the personal data described in this policy we are the controller under the GDPR and the UK GDPR, and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.

Write to us at the address that fits your question. We answer all of them from India.

• Privacy, data protection and rights requests: [email protected].
• Billing and refunds: [email protected].
• Grievance Officer (India, IT Rules 2021, rule 3(2)(a)): Benna Bala Krishna, Director, Mana Intelligence Private Limited. Contact [email protected]. We acknowledge a grievance within 24 hours of receipt and dispose of it within 15 days, which is what rule 3(2)(a) requires. A complaint under rule 3(2)(b) — content exposing a person's private area, showing them in full or partial nudity or in a sexual act, or impersonating them, including a morphed image — is acted on within 24 hours of the complaint. Content a court orders us to remove, or a government agency notifies us to remove, comes down within 36 hours under rule 3(1)(d).
• EEA and UK: Vibely is operated from India by Mana Intelligence Private Limited. Data subjects in the EEA and the UK can reach us at [email protected], and may lodge a complaint with their local data protection supervisory authority.
• We do not currently name a representative under Article 27 of the GDPR or the UK GDPR, and we do not have a statutory Data Protection Officer. Rather than point you at a representative you cannot contact, we say so here: requests reach us directly at [email protected] and are answered within 30 days.

2. The personal data we collect, and where it comes from

Three sources: what you give us, what the service records as you use it, and what a third party you chose hands back to us.

• From you, directly: your email address, name, username and avatar; your password or the identity you sign in with; the prompts, files, images and screenshots you send the agent; the source code, designs and configuration in your projects; the connector credentials you authorise; and anything you write to us in support.
• Generated as you use Vibely: your project's message and version history, snapshots and deployment metadata; your credit ledger and per-turn usage metering; your workspace, plan and membership records; IP address, device, browser, and request timestamps; server logs and browser error beacons.
• From your sign-in provider: if you sign in with Google, GitHub or Apple, that provider returns your email address, name and avatar to us.
• From our payment processor: Razorpay returns the status of a payment and limited card metadata. We never receive or store your full card number.
• From connectors you authorise: the third-party account identifiers for accounts you connect, and the OAuth tokens that let your project act on them. We store those tokens encrypted in our own database — including for every Google connector — except for the connectors routed through Composio, our connector gateway, which holds their tokens itself.
• From analytics, only if you consent: see "What our analytics actually do" below.

3. What we use it for

We use personal data for these purposes and no others:

• Running the service: creating your account, running agent turns on your instruction, serving previews, publishing apps, and building native binaries.
• Billing: charging your plan, metering credits, keeping the credit ledger, and keeping the payment and tax records we are required to keep.
• Keeping the service up and safe: rate limiting, abuse and fraud prevention, incident response, and debugging failures.
• Talking to you: transactional email about your account, and answering your support messages.
• Understanding how the product is used, if you consent to analytics.
• Improving the product from usage telemetry, if you turn that on. It is off by default — see "Training and product improvement".
• Meeting legal obligations and responding to lawful requests.

4. Our legal basis for each purpose (GDPR Article 6)

If you are in the EEA or the UK, this is the basis we rely on, purpose by purpose:

5. What our analytics actually do

Analytics run only after you accept them, and you can withdraw that at any time from the "Cookie preferences" link in the page footer. They are not anonymous once you are signed in. We say this plainly because the opposite claim is the one most privacy policies make and cannot stand behind.

These are the tools, and this is what each one does:

• PostHog — product analytics. Once you are signed in we associate your events with your account id and your email address. In production it also records interaction heatmaps and session replays of your use of the Vibely app: pointer movement, clicks and navigation. Replays do not capture request or response bodies, request headers, or the contents of password fields, and they do not extend to the apps you build and publish.
• Google Analytics 4 and Google Tag Manager — aggregate traffic measurement on our marketing pages. Advertising storage, ad user data, ad personalisation and personalisation storage are pinned to denied in our tag configuration and are not wired to the consent banner, so they stay denied even if you accept everything.
• Cloudflare Web Analytics — a cookieless performance beacon served by our CDN. It sets no cookies, stores nothing on your device, and does not identify you.
• Sentry — error and performance monitoring. It attaches your account id to a crash report so we can reach you about it.
• We run no advertising cookies, no retargeting pixels, and no cross-site tracking. We do not sell personal data, and we do not share it for cross-context behavioural advertising. The cookies themselves are listed under “Cookies and similar technologies” below, and the California position is at Do Not Sell or Share My Personal Information.

6. Cookies and similar technologies

Cookies are small text files stored on your device when you visit a site. We use local storage and session storage for the same purposes and treat them the same way here.

Essential cookies are required for the service to work and you cannot opt out of them: authentication cookies that keep you signed in, session cookies that hold your workspace state, security cookies carrying CSRF and fraud-detection tokens, and load-balancing cookies that route your request to the right instance. Blocking them prevents you from signing in.

Analytics cookies run only after you accept them. They collect page views and feature usage, session duration and navigation paths, browser, device category and country-level region, and performance timings. The four tools and exactly what each does are listed in the section above. Blocking them does not affect your ability to use Vibely.

Some third parties set their own cookies: Razorpay for checkout and billing, and Sentry for crash and performance reports. Stripe cookies are set only inside apps you build that use the Stripe connector — never on Vibely itself.

We run no advertising cookies, no retargeting pixels, and no cookies that track you across other sites.

You can change your analytics consent at any time from the “Cookie preferences” link in the page footer, or under Settings → Privacy & security when signed in. Withdrawing takes effect immediately. Your browser can also view, block and delete cookies: Chrome → Settings → Privacy and security → Cookies; Firefox → Settings → Privacy & Security → Cookies; Safari → Preferences → Privacy → Manage Website Data.

7. Training and product improvement

Vibely does not use your prompts, code, or project data to train models. Product-improvement data collection is off by default on every plan and collects usage metrics only — model, provider, token counts and cost — never prompts or code. You turn it on, if you want to, at Settings → Privacy & security → Data protection → "Allow data collection for training", and you can turn it off again at any time.

That commitment is about Vibely. What third-party model providers do under their own terms is set out in the next section.

8. AI model providers

Vibely routes prompts to third-party AI model providers. OpenAI, Anthropic, Google and Fireworks each state in their own published API terms that API inputs are not used to train their models — that is their published commitment, not one we have negotiated with them or can audit. DeepSeek is used under its standard terms, which permit using inputs to improve its models, and processes data in China. Providers receive only the input necessary to fulfil a turn and standard request metadata.

If you need your prompts kept away from a particular provider, email [email protected] before you start building.

9. How long we keep each category

These periods are enforced by an automated nightly purge, not by someone remembering to run it.

Server logs, backups and the retention our analytics and error-monitoring vendors apply on their side follow those vendors' own schedules. Email [email protected] if you need the current position for a specific vendor.

10. Data in the apps you build

An app you build and publish on Vibely can collect data from its own users — a contact form, a signup, a submission. For that data you are the controller. We are your processor only for what actually passes through our systems: the app's code and content, which we host and serve, and anything you hold in a Vibely project.

What an app's form collects does not land with us. We host the published build and its static files; we do not run a database or a backend for your app, so a submission goes to whatever service you wired the form up to, under your own account with that provider. We cannot read it, retain it or delete it for you, and you should not tell your users we hold it. You are responsible for telling your app's users what you collect and why, for having a lawful basis to collect it, and for the retention you set at the service that stores it. Our Article 28 data processing agreement covering this is published at Data Processing Agreement; it applies without signature, and [email protected] will execute a counter-signed copy if your procurement process needs one.

11. Data from Google accounts you connect

Vibely's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

When you connect a Google account (Gmail, Google Calendar, Drive, Sheets, Docs, Slides or Search Console) you choose which permissions to grant, and Google shows them to you before you agree. We use that access only to do what you or the app you built asks of it: reading, creating or sending the items the request names.

• Google user data is passed to an AI model provider only as part of an agent turn you started, and only to complete that turn. It is not used to train or improve any AI or machine-learning model, ours or anyone else's.
• We do not sell Google user data, use it for advertising, or use it to build a profile of you.
• No one at Vibely reads it, unless you ask us to for support, it is needed for security or abuse investigation, or the law requires it.
• Disconnecting the connector deletes our copy of the token and asks Google to revoke it. You can also revoke Vibely at any time at myaccount.google.com/permissions.

12. Who we disclose personal data to

We disclose personal data to a small, named set of service providers, and otherwise only where the law requires it. We do not sell personal data.

• Our subprocessors: cloud hosting, database and storage, sandboxes, CDN, payments, email, error tracking, analytics, AI inference, the connector gateway, and the mobile build pipeline. Each one, what it does and where it processes, is published in Annex 3 of our Data Processing Agreement.
• Law enforcement, regulators or a court, where we are compelled by a valid legal request or where disclosure is necessary to protect someone from serious harm.
• A buyer or successor, if Vibely is acquired or merged. We will tell you before your personal data moves to a new controller.

13. International transfers

Vibely is operated from India by Mana Intelligence Private Limited. Our infrastructure is not in one country: application servers and the sandboxes your projects run in are in the United States (AWS us-east-1), while the primary database, authentication and file storage run on Supabase in Singapore (ap-southeast-1), and our CDN serves from edge locations worldwide. So your personal data is processed in the United States and in Singapore, and is accessible to our team in India. We do not operate an EU or India hosting region today and we are not naming a date for one; we will update this policy before we change where data is stored.

The European Commission has not issued an adequacy decision for India. Transfers from the EEA or the UK to us therefore rely on Article 46 safeguards rather than adequacy. Our US and EU subprocessors are engaged under their own published data processing terms, which incorporate the European Commission's Standard Contractual Clauses where the vendor offers them. DeepSeek processes data in China and we do not hold Commission-approved Standard Contractual Clauses with it.

If you are in the EEA or the UK and need a specific transfer mechanism in place before you send us personal data, email [email protected] and we will tell you exactly what we can and cannot evidence today.

14. Your rights, and how to use them

Depending on where you live you have the right to access your personal data, to get a copy of it, to have it corrected, to have it deleted, to restrict or object to processing, to withdraw a consent you gave, and to nominate someone to act for you if you die or lose capacity (India, DPDP Act section 14).

Three of these you can exercise yourself, right now:

• Delete your account and the personal data in it: Settings → Account → Delete account.
• Withdraw analytics consent: the "Cookie preferences" link in the page footer. It takes effect immediately.
• Turn product-improvement telemetry off (it is already off unless you turned it on): Settings → Privacy & security → Data protection.
• For anything else — access, a copy of your data, correction, restriction, objection, or a nomination — email [email protected] and say which right you are exercising. We reply within 30 days. If a request is complex enough that we need longer, we will tell you inside those 30 days and why.
• We will check that the request came from you before we act on it. That normally means confirming control of the email address on the account; for a deletion or a full copy we may ask for one more factor.
• Using any of these rights costs nothing and changes nothing about your plan, your price, or the service you get.

15. California residents (CCPA and CPRA)

This section supplements the rest of this policy for California residents and describes your rights under the CCPA as amended by the CPRA. Where it conflicts with anything above, this section controls for California residents.

In the past 12 months we have collected these statutory categories: identifiers (name, email address, IP address, account username); commercial information (subscription plan, billing history, credits consumed); internet or network activity (pages visited, features used, browser and device type, and — only if you accept analytics — session replays of your use of the Vibely app); geolocation data (approximate location derived from IP address); user-generated content (prompts, project files, code and designs); and inferences drawn from those, such as which features a workspace gets stuck on.

We have not sold personal information in the past 12 months and we do not share it for cross-context behavioral advertising. Our full position, including how we treat the Global Privacy Control, is at Do Not Sell or Share My Personal Information.

Your rights: to know the specific pieces and categories we hold, their sources, our purposes and who we share them with; to delete, subject to the statutory exceptions; to correct inaccurate information; to opt out of sale or sharing (there is nothing to opt out of, but you can still switch analytics off); to limit our use of sensitive personal information (we use none beyond what running the service requires); and not to be discriminated against for exercising any of them — no denial of service, no different pricing.

To make a request, email [email protected] with the subject line “California Privacy Request” and say which rights you are exercising. You may submit up to twice in any 12-month period. We acknowledge within 10 business days and answer substantively within 45 days; if we need up to a further 45 days we will tell you why. We verify identity before disclosing or deleting, which normally means confirming the email address on the account.

Do Not Track: some browsers transmit a “Do Not Track” signal. There is no uniform standard for them and we do not alter our practices in response — California law requires us to say so. The Global Privacy Control is a different signal with a legal status of its own; Do Not Sell or Share My Personal Information explains how we honour it.

16. Complaining to a regulator

If you think we have handled your personal data badly, tell us first at [email protected] — it is usually the fastest fix. You do not have to. If you are in the EEA or the UK you can complain to the data protection supervisory authority where you live, where you work, or where the problem happened; in the UK that is the Information Commissioner's Office. If you are in India you can complain to the Data Protection Board of India, after raising it with our Grievance Officer.

17. Automated decision-making

We do not make decisions about you solely by automated means that produce legal effects or similarly significant effects. The agent is automated, but it writes code on your instruction — it does not decide anything about you. Automated signals feed our fraud and abuse checks; a suspension or termination that follows is reviewed by a person, and you can contest it at [email protected].

18. Children

Vibely is not for anyone under 18. Under the Indian Contract Act, 1872, a contract with a person under 18 is void, and we do not knowingly collect personal data from minors. If you believe a minor has given us personal data, email [email protected] and we will delete it.

19. Security

Data is encrypted in transit over HTTPS/TLS, and at rest by the default storage encryption our cloud providers apply. Access to production systems is limited to the small number of people who operate the Service, over cloud accounts protected by multi-factor authentication. Connector credentials and tokens are stored encrypted and scoped per workspace. Sandboxes are isolated per project.

We hold no security certification today, and we will not imply otherwise. We do not hold a SOC 2 report or an ISO 27001 certificate, no audit against either framework is under way, and we are not naming a date for one. See Security for the current posture, which we update on the day it changes.

20. How we tell you about changes

We will announce a material change to this policy by email or in-product notice at least 14 days before it takes effect. The "last updated" date at the top of this page is the date of the most recent revision. If a change means we need a new consent from you, we will ask for it rather than assume it.