Privacy Policy

1. Who we are

VibeLock LLC, a Delaware limited liability company is the controller of the personal data described in this policy. You can reach us at hello@vibelock.ai.

Where we are required to appoint a representative in the European Union or the United Kingdom under Article 27 of the GDPR or UK GDPR, their details are published in this policy.

2. What we collect

Account data

Name, email address, the account you sign in with (a one-time email link, or your GitHub or Google account, from which we receive your name, email address, profile picture and account identifier), multi-factor settings, plan, team membership, and, if you turn on push alerts, your device's push address.

Application data

Application name and URL, proof of ownership records, the technology stack detected by the scan, and any optional profile answers you give (for example whether your application stores personal data).

Connection data

Which repository host, hosting provider or coding tool you connected, the repository and installation identifiers, connection status, and the time of each code read. Access tokens are held only as long as a connection needs them and are revoked when you disconnect or delete your account.

Scan and finding data

Responses observed from your live URL, finding titles, severities, deadlines and status, verdicts and rule identifiers, file paths and line numbers, commit identifiers, dependency names and versions, coverage, badge criteria and their dates, and generated policy documents. We never store your code.

Data in your application's responses

When we scan your application, we read what it returns, which can include personal data of your own users, for example a name on a public page or, where a check finds that your database answers without an account, the first rows of an exposed table. We read those values in memory to decide whether a check passed and then drop them. We keep only the names of tables, columns and storage buckets, how many rows could be read, and the plain-language finding. We process your users' data in this way on your behalf, as your processor, under the Data Processing Addendum.

Preview data

If you ask for a preview of an application before you have an account, we keep the address scanned, the results, a 7 day cookie that lets you see them again, and keyed one-way codes made from your IP address and your browser, used only to limit how many previews one person can run. We cannot turn those codes back into your IP address.

Secret findings

The type and location of an exposed secret, never its value. We never store, receive or process actual secret values.

MCP submissions

Results your coding tool sends to the hosted MCP server: verdicts, rule identifiers, file paths and line numbers. These are self-reported until corroborated by a scan.

Usage and device data

Our hosting provider's request logs, which include IP address, browser and device type, the page or address requested and the time, used for security and abuse prevention; and a record of actions you take in the app, used to improve the product. This includes visitors to our website and to published trust pages. On a published trust page we count views by day, without a cookie, an IP address or anything else that identifies the visitor. When a customer shares a detailed link, we record the time of each view and the website the visitor came from, never an IP address, and show that record to the customer who shared it.

Session and security data

Active sessions, and a record of your last ten sign-ins with the IP address and browser used, so that we can warn you by email when your account is used from a new browser or address. Failed sign-in attempts to our administration console are recorded with a pseudonym of the email address tried, never the address itself.

Billing data

Plan, subscription status and billing history. Card details are collected and processed directly by our payment processor. We never receive or store full card numbers.

Support and marketing data

Messages you send us, survey responses, feedback, and email preferences.

Waitlist data

Your email address, where you came from (a short source label), and, if you give them, the public address of your application and whether you say you bought the Vibe Coding Security OS. The application address is stored as text only. It is not scanned, fetched or resolved until you click the link in your launch email, and then only for the passive preview of an application you own.

Free checklist data

Your name and email address, where you came from, and, only if you tick the box, your consent to marketing email together with the exact wording you agreed to and the time you agreed.

Records of your agreement to automatic renewal

3 years, or 1 year after your subscription ends if that is later.

Records of your acceptance of these terms and of scan permission

Kept while your account exists and afterwards for as long as needed to show who authorised each scan.

Digital product purchase data

If you buy the Vibe Coding Security OS, the store you bought it from makes your name, email address and the details of the purchase available to us. We never receive your payment card details.

Requests sent to our customers

When someone uses a privacy request form on a customer trust page, we receive their name, email address and the type of request, and pass it to that customer. We do this on the customer behalf, as their processor.

3. What we never store

• Actual API key, token or secret values found in your application or code.
• Your code or repository contents. Where you connect a repository, the code at one commit is read inside an isolated scanner that exists only for that scan, checked in memory and discarded. Our web application and database never hold it, and only the results described above are kept.
• Code that your coding tool examines through the MCP server. It stays on your machine; only results are sent.
• Full payment card numbers.
• Protected health information, unless you choose to enter it into a free-text field, which you should not do.
• Values read from your application or its database during a scan, such as the contents of a row. We record that a row could be read, never what it said.

4. Why we process it, and our lawful basis

Where we rely on legitimate interests, we carry out and document a balancing test weighing our interest against your rights and freedoms, and we do not rely on that basis where your interests override ours. You may request a summary of the relevant assessment at hello@vibelock.ai, and you may object to processing on this basis at any time.

To provide the Service

Performance of a contract with you (GDPR Art. 6(1)(b)).

To secure the Service and prevent abuse

Our legitimate interests in protecting the platform and our users (Art. 6(1)(f)).

To bill you and keep financial records

Performance of a contract, and compliance with legal obligations (Art. 6(1)(b) and (c)).

To send service and security notifications

Performance of a contract, and legitimate interests (Art. 6(1)(b) and (f)).

To send marketing email

Your consent, or our legitimate interests where permitted for existing customers. You can withdraw or opt out at any time (Art. 6(1)(a) or (f)).

To run the waitlist and tell you when VibeLock opens

Steps you asked us to take before entering into a contract, and our legitimate interests in running an orderly launch (Art. 6(1)(b) and (f)).

To run a preview you ask for, and to stop previews being used for abuse

Steps you asked us to take before entering into a contract, and our legitimate interests in preventing misuse of the scanner (Art. 6(1)(b) and (f)).

To send you the free checklist you asked for

Performance of your request (Art. 6(1)(b)).

To check a claim that you bought the Vibe Coding Security OS

Our legitimate interests in giving early access fairly, by matching the email you gave against our purchase records (Art. 6(1)(f)).

To understand how the product is used

A record of actions you take in the app, linked to your account, with no IP address and nothing you typed. Our legitimate interests in improving the product (Art. 6(1)(f)). When you delete your account, the record no longer identifies you.

To comply with law and respond to lawful requests

Compliance with a legal obligation (Art. 6(1)(c)).

5. AI processing

Some features send content to a third-party large language model provider for analysis. This applies when the text of a document you publish is read so that it can be compared with what was verified. What is sent is the text of the document being read. It never includes your code. Generated policies are filled from a fixed template and are not sent to a model.

Our provider processes this content to return a result. It does not use it to train models, and it may keep it for a limited period for safety and abuse monitoring under its commercial terms before deleting it. We keep the result in your account, and we do not keep a separate copy of what was sent. Code from a repository read is checked by fixed rules only and is never sent to an AI model. When your coding tool scans through the MCP server, the code stays on your machine and only results are sent to us.

Model output can be wrong. Do not rely on it without human review.

Our AI Transparency Notice lists each place the Service uses a model, what is generated, and how to ask for a human to review a result.

6. Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose personal data only to:

• Subprocessors who provide hosting, database, isolated code scanning, email, payment and AI processing services under written contracts. The current list is published on our Subprocessors page.
• Your own team members, according to the role you assign them.
• Professional advisers, such as lawyers and accountants, under confidentiality.
• The store that sells our digital products, which sells to you as merchant of record under its own terms and privacy policy, and which makes your purchase details available to us.
• Authorities, where required by law, and where permitted we will notify you first.
• An acquirer, in connection with a merger, financing or sale of assets, subject to this policy continuing to apply.

7. International transfers

We are based in the United States and our subprocessors may process data in the United States and elsewhere. Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on one of the following, in this order:

• An adequacy decision, where one covers the recipient. Transfers to recipients certified under the EU-US Data Privacy Framework, and its UK Extension and Swiss-US counterpart, are made in reliance on the relevant adequacy decision.
• Where no adequacy decision applies, the European Commission Standard Contractual Clauses (Decision 2021/914), with the UK International Data Transfer Addendum for UK transfers and the Swiss amendments for Swiss transfers.
• Supplementary technical and organisational measures, including encryption in transit and at rest, application-layer encryption of vulnerability data, and access controls.

We carry out a transfer impact assessment for each transfer corridor before relying on Standard Contractual Clauses, assessing the law and practice of the destination country and whether our safeguards remain effective, in line with the European Data Protection Board recommendations on supplementary measures. Assessments are reviewed when a subprocessor, corridor or applicable adequacy decision changes.

You may request a copy of the relevant transfer mechanism by emailing hello@vibelock.ai.

8. Automated decision-making and profiling

The Service applies fixed rules to evidence it observes about your application: responses from your live URL, alerts from your repository host, results of reading your code at a stated commit, results returned by your own coding tool through the MCP server (treated as self-reported until corroborated), and comparisons between the documents you publish and what is verified. From that it records findings with their severities and deadlines, coverage, and which of the published badge criteria hold, and it derives the badge state from those criteria. It is automated processing, and we want to be precise about what that does and does not mean.

This processing does not produce a decision with legal or similarly significant effects concerning you within the meaning of Article 22 of the GDPR. It does not determine access to a service, credit, employment or any comparable outcome, and it reaches no conclusion about you as a person. It is a record of what was verified about your application, shown to you, and published only if you choose to publish it.

No language model grades you, and the Service assigns no score, grade or rating. Where we use a model, it drafts documents, reads the text of documents you publish into statements that fixed rules compare with evidence, and phrases suggestions; it never decides whether a check passes or whether a badge criterion holds. Every change to the record resolves to a named check and the scan that moved it, so you can see what changed and why. You can rescan to verify a fix at any time, and you can dispute a finding to VibeLock for human review.

9. Where we get data about you, if not from you

If you were invited to a project by someone else, we did not receive your personal data from you. We received your name, email address and assigned role from the account owner who invited you, so that we could create your access.

This section is your Article 14 notice. The purposes, lawful bases, recipients, retention periods and rights described elsewhere in this policy apply to that data in the same way. If you did not expect the invitation, contact hello@vibelock.ai and we will remove you.

If you bought the Vibe Coding Security OS, we received your name, email address and purchase details from the store you bought it from. We use them to support you, to send you updates to the product, and to check a waitlist claim that you bought it. The same purposes, lawful bases, retention periods and rights apply.

If you use an application that a VibeLock customer scans, VibeLock may briefly see personal data that application exposes to the public, and we act for that customer as its processor. Ask the application's owner about how they use VibeLock; if you contact us, we will pass your request to them.

10. Whether you have to provide data

Providing your name and email address is a contractual requirement: without them we cannot create an account or provide the Service. Everything else, including optional profile answers and the connections you choose to make, is optional and provided at your discretion, though the Service becomes less useful without it. There is no statutory obligation on you to provide any of it.

11. Data protection officer

We have not appointed a data protection officer. Our processing does not meet the criteria in Article 37(1) of the GDPR: our core activities do not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special category data. We keep this under review, and hello@vibelock.ai reaches the person responsible for privacy at VibeLock.

12. How long we keep it

Account and application data

For as long as your account exists.

After a downgrade or cancellation of a paid plan

Frozen, not deleted. You keep read access, and a published trust page stays up showing the date your application was last verified.

After a failed payment

Read-only for a 14 day grace period, with no new scans, then handled as a downgrade. Nothing is deleted.

After account deletion

Connections and tokens are revoked, the trust page is unpublished and the badge address stops responding at once. Your account, applications, scan history and notifications are kept for 30 days and then permanently deleted, and removed from our backups as those backups expire. We keep: billing records our payment processor and we must keep under tax law; records of what our own staff did in our administration console, which we need to investigate misuse; and a record of product actions that no longer identifies you. If you were also on the waitlist or downloaded the checklist, that entry is separate: ask us at hello@vibelock.ai and we will delete it too.

Records of ownership proofs and scans

While your account exists, and for the 30 days after deletion described above, so that we can show who authorised each scan. They never include your code.

Security log entries and feedback you send in the app

Kept while the application they belong to exists, and deleted with it.

Sign-in records

Your last ten sign-ins, replaced as you sign in again, and deleted with your account.

Administration records

Records of what our own staff did in our administration console, including which account they looked at. Kept for as long as we need them to investigate misuse of the console, and not deleted when you delete your account.

Record of product actions

Kept for as long as it helps us understand how the product is used. When you delete your account, the link to you is removed at once.

Privacy requests sent through a trust page

Held for the customer who received them while their account exists, as their processor, and deleted with it.

Preview data

Kept for 7 days, after which you can no longer see it, and then deleted when our next clean-up runs.

Rate limit records

Kept as a one-way code made from your IP address, never the address itself.

Hosting and request logs

For the period our hosting provider keeps request logs, after which they are deleted automatically.

Billing records

Retained as long as required by tax and accounting law.

Code read from a connected repository

Not retained. Discarded when the scan ends.

Waitlist and free checklist data

Until you ask us to remove you, or until 12 months after we send you the launch invitation if you have not created an account by then, whichever comes first. If you create an account, your account data takes over.

Record of a marketing consent

For as long as we email you on the basis of that consent, and then for as long as we need it to show that the consent was given.

Digital product purchase data

As long as required by tax and accounting law, and for as long as we provide updates to the product.

13. Your rights

Depending on where you live, you may have some or all of the following rights. We do not discriminate against you for exercising them.

• Access: obtain a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data, subject to legal retention requirements.
• Restriction: ask us to limit processing in certain circumstances.
• Portability: receive your data in a structured, machine-readable format. A full export is available in account settings.
• Objection: object to processing based on legitimate interests, including profiling.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
• Stop marketing email: every marketing email has an unsubscribe link that works in one click, and you can also email hello@vibelock.ai. We stop within 10 business days at the latest, and we keep a record that you unsubscribed only so that we never email you marketing again.
• Opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of, but you may still submit a request.
• Limit use of sensitive personal information: we do not use sensitive personal information for purposes requiring this right.
• Non-discrimination: we will not deny service, charge different prices, or provide a different quality of service because you exercised a right.
• Complain: lodge a complaint with your supervisory authority. EU and UK users may complain to their national data protection authority.

14. How to exercise your rights

Use the export and delete controls in account settings, or email hello@vibelock.ai. We will verify your identity before acting, usually by confirming control of the account email.

We respond within 30 days for GDPR and UK GDPR requests, and within 45 days for requests under California law, extendable where permitted. An authorised agent may submit a request on your behalf with proof of authorisation.

If you were invited to a project by a customer of ours, we act as a processor for that data and will route your request to them, telling you that we have done so.

If we refuse a request, we will tell you why. You may appeal that decision by replying to our response or emailing hello@vibelock.ai with the word appeal in the subject line. A different person reviews the appeal where practicable, and we will respond within 45 days with our decision and the reasons for it. If we deny the appeal, we will tell you how to complain to your state attorney general or supervisory authority.

If you want to complain about how we handle your personal data, email hello@vibelock.ai with the word complaint in the subject line. We acknowledge a complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to your supervisory authority at any time, in the United Kingdom the Information Commissioner's Office.

15. United States state privacy notice

This section is our notice at collection and our privacy notice for residents of California and of the other states with comprehensive consumer privacy laws. It supplements the rest of the policy. We give it to every United States resident, whether or not a given state law applies to us. Using the statutory categories, here is what we collect, where it comes from, why, and who receives it. How long we keep each category is set out in section 12.

In the preceding twelve months we disclosed the categories above to service providers for the business purposes described in this policy. We did not sell personal information, did not share it for cross-context behavioural advertising, and have no actual knowledge of selling or sharing the personal information of anyone under 16.

We use sensitive personal information only to perform the Service and to secure your account. We do not use or disclose it to infer characteristics, so the right to limit its use does not arise. You may still exercise every other right described above, and we will not discriminate against you for doing so.

We do not process personal information for targeted advertising, and we do not use it for profiling in furtherance of decisions that produce legal or similarly significant effects. We do not knowingly process the personal information of anyone under 16. We do not offer financial incentives in exchange for personal information.

Depending on your state, you have the right to know what personal information we hold about you and how we use and disclose it, to get a copy of it in a portable format, to correct it, to delete it, to opt out of its sale, of sharing for cross-context behavioural advertising, of targeted advertising and of such profiling, to limit the use of sensitive personal information, and to appeal a refusal. Section 14 explains how to make a request, how we verify it, how an authorised agent can act for you, and how to appeal. We treat a Global Privacy Control signal as a request to opt out of sale and sharing.

Identifiers

Name, email address, account identifier, IP address. Collected from you, from your sign-in provider, from the account owner who invited you, or from the store you bought a digital product from. Used to provide and secure the Service, to run the waitlist and to deliver what you asked for. Disclosed to hosting, database and email subprocessors.

Commercial information

Plan, subscription status and billing history, and the purchase of a digital product. Collected from you, our payment processor and the store you bought from. Used to bill you, keep records and support you. Disclosed to the payment processor.

Internet or network activity

Request logs, actions taken in the app, device and browser type. Collected automatically. Used for security, abuse prevention and product improvement. Disclosed to hosting subprocessors.

Geolocation data

None. We do not derive your location, even approximately. Your IP address is listed under identifiers.

Professional information

Your role in a project, and the technology stack of your application as detected by the scan or as you tell us. Collected from you and from scans. Used to decide which checks apply.

Sensitive personal information

Account log-in data: the email address or the GitHub or Google account you sign in with, together with the session credentials that keep you signed in. We hold no password. Collected from you and your sign-in provider. Used solely to authenticate you and secure your account.

Inferences

None. We do not build profiles or draw inferences about your characteristics, preferences or behaviour.

16. Cookies and tracking

We set no cookie or browser storage for advertising, analytics or tracking. What we set either makes the site and the app work, or stays in your browser to remember a setting or decide when to show a notice. The Cookie Policy lists each one and how long it lasts.

We honour Global Privacy Control signals where legally required.

17. Security

We encrypt data in transit using TLS and at rest using AES-256, apply row level security so one account cannot access another account data, encrypt vulnerability data at the application layer, enforce multi-factor authentication on administrative accounts, log sensitive actions, and review dependencies for known vulnerabilities.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it, and we will notify the competent supervisory authority within the same 72 hours where GDPR Article 33 requires it.

18. Children

The Service is not directed to children. We do not knowingly collect personal data from anyone under 16, or under 13 in the United States. If you believe a child has provided us data, contact hello@vibelock.ai and we will delete it.

19. Changes

We may update this policy. For material changes we will give notice by email or in-app before they take effect and update the date below. Continued use after that constitutes acceptance.

20. Contact

Privacy enquiries and requests

hello@vibelock.ai

Complaints

hello@vibelock.ai, with the word complaint in the subject line

Security reports

hello@vibelock.ai, with the word security in the subject line