Privacy Policy

Account data (name, email, sign-in identity via Clerk), your business profile (the brief you fill in), content the AI team produces for you, which channels you have linked and the credentials for them — encrypted at rest (AES-256-GCM) and decrypted only on our servers to publish a piece you approved or to test the connection at your request; on deployments without an encryption key nothing is stored and the app says so, usage metrics, and billing records (payments are processed by Stripe — we never see full card numbers).

If you ask us to fill your brief in from your website — or press “use the colors from your site” in your Brand kit — we also process the text of its public pages for that one request. What stays afterwards is the profile you confirmed on screen and, when that page names a logo, one copy of that image: we fetch it once, store it with your workspace and show it there, so your browser never asks your site for it again. You can replace or remove it in Settings. The pages themselves are not part of your workspace data. To pick your brand colors we also open up to two of that site’s own style files — the ones on its own address, or the file its website builder compiled from its settings — and only the colors are taken from them, no text.

To run the service: the AI team needs your business profile to produce relevant content; connections are needed to publish; usage metering enforces your plan’s caps; analytics connections (Google Search Console, GA4) are used only to report your own growth back to you.

The text of your public pages is used for one thing only: drafting the brief you then check and correct. It is not used to train anything and not shared with other customers.

We do not sell your data or use your business content to train models for other customers.

Data is stored in tenant-isolated Postgres (Neon) with row-level security, and files in Cloudflare R2. Subprocessors include Neon, Clerk, Stripe, OpenAI, Google, Cloudflare, Inngest, DataForSEO, Sentry and Vercel — each receives only what its function requires. Our requests to the model provider will pass through CheapVibeCode once we switch to it — a gateway operated from Russia that will then receive the same data, choose the provider it passes them to and, under our written agreement, not store their content; Annex III of the DPA describes it. Sentry receives error messages when our software fails, and is configured not to receive your account details, a recording of your screen or the values of variables from the failing code. DataForSEO receives a short phrase from your brief, or the name of a product category your sitemap lists, when your team picks a topic, so that the topic is something people actually search for; Annex III of the DPA says exactly what that phrase contains.

When you ask us to read your website, the text of those pages goes to OpenAI — the model that drafts the profile — (through the CheapVibeCode gateway once we switch to it) and to nobody else who could use it for anything but running that request. When an article of yours has to state a rule or a standard, we open the public page it is about to cite and send that page’s text to the same model, which answers whether the page says it; we keep the address and the one sentence we quote, and none of the rest. We keep that text in your workspace and send it with each article we write for you, both to the model writing it and to the reviewer checking it, so that your team works from what your site already says instead of guessing; we fetch the pages again when what we kept is more than 30 days old. Where no model key is set on our side, we do not read the site at all and tell you so.

Apart from your logo, the pages we read from your website are not kept at all: at most five public pages, and of each we send at most 8,000 characters — its title, its meta description, up to 2,000 characters of its JSON-LD markup and then its visible prose, assembled in that order and cut at 8,000 — and only for as long as that one request runs. Nothing from them is written to your workspace — what stays is the profile you confirmed on screen. One exception: if your Brand kit has no colors and your brief names your website, before an article we open your home page (only that page, and none of its style files) and save the colors it uses to your Brand kit, where you can change or remove them.A page an article cites is treated the same way: we open it once, send at most 8,000 characters of it to the model that checks the claim, and keep only its address and the sentence the article quotes. Separately, we read the sitemap files your site publishes for search engines and keep the addresses and names of the product and category pages they list, so that an article can link to them and so that up to two category names can be looked up as search phrases, as Annex III of the DPA describes under DataForSEO; no product or category page is opened for this.

One line about the read does stay: a usage record with the address you asked us to read, when it ran and what it cost us. It belongs to your workspace and goes when the workspace goes — “Delete this workspace…” under Settings → Account removes it along with everything else.

The daily cap on site reads is deliberately outside that: we keep today’s date and how many reads it has used, and those two numbers survive deletion. Otherwise the cap could be cleared by the person it applies to, one new workspace at a time.

Deleting a workspace does not erase everything, and this is the whole of what stays. Your billing and plan record, and the row that ties your organization to Stripe — for as long as the law requires us to keep them. Your email address in our records, but only while a membership in another workspace still holds it; once nothing holds it, it goes too. If you also subscribed to our newsletter from the footer of this website, that address is removed by the same click.

Deletion is not instant everywhere at once: our database keeps a short recovery window, currently six hours, from which a copy could technically be restored. After that window passes, the deleted rows are gone from backups too.

You can export all your organization’s data or delete it from the workspace settings (billing records are retained where the law requires; channel credentials are never part of an export). You can also request either by email. Disconnecting a channel erases the credentials we hold for it, so we can no longer reach it.

We use strictly necessary cookies for sign-in and CSRF protection. Analytics cookies, if introduced, will be consent-gated.

Privacy questions and data requests: vibrantmedialondon@gmail.com.