Privacy Policy

This Privacy Policy explains how Agentic Digital, Lda. ("Vibing," "we," "us," or "our") collects, uses, stores, and protects your personal data when you use the Vibing desktop application and website (collectively, the "Service"). It also explains your rights under applicable data protection law, including the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA").

1. Data Controller

Agentic Digital, Lda. is the data controller for personal data processed in connection with the Service.

Contact: info@getvibing.ai

2. Data We Collect

2.1 Account and Registration Data

• Name and email address
• Password (stored in hashed form only)
• Account preferences and settings

2.2 Payment Data

Payment processing is handled by a third-party payment processor (Stripe or equivalent). We do not store full credit card numbers or banking details. We may retain billing address, transaction history, and subscription status.

2.3 Usage and Application Data

• Feature usage patterns and interactions within the desktop app
• Project metadata (e.g. project names, sprint counts) — not your code or project content
• Error logs and crash reports
• Session timestamps and app version information

2.4 Third-Party API Keys

You may provide API keys for third-party services (e.g. Anthropic, Google). These are stored in encrypted form on your local device and, where necessary for the Service to function, in encrypted form on our servers. We do not use your API keys for any purpose other than facilitating your use of the Service.

2.5 Project Content

Your project specifications, requirements documents, design blueprints, and knowledge bases ("Project Content") are stored locally on your device. Where cloud sync or backup features are enabled, Project Content may be stored on our servers in encrypted form. We do not access, analyse, or use your Project Content except as strictly necessary to provide the Service.

2.6 Website and Cookie Data

When you visit getvibing.ai, we may collect IP address, browser type, pages visited, and referral source via analytics cookies. See our Cookie Policy for details.

3. How We Use Your Data

We process your personal data on the following legal bases:

3.1 Contract Performance

• Creating and managing your account
• Processing payments and managing subscriptions
• Providing and maintaining the Service
• Facilitating connections to third-party services you configure

3.2 Legitimate Interests

• Improving and developing the Service (using anonymised/aggregated data only)
• Security monitoring and fraud prevention
• Analytics to understand how the Service is used
• Responding to support requests

3.3 Legal Obligation

• Compliance with applicable laws and regulations
• Responding to lawful requests from authorities

3.4 Consent

• Marketing communications (you may opt out at any time)
• Non-essential cookies (see Cookie Policy)

4. No AI Training on Your Data

Vibing does not use your Project Content, prompts, code, or API interactions to train, fine-tune, or improve any AI model. Your data is yours.

5. Data Sharing

We do not sell your personal data. We may share data with:

• Payment processors (e.g. Stripe) to process transactions
• Cloud infrastructure providers (e.g. AWS, Google Cloud) who process data on our behalf under data processing agreements
• Analytics providers (using anonymised or aggregated data only)
• Third-party AI providers — only the prompts and context you direct through the Service, using your own API credentials
• Legal authorities where required by law

All third-party processors are subject to contractual data protection obligations consistent with GDPR.

6. International Data Transfers

We are based in Portugal (EU). If your data is transferred outside the EEA (e.g. to US-based cloud providers), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

7. Data Retention

• Account data: retained for the duration of your account plus 30 days after deletion
• Payment records: retained as required by applicable tax and accounting laws (typically 7 years)
• Usage logs: retained for up to 12 months
• Crash reports: retained for up to 6 months

You may request deletion of your personal data at any time (see Section 9).

8. Security

We implement industry-standard technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS) and at rest (AES-256)
• Encrypted storage of API keys and credentials
• Access controls limiting employee access to personal data
• Regular security reviews and vulnerability assessments

No method of transmission over the internet is completely secure. We cannot guarantee absolute security of your data.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Request your data in a structured, machine-readable format
• Restriction: Request that we restrict processing of your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time for consent-based processing

To exercise any of these rights, contact us at info@getvibing.ai. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (in Portugal: CNPD — Comissao Nacional de Protecao de Dados, https://www.cnpd.pt).

10. California Residents (CCPA)

If you are a California resident, you have additional rights under the CCPA, including:

• The right to know what personal information we collect, use, disclose, or sell
• The right to delete your personal information
• The right to opt out of the sale of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your CCPA rights

To exercise these rights, contact us at info@getvibing.ai with the subject line "CCPA Request."

11. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at info@getvibing.ai.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

For privacy-related questions or requests:

Agentic Digital, Lda.

Email: info@getvibing.ai

Website: https://getvibing.ai