Privacy Policy

1.1 Information You Provide Directly

1.2 Information Generated During Engagements

1.3 Information Collected Through Third Parties

1.4 Information Collected Automatically

1.5 Information We Do NOT Collect

• ✓No source code. Unless you specifically provide code samples for review during a consulting engagement, we do not access or store your application source code.
• ✓No internal network data. We do not access your internal networks or install agents inside your infrastructure. Consulting engagements are based on information you voluntarily share.
• ✓No employee personal data. During consulting engagements we may learn team member roles and responsibilities, but we do not collect personal data (home addresses, Social Security numbers, etc.) of your employees.
• ✓No browsing history. We do not track your activity across other websites.

3.1 Third-Party Service Providers (Sub-Processors)

All sub-processors are contractually obligated to process your data only as necessary to provide their services to VibeSec and to maintain appropriate security measures.

3.2 Legal Requirements

We may disclose your information if required to do so by law, subpoena, court order, or governmental or regulatory request. We will notify you of such requests unless prohibited by law or court order.

3.3 Business Transfers

If VibeSec is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email before your information becomes subject to a different privacy policy.

3.4 With Your Consent

We may share information when you explicitly direct us to (for example, if you ask us to share deliverables with a third-party auditor on your behalf).

4.1 How We Use AI

VibeSec uses AI-powered tools (including Anthropic Claude) to assist with analysis and draft components of consulting deliverables. AI helps us analyze workflow patterns, identify process optimization opportunities, and prepare FORGE blueprints and recommendations. All AI-generated analysis is reviewed and refined by VibeSec's human consultants before delivery.

4.2 What Data AI Processes

During consulting engagements, AI tools may process:

• Workflow descriptions and process documentation you share
• Organizational context (team structure, AI tool inventory) provided during sessions
• Anonymized process data used to generate FORGE blueprints and recommendations

AI tools do NOT process: your source code, internal network data, employee personal information, or any data you have not voluntarily shared with VibeSec.

4.3 AI Data Retention

VibeSec uses commercial AI API services for AI-assisted analysis. Provider retention, logging, and model training treatment are governed by the applicable provider agreement and account settings in effect when processing occurs. VibeSec does not authorize model providers to use client submissions for public model training where commercial terms or account settings prevent that use.

4.4 Human Review

All deliverables that include AI-generated analysis are reviewed by VibeSec's human consultants before delivery to you. AI assists our work but does not replace human judgment.

5.1 Where Your Data Is Stored

5.2 Security Measures

• ✓Encryption in transit: All data transmitted between your browser and our website is encrypted using TLS 1.2 or higher.
• ✓Encryption at rest: Data stored in Cloudflare KV is encrypted at rest per Cloudflare's infrastructure standards.
• ✓Access controls: Only authorized VibeSec personnel (currently the founder) can access client engagement data. Client data is organized per-engagement with access restricted to the engagement team.
• ✓Confidentiality: All consulting engagements are covered by mutual confidentiality obligations (see our Terms of Service, Section 7).
• ✓Minimal data collection: We collect only the data necessary to deliver the Services you engage us for.

5.3 Breach Notification

In the event of a data breach that affects your information, VibeSec will notify affected clients via email within seventy-two (72) hours of becoming aware of the breach, provide information about the nature of the breach, the data affected, and steps we are taking, and notify relevant regulatory authorities as required by applicable law.

6.1 Deletion on Request

You may request deletion of your data at any time by contacting [email protected]. VibeSec will process deletion requests within thirty (30) days. Some data may be retained as required by law (for example, financial records for tax compliance). Deletion of engagement files does not affect deliverables already delivered to you.

6.2 Early Deletion

If you would like engagement files deleted before the standard 90-day retention period, notify VibeSec in writing and we will accommodate the request within ten (10) business days.

7.1 All Clients

Regardless of your location, you have the right to:

• ✓Access: Request a summary of the data we hold about you and your organization.
• ✓Correction: Request correction of inaccurate information.
• ✓Deletion: Request deletion of your data, subject to legal retention requirements.
• ✓Copies of deliverables: Request re-delivery of engagement deliverables during the retention period.
• ✓Opt-out of marketing: Unsubscribe from marketing emails at any time (transactional emails related to active engagements are not marketing).

To exercise these rights, contact [email protected]. We will respond within thirty (30) days.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• ✓Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• ✓Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• ✓Right to Opt-Out of Sale/Sharing: VibeSec does NOT sell your personal information. VibeSec does NOT share your personal information for cross-context behavioral advertising.
• ✓Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA request, contact [email protected] with the subject line "CCPA Request."

7.3 European Economic Area and UK Residents (GDPR)

VibeSec is US-based and primarily serves US clients. If GDPR applies to you, you have the following additional rights:

• ✓Lawful Basis: We process your personal data on the basis of contract performance (delivering consulting services you engaged) and legitimate interests (security, service improvement).
• ✓Right to Portability: You may request your personal data in a structured, commonly used, machine-readable format.
• ✓Right to Restrict Processing: You may request that we restrict processing of your data in certain circumstances.
• ✓Right to Object: You may object to processing based on legitimate interests.
• ✓Data Transfers: Your data is processed in the United States. By engaging VibeSec, you consent to the transfer of your data to the US.

8.1 Cookies We Use

VibeSec uses only strictly necessary cookies:

8.2 What We Do NOT Use

• ✗No third-party tracking cookies (no Google Analytics, Facebook Pixel, etc.)
• ✗No advertising cookies
• ✗No cross-site tracking
• ✗No fingerprinting

8.3 Cookie Consent

Because we use only strictly necessary cookies (required for the website to function), explicit cookie consent is not required under most privacy laws, including GDPR.