Privacy Policy

This Privacy Policy describes how VibeDay LLC (“VibeDay”, “we”, “us”), a United States company operating vibeday.com and the VibeDay platform (the “Service”), collects, uses, shares, and protects personal information. It covers our website, the logged-in product, and our marketing. For customer workspaces, VibeDay acts as the business/controller for account and billing data, and processes the content in your workspace on your instructions to provide the Service.

• Account information: email address, password (hashed by our authentication provider), name, workspace and brand details you provide, team member invitations, and your plan and settings. When you create your account, we also record your acceptance of the Terms of Service and this Privacy Policy — the timestamp, the document version, your IP address, and your browser’s user-agent — as an audit record for dispute-evidence purposes.
• Content you create and upload: topics, prompts, captions, brand kits (logos, colors, voice), images, video, audio, transcripts we generate from your uploads, scheduling preferences, and AI-generated assets in your workspace. This can include photos and recordings of people you choose to upload — see Section 3.
• Connected social accounts: when you connect Instagram, Facebook, TikTok, or YouTube (and, in future, additional platforms), we receive OAuth tokens and basic profile information (account/channel name, ID, avatar). Depending on the features you use, we also receive post metrics, comments, and direct messages from those platforms — see Sections 6–7.
• Google Analytics data (optional): if you connect your own GA4 property to the Results feature, we read aggregate traffic and conversion metrics from it — see Section 7.
• Billing information: processed by Stripe. We never store full card numbers on our servers; we store your plan, invoices, credit balance, and usage ledger.
• Usage and device data: pages visited, features used, generation counts, error logs, browser type, operating system, and IP address (for security, fraud prevention, and diagnostics).
• Trial-integrity data: to enforce our one-trial-per-person policy, we record that a person has consumed a trial (including a normalized form of the signup email).
• Support communications: messages you send to support@vibeday.com or legal@vibeday.com.

Some VibeDay features work with images or recordings of people — for example, animating a presenter photo into a talking video, or generating a reel that features a person you uploaded. Because laws such as the Illinois Biometric Information Privacy Act (BIPA) and the Texas and Washington biometric statutes treat face and voice data with special care, we want to be precise about what we do and do not do:

• Purpose. Face photos, likeness images, and audio you upload are processed only at your direction, solely to generate, animate, or edit the specific content you request, and to run safety moderation on the results.
• No identification. We do not use uploaded photos or audio to identify, verify, or recognize individuals. We do not create faceprints, voiceprints, or other biometric identifiers for identification purposes, do not build galleries of faces, and do not match faces or voices across customers or against any database.
• No sale, no training. We never sell, lease, or trade this data, and we never use it to train AI models. We configure every AI provider integration so this content is not used to train their models, as described per provider in Section 5.
• Your responsibility for third parties.If you upload a photo or recording of someone other than yourself, our Terms of Service require that you have that person’s express consent, in writing where the law requires it.
• Retention and deletion. This data follows the same lifecycle as your other content (Section 11): it stays in your workspace under your control, raw upload files are deleted on a short automatic schedule after processing, and everything is deleted when you delete the asset or your account.

• Provide and operate the Service — AI generation, rendering, transcription, scheduling, publishing, analytics, and the engagement inbox (performance of contract)
• Process subscriptions, trials, credits, and payments (performance of contract; legal obligation)
• Send transactional and account communications — receipts, trial-ending reminders, publish confirmations and failures (performance of contract)
• Moderate content for safety and enforce our Terms (legitimate interests; legal obligation)
• Detect and prevent fraud, abuse, security incidents, and trial circumvention (legitimate interests)
• Improve the Service using aggregate, pseudonymous usage data (legitimate interests)
• Marketing our own service, where permitted, with opt-out (legitimate interests / consent, per your region)
• Comply with law and respond to lawful requests (legal obligation)

We do not use your information for automated decisions that produce legal or similarly significant effects about you.

VibeDay’s generation features are powered by third-party AI providers. We send a provider only the information needed to perform the task you initiated, scoped strictly to your workspace — for example, your prompt, the relevant brand context, and the specific images, audio, or video the generation operates on.

Which providers we use

• Anthropic (Claude) — text and structured content generation; text safety moderation.
• OpenAI — image generation; fallback text generation.
• Google Cloud Vertex AI — video generation (Veo) and vision-model quality checks (Gemini).
• fal.ai — image and video model hosting used for keyframes, animation, presenter video (including ByteDance OmniHuman and Kling-family models), and image layer decomposition.
• Replicate — image and video model hosting used for keyframes, animation, and lip-sync.
• ElevenLabs — AI voiceover (text-to-speech) and music generation.
• Deepgram — transcription of video/audio you upload.

Providers may change as models improve; we will keep this list current, and every generation is logged with the provider that handled it so you can audit your workspace’s AI activity on request.

What we never send to AI providers

Your password, billing details, social platform OAuth tokens, your connected accounts’ private data, other workspaces’ data, or any information from other VibeDay customers.

Training commitment

VibeDay does not train AI models on your content. We access every provider through its commercial/API tier, not a consumer product, and we configure each integration for the strongest data protection the provider offers: Anthropic and OpenAI do not use API inputs or outputs to train their models under our agreements with them; Google Cloud contractually commits not to use customer data to train its models; fal.ai’s API terms prohibit fal from using customer content to train its products; for Deepgram we opt out of model training on every request we send; for ElevenLabs we have disabled the use of our content for training in our account settings; and Replicate’s terms license customer content only as needed to provide the service. Some generations run on third-party models hosted by these platforms (for example ByteDance and Kuaishou video models hosted by fal.ai); the content needed for such a generation is processed by that model provider under its own terms. Providers may retain inputs for a limited period for abuse monitoring under their published policies (for Anthropic and OpenAI, typically 30 days or less), then delete them.

Your control

• AI features are opt-in per action: nothing is sent to an AI provider until you initiate a generation.
• You can use VibeDay’s manual creation, upload, and scheduling features without invoking AI at all.
• AI-generated assets carry provenance metadata, and where a platform supports an AI-content label (such as TikTok’s), we apply it automatically at publish time.

Provider data-handling references: Anthropic, OpenAI, Google Cloud.

When you connect a social account, the platform sends us an OAuth token scoped to the permissions you approve. We encrypt all platform tokens at rest with AES-256-GCM and decrypt them only server-side at the moment of use (publishing, metrics reads, inbox sync). We request the minimum scopes each feature needs.

• Publishing: we send the content you scheduled to the platform’s API at the time you chose, and store the resulting post ID and status.
• Analytics: we read post and account metrics (views, likes, comments, follower counts) to show your performance dashboards.
• Engagement inbox: where you grant the relevant permissions, we sync comments and direct messages on your connected accounts so you can read and reply from VibeDay. This content necessarily includes personal information of the people who wrote it; we use it only to display it to you and send the replies and moderation actions you initiate, and it is deleted when you disconnect the account or delete your workspace.

Our use of Meta platform data complies with the Meta Platform Terms and Developer Policies; our use of TikTok data complies with the TikTok Developer Terms. You can disconnect any platform in Settings → Platform Connections — we immediately delete the stored tokens and account metadata — or revoke VibeDay’s access from the platform’s own security settings. Meta users may also trigger deletion via Meta’s data-deletion callback; you can check the status of such a request at our data deletion status page.

VibeDay’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use Google user data only to provide the features you see in VibeDay, we do not transfer it to third parties except as necessary to provide those features or as required by law, we do not use it for advertising, and we never allow humans to read it except with your consent, for security, or to comply with law. We do not use Google user data to train AI models.

YouTube API Services

The YouTube integration uses YouTube API Services (YouTube Data API v3) to publish videos to channels you connect. By using it, you agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy. We request two minimum scopes:

• youtube.readonly — used at connection time to retrieve your channel’s ID, title, and avatar so we can display the connected channel, and, where you use analytics/inbox features, to read your own videos’ public metrics and comments. We do not read watch history or subscriptions.
• youtube.upload — used at publish time to upload videos you author or generate in VibeDay and explicitly schedule for your own channel. We do not modify or delete your existing YouTube content.

We store the OAuth refresh token (encrypted with AES-256-GCM) and the channel ID/name/avatar. Access tokens are short-lived and never persisted beyond a publish action. We do not share, sell, or transfer YouTube user data to third parties, do not use it for advertising, and do not aggregate it with other platforms’ data. Revoke access any time in VibeDay (Settings → Platform Connections → Disconnect, which immediately deletes stored tokens and channel metadata) or at Google security settings.

Google Analytics (Results feature)

If you opt in to the Results feature, you connect your own GA4 property and VibeDay reads aggregate reporting data from it (sessions, traffic sources, conversions attributable to your social posts) to show what your posts drove on your website. We read reports only; we never write to your Analytics property, and the same Limited Use commitments above apply. Disconnecting deletes our stored tokens for the integration. This customer-facing integration is separate from our own site measurement described in Section 9.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not share your content with other VibeDay customers. We share information only:

• With the service providers (subprocessors) below, bound by confidentiality and data-processing terms, to operate the Service;
• With social platforms, when you publish, reply, or connect an account — at your direction;
• To comply with law, enforce our Terms, or protect the rights and safety of VibeDay, our users, or others; and
• In a merger, acquisition, or asset sale, in which case this policy continues to apply to your data until you are notified otherwise.

Current subprocessors

• Vercel (US) — application hosting and delivery
• Supabase (US, us-east-1) — database, authentication, and file storage
• Stripe (US) — payments, subscriptions, and tax
• Resend (US) — transactional email
• Inngest (US) — background job orchestration
• Sentry (US) — error monitoring
• PostHog (US) — product analytics (pseudonymous; see Section 9)
• Google (US) — Vertex AI generation, Google Analytics 4 site measurement, Cloud Run media processing
• Railway (US) — video render workers
• Anthropic, OpenAI, fal.ai, Replicate, ElevenLabs, Deepgram (US) — AI processing as described in Section 5

We will update this list as vendors change; material changes are announced per Section 17.

We use essential cookies to keep you signed in and the site working — these are always on. We also use analytics and advertising cookies — Google Analytics 4 (deployed with Google Consent Mode v2) and PostHog — to understand how people find and use VibeDay and to measure our advertising.

9.1 Your choices, and how they differ by region

• European Economic Area, United Kingdom and Switzerland: analytics and advertising cookies stay off until you accept them. You are asked on your first visit, and nothing non-essential runs before you answer.
• United States and elsewhere: these cookies run by default and you may opt out at any time. The applicable laws call for notice and a working opt-out rather than prior consent — this page is that notice, and the control below is that opt-out.

To change your choice at any time, use the “Your Privacy Choices” link in the footer of any page. Withdrawing is as easy as granting, and your choice persists on that browser until you change it.

9.2 Global Privacy Control

We honour the Global Privacy Control (GPC) signal. If your browser sends one, we treat it as a valid opt-out: we do not load analytics or advertising cookies and do not show a consent prompt, because you have already answered. This applies everywhere, not only where GPC is legally mandated.

9.3 What our product analytics provider receives

Our PostHog integration is configured to send the minimum needed to understand product usage:

• Pseudonymous identifier:your account’s internal UUID. We do not send your email, name, or any other directly identifying field.
• Page views: the path you visit, with URL query parameters stripped before transmission.
• Defined product events(e.g. "generation_created", "post_published") carrying only counts, timestamps, and opaque identifiers — never the content of your posts, captions, prompts, or brand details.
• Standard browser and device info for compatibility analysis.

We explicitly do not send PostHog your IP address (stripped at the SDK boundary), session replays, mouse movements, heatmaps, autocaptured click text, or any customer-typed content. Internal admin users are opted out entirely. PostHog stores this data in the United States; request deletion of your analytics records via legal@vibeday.com.

To keep the Service safe and comply with our AI providers’ policies, prompts and generated media pass through automated safety moderation (Anthropic text moderation and the AI providers’ built-in safety filters; a dedicated image/video moderation provider will be added only under contract terms consistent with this policy), and flagged items may be reviewed by VibeDay personnel. Safety incidents are logged and can lead to workspace suspension under our Terms. Moderation data is used only for safety and enforcement, never for advertising.

• Contentis retained while your account is active, subject to your plan’s storage cap. The Service manages storage automatically: raw upload files are deleted on a short schedule (currently 7 days) once processed into working renders, and older derived versions may be pruned as shown in the product.
• Account deletion: when you delete your account (or your workspace is deleted), we delete your personal information and content within 30 days, except records we must keep by law (e.g., invoices for tax), fraud- and trial-integrity records, and copies in encrypted backups that are purged on their own cycle.
• Platform data: disconnecting a platform immediately deletes its stored tokens and account metadata; synced comments/messages for that account are removed with it.
• AI provider retention: providers may retain inputs for a limited period for abuse monitoring per their published policies (for Anthropic and OpenAI, typically 30 days or less); training commitments are described per provider in Section 5.

Depending on where you live, you may have rights to access, correct, delete, and export your personal information, to opt out of certain processing, and to not be discriminated against for exercising your rights. Regardless of where you live, we offer everyone:

• Self-service export of your data and deletion of your account in account settings;
• Disconnection of any platform integration at any time (see also our Data Deletion Instructions);
• Analytics opt-out and GPC support (Section 9);
• Any other request by email to legal@vibeday.com. We verify requests using your account email and respond within the time required by applicable law (generally 30–45 days). An authorized agent may submit a request with proof of authorization. If we deny a request, you may appeal by replying to our decision.

12.1 California (CCPA/CPRA)

California residents have the rights to know, access, correct, delete, and port their personal information, and to opt out of “sale” and “sharing”. We do notsell personal information. Our use of advertising cookies may constitute “sharing” under the CPRA; the “Your Privacy Choices” footer link and GPC both function as the required opt-out. We do not use or disclose sensitive personal information for purposes requiring a right-to-limit notice, and we do not knowingly sell or share the personal information of anyone under 16. Categories collected are listed in Section 2; purposes in Section 4; recipients in Section 8; retention in Section 11.

12.2 EEA, UK, and Switzerland (GDPR)

If you are in the EEA, UK, or Switzerland, VibeDay LLC is the controller of your account data, and our legal bases are listed in Section 4. You additionally have the rights to object to processing based on legitimate interests, to restrict processing, to withdraw consent at any time (without affecting prior processing), and to lodge a complaint with your supervisory authority. Where we process content in your workspace that contains other people’s personal data, we do so as your processor on your instructions; a data processing addendum is available on request at legal@vibeday.com.

We are based in the United States and process data there (our primary data region is AWS us-east-1 via Supabase). If you use the Service from outside the US, your information is transferred to and processed in the US. For transfers from the EEA, UK, and Switzerland, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses with our subprocessors and, where a vendor is certified, the EU–US Data Privacy Framework.

We protect your data with industry-standard measures: TLS encryption in transit, encryption at rest, AES-256-GCM encryption for all platform OAuth tokens, per-workspace database isolation enforced at the application layer and by Postgres row-level security, least-privilege access controls, audit logging of administrative actions, and error monitoring. No internet service can guarantee absolute security; keep your password unique and protect your account.

If a security incident affects your personal information, we will notify you and the relevant regulators without undue delay and within the timelines required by applicable law (for example, 72 hours to supervisory authorities under GDPR where it applies), including a description of what happened, the data involved, and the steps we are taking.

The Service is for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 (and never from children under 16). If you believe a child has provided us information, email legal@vibeday.com and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be announced by email and/or in-app notification at least 30 days before taking effect; non-material changes (such as clarifications or subprocessor updates) take effect on posting with an updated effective date. Prior versions are available on request.

Privacy questions or requests: legal@vibeday.com. General support: support@vibeday.com. Postal: VibeDay LLC, 82 Wendell Ave, Suite 100, Pittsfield, MA 01201, USA.