Privacy Policy

1. Introduction

Vibeotic (“we”, “us”, or “our") provides an AI music prompt generation service. This Privacy Policy explains how we collect, use, store and protect your personal information when you use the Vibeotic website and services (collectively, the "Service"). It is written for users based in the United Kingdom and is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information we collect

We collect the following types of information:

• Account information: when you create an account, we collect your email address and any display name you choose to provide. This is required to authenticate you, manage your account and communicate with you.
• Prompt input data: when you use the AI prompt generator, we collect the text you enter (such as artist names, styles, songs or descriptions) so we can generate a music prompt for you.
• Generated prompts: we store the prompts produced by the Service to operate your account history, enforce generation allowances and improve prompt quality through Prompt Learning.
• Feedback: if you rate a generated prompt, we record your thumbs-up or thumbs-down rating to improve future results.
• Usage and technical information: we automatically collect technical data necessary to operate and secure the Service, such as your IP address, browser type, device information, operating system, session identifiers and crash/error reports.
• Payment information: when you subscribe to Vibeotic Max, our payment processor (Stripe) collects payment details. We do not store your full card number or CVV. We receive a limited set of data from Stripe, such as your subscription status, billing period and payment confirmation, so we can manage your plan and allowances.

Prompt analytics

To help us understand and improve Vibeotic’s prompt generation, we temporarily store the music-style descriptions submitted to the generator. We also record the prompt engine and version used, whether the request came from a guest or registered user, and whether generation succeeded.

These records are not intentionally linked to an account or device. We do not add generated prompts, names, email addresses, account IDs, guest IDs, IP addresses or hashes, session identifiers, payment information or advertising tracking data to this analytics dataset. However, a description may contain personal information if a user chooses to include it in their text.

Prompt Analytics records are restricted to authorised Vibeotic administrators and are automatically deleted after 30 days.

Beta invitation records

If you receive an invitation to a Vibeotic Beta trial, we store a secure hash of the invitation link, its creation and expiry dates, and whether it has been accepted or withdrawn. We do not store the invitation link itself, or the recipient’s name or email address, in these records.

When an invitation is accepted, we keep a Beta trial entitlement record linked to your account showing how many one-time Beta prompts you were granted, how many remain, and when they were first and last used. This is required to operate the trial fairly. These records are restricted to authorised Vibeotic administrators, and invitation details are never included in our advertising or analytics data.

3. How we use your information

We use the information we collect to:

• Provide, operate and maintain the Service, including generating prompts and tracking generation allowances;
• Authenticate users and manage accounts;
• Process payments and subscriptions through Stripe;
• Improve prompt quality, reliability and user experience through aggregated usage and feedback analysis;
• Detect, prevent and respond to fraud, abuse, security incidents or technical issues;
• Communicate with you about your account, service updates, billing or support requests; and
• Comply with applicable legal obligations.

4. Legal basis for processing

Under UK GDPR, we process your personal data on the following legal bases:

• Performance of a contract: to provide the Service and fulfil your subscription.
• Legitimate interests: to operate, secure and improve the Service, and to detect fraud or abuse.
• Consent: where we ask for your consent (for example, to optional cookies or marketing communications), you can withdraw it at any time.
• Legal obligation: where we are required to process data by law.

5. Payment processing

Vibeotic uses Stripe to process payments for Vibeotic Max. Stripe is responsible for handling your payment card details. We do not collect, store or have access to your full card number or CVV.

We receive only the information Stripe shares with us that is necessary to manage your subscription, such as your Stripe customer ID, subscription status, current billing period, renewal date and cancellation status. Stripe’s privacy practices are governed by its own Privacy Policy, which we encourage you to review.

6. Third-party service providers

We use trusted third-party providers to operate the Service. These include:

• Stripe — payment processing and subscription management.
• OpenAI — processing prompt input data to generate music prompts.
• Lovable Cloud / Supabase — hosting, database, authentication and storage infrastructure.

We only share the data necessary for each provider to perform its function. We do not sell your personal data to third parties.

7. Data retention

We keep your personal data for as long as your account is active, or as long as necessary to fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes and enforce our agreements.

If you delete your account, we will delete or anonymise your personal data within a reasonable period, unless we are required to keep it by law. Anonymous or aggregated data may be retained for analytics and service improvement.

8. Data security

We use industry-standard technical and organisational measures to protect your data, including encryption in transit, secure hosting environments, access controls, and regular review of our security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your data rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your personal data in certain circumstances;
• Object to or restrict certain types of processing;
• Withdraw consent where processing is based on consent;
• Request a copy of your data in a portable format; and
• Lodge a complaint with the UK Information Commissioner’s Office (ICO).

To exercise these rights, please contact us using the details below. We may need to verify your identity before acting on your request.

10. International transfers

Some of our third-party providers (such as OpenAI and Stripe) may process data outside the United Kingdom. Where this happens, we rely on appropriate safeguards, such as standard contractual clauses or adequacy decisions, to ensure your data receives an equivalent level of protection.

11. Children

The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or Service features. When we make material changes, we will update the effective date at the top of this page. Your continued use of the Service after any changes means you accept the updated Privacy Policy.

13. Contact us

If you have any questions, concerns or requests about this Privacy Policy or how we handle your data, please contact us at:

Email: vibeoticsupport@gmail.com

We will aim to respond to privacy-related requests within 30 days.