VYBE Privacy Policy

Effective date: {{EFFECTIVE_DATE}}

This Privacy Policy explains what personal information {{COMPANY_LEGAL_NAME}} ("VYBE", "we", "us") collects when you use vybe-co.com, the VYBE mobile apps and related services (together, the "Platform"), why we collect it, who we share it with, how long we keep it, and the choices and rights you have.

VYBE is a marketplace where businesses ("Brands") find independent content creators ("Creators") for paid content work ("Campaigns" and "Collaborations"). Some Creators also join our referral program as "Ambassadors". This policy covers all of them, our staff accounts, and visitors who do not have an account.

The short version:

• VYBE is available only in the United States. We collect what we need to run the marketplace, keep the Platform safe and, once payments go live, pay Creators and meet tax law.
• We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have no advertising or analytics trackers on the Platform.
• We ask for your date of birth before you create an account, only to check that you are 18 or over. We keep a record that you are an adult, not the date itself.
• [DRAFT — counsel] Once payments go live, Stripe, not VYBE, collects Creators' identity documents and tax details (including Social Security numbers) when they set up their Stripe account. VYBE receives only the verification and tax-information status, what Stripe still needs, and the verified name and country. If you gave tax information to VYBE before the Fees v2 effective date, we keep it encrypted and limit who can see it. Bank details are held by Stripe, not by VYBE. Until payments go live we do not collect tax IDs, run ID checks or set up payouts.
• [DRAFT — counsel] Stripe may ask Creators for an ID image and, in some cases, a selfie during Stripe account set-up; Stripe does this under its own privacy policy and VYBE does not receive them. VYBE itself does not use selfies or face matching.
• We automatically scan in-app messages for contact details, payment details and safety risks. A notice in every conversation says so. Nothing is blocked; flagged and reported messages may be read by our staff.
• You can download a copy of your information and delete your account in Settings → Account & data. You can also ask to see, correct, delete or get a copy of your information by writing to [email protected].

1. Who this policy applies to

This policy applies to personal information we collect through the Platform and when you contact us. It does not cover websites or services run by others, even if we link to them, such as Instagram, TikTok, YouTube or Stripe's hosted pages (including the Stripe Express dashboard). Those services have their own privacy policies.

The Platform is only for people who are 18 or older. See section 12.

United States only. The Platform is available only in the United States, and this policy is written for US users. We block access from certain countries and regions (see section 4.4).

2. Information we collect

2.1 Information you give us

Account information (everyone)

• Email address (we store it once it has been verified).
• Your account type (Brand or Creator). The choice is permanent, so a person who wants both needs two accounts.
• Language preference.
• Date of birth check. Before you create an account, we ask for your date of birth. We use it once to check that you are 18 or over. We then store only the fact that you confirmed you are an adult and when; we do not store the date. If you are under 18, we do not create an account, and we do not keep the date you entered; your browser or app remembers the refusal for 30 days.
• When you create your account, VYBE passes your name, email address and password to our sign-in provider, Zitadel, which creates your login and emails you a code to confirm your address. Your password and, if you turn it on, your two-factor (TOTP) authenticator are held by Zitadel. VYBE does not store your password.

Creator profile

• Handle, display name, bio, "about" text, city, country, content niches, whether you are open to collaborations, whether you appear in the Brand directory, and your profile photo.
• Social media accounts: platform, handle, follower count, average views and engagement rate. These numbers are self-reported until we can connect to the platforms directly.
• Portfolio links and titles.
• Legal first and last name, used for our records and sanctions screening. It is not shown on your public profile.
• [DRAFT — counsel] Mailing address for contracts (optional; required before you apply for Collaborations of US$250 or more with one Brand within 120 days), encrypted.

Shipping address (Creators, product Campaigns only) [DRAFT — counsel]

• Name for the label, address, and optionally a phone number for the carrier. When you apply to another product Campaign we prefill the last address you used; it is deleted on the schedule in section 9 (there is no separate saved address). How we share it and how long we keep it: see Shipping.

Creator tax information collected by VYBE before the Fees v2 effective date (legacy) [DRAFT — counsel] Stripe, not VYBE, collects your tax details (including your TIN) and identity documents during Stripe account set-up. VYBE receives your Stripe account ID, verification and tax-information status, what Stripe still needs, and the verified legal name and country on the account. If you gave tax information to VYBE before [Fees v2 date], we keep the following as described in section 9 and then delete it:

• Answers to the US-person questions (citizen, resident, organized in the US).
• Legal first and last name (encrypted), business name, disregarded-entity name, federal tax classification, exempt payee and FATCA codes.
• Residence address and, if different, mailing address (street and city encrypted).
• Date of birth (encrypted).
• Tax identification number (TIN), which may be a Social Security number (SSN), EIN or ITIN (encrypted; the last 4 digits are kept unencrypted so we can show you which number is on file).
• Your electronic signature on the Form W-9 certification, including the name you typed, the capacity you signed in, the date and time, your IP address and your device's user agent, plus a sealed copy of what you certified.
• If you give it, your consent to receive tax statements (such as Form 1099-K or Form 1099-NEC) electronically, with the time, IP address and user agent.

Creator payout information (once payments go live)

• Creators set up a Stripe Express account through Stripe's own pages, [DRAFT — counsel] usually after a Brand first accepts them. Stripe collects the identity and bank details it needs. VYBE does not receive or store your bank account number. We keep your Stripe account ID and its status (for example, whether payouts are enabled and what Stripe still needs).

Brand information

• Brand logo and banner.
• Business details: the business's legal name, the account holder's name and the US business address, used for records, sanctions screening and, on request, to give a Creator you hire your contract details.
• Campaign details: brand name, brief, reference links, platforms, categories, rate range and deliverables, and your confirmation of the Prohibited and Restricted Campaigns Policy (with its version and time).
• Creators you save and private notes you write about them (visible only to your account and to VYBE).
• Payment card details are entered on Stripe's page. VYBE never sees your full card number. We keep the Stripe customer and payment method IDs, card brand, last 4 digits, expiry date, card country and Stripe's card fingerprint.
• [DRAFT — counsel] Refund bank details (bank-debit payments only). If part of a payment you made by bank debit is refunded, you enter the routing and account number of the account that funded the payment (or that repaid it after a bank return) in a secure form in the app, so VYBE can send the refund by bank transfer. Purpose: only to check the account and pay that refund. Recipient: VYBE sends the numbers once to Stripe, its payment processor, which checks that they belong to the same account (same account and same account holder name); VYBE accepts no other account. After 5 unsuccessful tries the form locks and support helps by another secure route. Retention: the numbers are stored encrypted only until the transfer is sent or the refund is cancelled, then deleted; VYBE keeps only the record of the refund (amount, date, last 4 digits). VYBE never asks for bank details by email, text or phone.

Ambassador information

• Program application: social handles, the version of the Ambassador terms you accepted, and a snapshot of the eligibility requirements at that time.
• Membership: residence country and commission rate.
• Screenshots you send as proof of your VYBE posts. These are stored privately and seen only by our program team.

Collaboration content and records

• Draft and published content links, captions, and optional screenshot links. VYBE does not host Creators' video or photo files.
• Approval, change requests, issue flags, and Usage Rights requests and answers between Brands and Creators.
• Decline reasons and invitation notes.

Messages

• Messages you send to the other party in a Collaboration, and when each side last read the conversation (shown as "Seen").
• Reports you make about a user, profile, brand, Campaign, conversation, message or submission, with the reason and any note, and the users you block.

Takedown and safety requests (anyone, with or without an account)

• If you send an intimate-image removal request, a copyright notice, a counter-notice or another report through vybe-co.com/report or by email: your name, email address, and where required your postal address, phone number, relationship to the person shown, the links you report, your statements and your typed signature. We do not ask you to upload images.

Agreements

• Which versions of our terms and policies you accepted, when, and from which IP address, browser or app version and platform.

Support and requests

• What you tell us when you email us, and records of privacy requests.

• [DRAFT — counsel] Video files you upload for a Campaign: the file and its technical details (size, format, resolution, length, whether it contained a location), a preview copy and a still image we make from it, and still frames from it that we send to Microsoft’s PhotoDNA service, which compares them with known child-sexual-abuse imagery. We remove location information from the copy the Brand receives. The Brand that ran the Campaign sees the preview and, after approving it, can download the original. We delete the original 60 days after approval (14 days for versions not approved) and with your account.

2.2 Information we collect automatically

• IP address and country. We use the country our network provider (Cloudflare) derives from your IP address. We record your sign-up country once, at sign-up, and we use your connection country to block access from sanctioned countries and regions. For Creators, we also record the country you connect from and whether it differs from the country you told us. See section 4.4. We do not collect precise location (GPS) and the apps do not ask for location permission.
• Device and log information. Your IP address and user agent (browser or app type and version) are recorded in our security audit log when you take certain actions, such as signing tax forms, applying to programs or changing payout details. We also record when you last used the Platform.
• Push notification data (apps only). Device platform, app, push token, language and app version.
• Notification settings. Time zone, quiet hours and whether message previews show in notifications.
• Cookies. A small number of cookies that keep you signed in, remember your language and time zone, remember an age-check refusal for 30 days, and remember an Ambassador referral code. See our Cookie Notice.

What we do not collect automatically: we use no advertising identifiers (such as IDFA), no advertising or social media pixels, no third-party analytics, and no session recording tools. When you upload a photo, we re-encode it and remove its metadata, including any GPS location. [DRAFT — counsel] Portfolio videos from TikTok or YouTube load only when you press play; the platform then collects information under its own policy (see the Cookie Notice).

2.3 Information from other sources

• [DRAFT — counsel] Stripe Identity (VYBE staff and, where VYBE asks, Ambassadors; Creators only for checks made before the Fees v2 effective date). The result of your ID document check, the country that issued the document, a session reference, and the first name, last name and date of birth read from the document. We do not keep the name and date of birth from Stripe in readable form; we turn them into a keyed code (see section 5).
• Stripe (Brands). Card details listed above and the status of payments, refunds and disputes.
• [DRAFT — counsel] Stripe Connect (identity and tax verification status) (Creators and Ambassadors, once payments go live). Your Stripe account ID, its status and requirements, whether Stripe has verified your identity and tax information, the verified name and country on the account, whether a parent or legal guardian is listed on the account (used only to enforce our 18+ rule), a fingerprint of the payout bank account (not the account number), whether its bank account has changed, and transfer and payout status.
• Sanctions lists. We compare names with public sanctions lists published by the US Treasury (OFAC) and the European Union, either ourselves or through a screening provider.
• Zitadel. Confirmation that your email is verified, your sign-in sessions, and whether you signed in with two-factor authentication.
• Cloudflare. The country of your connection, and the result of a bot check (Turnstile) on the sign-up and report forms.
• The IRS. If the IRS tells us a name and TIN do not match (for example through TIN Matching or a "B-notice").
• Other users. Brands' notes about Creators, and reports one user makes about another.

3. Notice at collection: categories, sources, uses, recipients and retention

The table below uses the categories of personal information named in the California Consumer Privacy Act. "Service providers" means the companies listed in section 7.1 that process data for us.

We do not collect biometric information, health information, precise geolocation, or the contents of government ID documents (Stripe holds those; see section 5).

4. How we use personal information

We use personal information to:

1. Provide the Platform: create and secure your account, show profiles and Campaigns, let Brands and Creators message each other and manage Collaborations, and record Usage Rights requests and answers.
2. Take payments and pay Creators (once payments go live): charge Brands through Stripe, hold funds until the Brand verifies the Content, and transfer Creator Fees and Ambassador commissions to Creators' Stripe Express accounts.
3. Meet legal obligations: check your age, record your acceptance of our terms, screen users against sanctions lists, collect tax forms, file information returns (Form 1099-K or Form 1099-NEC, as applicable) with the IRS, keep accounting records, handle intimate-image and copyright removal requests, and respond to lawful requests.
4. Keep the Platform safe and prevent fraud: verify Creators' identities, detect duplicate or linked accounts, check connection countries, scan messages, profile text and Campaign briefs for off-platform payment, contact sharing and objectionable content, review reports, enforce blocks and our policies, and keep an audit log.
5. Run the Ambassador program: attribute new Brands to the Ambassador who referred them, check eligibility, review posting proof, and pay commissions.
6. Send you notifications about messages, Collaborations, Content, earnings and reminders, by email and push. All our emails are about your account and activity; we do not send newsletters or marketing emails today. We will only feature you in our own marketing if you agree when we ask you by email. You can turn off most categories in settings; some notices (for example tax, payout and program decisions) are required and cannot be turned off.
7. Support you and answer your questions.
8. Improve and fix the Platform, using our own logs.

We do not use personal information for advertising, and we do not use AI or machine-learning services on your data.

4.1 Message scanning

To protect users from scams and to keep payments on VYBE, we automatically scan the text of every in-app message for:

• email addresses, phone numbers and bank account numbers;
• words that suggest moving the conversation or payment off VYBE (for example names of other messaging or payment apps, "bank transfer", "pay you directly", "avoid the fees"); and
• certain objectionable terms (for example sexual content, slurs and threats).

When a message matches, we attach a flag to it. Nothing is blocked or changed: the message is still delivered. Our trust and safety staff may read flagged messages and reported messages, and may act under our Community Guidelines, including by removing a message (it is then shown as "removed by VYBE"). Users cannot edit or delete messages. We apply the same objectionable-term check to profile text and Campaign briefs. We do not use message content for advertising.

By using messaging, both people in a conversation agree to this scanning. A notice about scanning is shown to both people in every conversation.

4.2 Duplicate and linked account detection

[DRAFT — counsel] When a Creator sets up a Stripe account, we create a keyed code (an HMAC) of the fingerprint Stripe gives us for the payout bank account (never the account number). Two accounts paid to the same bank account are flagged for review by our staff, not blocked automatically. When a staff member (or, before the Fees v2 effective date, a Creator) completes an ID check, we create a keyed code (an HMAC) from the verified first name, last name and date of birth. The code is made with a secret key, so it cannot be reversed into your name or birthday by anyone who does not hold the key. We use it to tell when two accounts belong to the same person, for example to stop someone from opening several Creator accounts or from referring their own business as an Ambassador.

For the Ambassador program, we also keep keyed codes of each referred Brand's card fingerprint and email address for 3 years, so that a business cannot sign up again and count as "new".

4.3 Payout safety checks

[DRAFT — counsel] Once payments are live, before we pay a Creator, our systems check that:

• Stripe reports the Creator's identity verification and tax information complete, and Stripe needs nothing more;
• the Stripe account's country matches the country the Creator gave us, and the name verified by Stripe matches the Creator's legal name on VYBE;
• the IRS has not told us the Creator's name and TIN do not match;
• the bank account on the Creator's Stripe account has not changed in the last 14 days and is not shared with another account without review;
• the Creator's connection country matches their declared country (section 4.4); and
• the Creator has passed sanctions screening and has no open dispute.

If a check fails, the payout is paused until a VYBE staff member reviews it. Payouts are not cancelled automatically.

4.4 IP country checks

We use the country (and, where available, the region) derived from your IP address to:

• block access from countries and regions subject to sanctions;
• record the country you signed up from;
• compare a Creator's connection country with the country they declared (a mismatch pauses payouts until staff review);
• check that a referred Brand is in the same country as the Ambassador; and
• treat connections from anonymizing networks such as Tor as "unknown country".

These checks help us prevent fraud and meet our legal obligations. If you think a check got it wrong, contact [email protected] and a person will review it.

4.5 No automated decisions about you without human review

We do not use AI or scores to rank, approve or reject users. Our matching tools explain why a Creator may fit a Campaign; they do not rank by money or hide anyone. The automated checks above can pause a payout or block a referral from being counted, but you can always ask a person to review the result by emailing [email protected].

5. Identity and tax verification by Stripe

[DRAFT — counsel] Stripe verifies Creators' identity and tax information under its own legal obligations, acting as an independent controller under the Stripe Privacy Policy and the Stripe Connected Account Agreement. Stripe may ask for an ID image and, in some cases, a selfie; VYBE does not receive them. Stripe also prepares and files Form 1099 for VYBE as VYBE's service provider. VYBE shares your account and payment information with Stripe because you asked to be paid through Stripe.

• What VYBE keeps: your Stripe account ID, whether Stripe has verified your identity and tax information, what Stripe still needs, the verified legal name and country on the account, and the keyed bank-fingerprint code described in section 4.2.
• What VYBE does not receive: your ID document or any image of it, your selfie (if Stripe asks for one), or your full TIN.
• VYBE staff, and checks made before the Fees v2 effective date: VYBE staff (and Creators who completed a VYBE ID check before the Fees v2 effective date) verify through Stripe Identity, a document-only check with no selfie or face matching. For those checks VYBE keeps whether the check passed, the issuing country, the Stripe session reference, the date and the keyed name+date-of-birth code (section 4.2), and asks Stripe to redact the verification data {{STRIPE_REDACTION_PERIOD}}. More detail is in our Identity Verification and Biometric Data Notice.

6. Social Security number and tax ID protection

[DRAFT — counsel] From the Fees v2 effective date, VYBE does not collect SSNs or other TINs: Stripe collects them (section 5). This section applies to TINs VYBE collected before that date, which we keep only because tax law requires it. Our Social Security Number Protection Policy (published when tax forms open) has the details. We protect them as follows:

• They are encrypted with AES-256-GCM before being stored, and each encrypted value is bound to its owner so it cannot be copied to another record.
• Only the last 4 digits are shown to you and to staff in normal use.
• A staff member can see a full TIN, date of birth or place of birth only by giving a reason. Every such view is recorded in an audit log, and each staff member is limited to 20 views per hour.
• Staff must use multi-factor authentication for all admin access.
• We only send TINs over encrypted connections, never display them publicly, never use them as a login, and only disclose them to tax authorities or as the law requires.
• We delete TINs when the retention period in section 9 ends.

7. How we disclose personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows.

7.1 Service providers

These companies process personal information for us, under contract, to provide the Platform:

Some of these providers (notably Stripe) are regulated financial services companies and may also use your information for their own legal and fraud-prevention purposes under their own privacy policies.

7.2 Government authorities

• [DRAFT — counsel] IRS (United States): Creators' and Ambassadors' names, addresses, TINs and payment totals, filed on Form 1099 by Stripe for VYBE.
• US Treasury (OFAC): reports of blocked or rejected transactions, where sanctions law requires.
• Other authorities when we are legally required to, for example in response to a valid subpoena or court order, or to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC).

7.3 Other users

• Signed-in Brands and Creators can see Creator profiles (storefronts). Creators can turn off "discoverable" to hide from the Brand directory. Profiles are not visible to people who are not signed in.
• Creators can see Brands' profile information and Campaigns.
• The other party to a Collaboration sees your messages, read status, Content links and Usage Rights answers. A Creator who asks may also receive the Brand's legal business name and business address for their contract records. [DRAFT — counsel] The Brand sees your legal name and, if you gave one, your mailing address for contracts in the Collaboration record. Because you choose to give it for this purpose, this is not a sale or sharing of your information.
• Copyright notices: if we remove your Content after a copyright notice, we send you a copy of the notice with the sender's name and email (other contact details removed). If you send a counter-notice, we send it to the person who sent the notice, as copyright law requires.
• Ambassadors: the referral landing page shows the Ambassador's handle publicly. A referred Brand sees which Ambassador referred them. When fewer than three businesses contributed to an Ambassador's monthly figures, we show the Ambassador a range, not an exact amount.
• Product Campaigns: see Shipping below.

Shipping

[DRAFT — counsel] When you apply to a Campaign that ships a product and tick the box, you direct us to give your shipping address (and your phone number, if you add one for the carrier) to that Brand if it accepts you and its payment is secured. Before then the Brand sees only your state. The Brand may use the address and phone only to mail that product (including a reship), may share them only with its carrier or shipping providers, and must delete them within 30 days after delivery or cancellation. It can see them in VYBE until the Collaboration is cancelled or 14 days after delivery, whichever is first (and never more than 45 days after it ships), and we record every time it views them. Because you direct this disclosure, it is not a "sale" or "sharing" of your information. The Collaboration Summary never shows your shipping address. If your application ends without a Collaboration, we delete the address you gave with it within 1 day. How long we keep shipping data: section 9.

7.4 Other cases

• To protect the rights, property or safety of VYBE, our users or others, including to investigate fraud.
• To a buyer or successor if VYBE is involved in a merger, acquisition or sale of assets. We will tell you before your information becomes subject to a different privacy policy.
• With your direction or consent.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing.

8. Cookies, Do Not Track and Global Privacy Control

We use only the cookies needed to run the Platform: to keep you signed in, remember your language, and remember an Ambassador referral code for 30 days. We do not use advertising or analytics cookies, and we do not allow third parties to collect information about your activity on the Platform to track you across other sites or over time, except that a TikTok or YouTube video you choose to play is delivered by that platform, which may collect information under its own policy (Cookie Notice section 4). [DRAFT — counsel] See our Cookie Notice.

• Do Not Track: we do not track you across sites whether or not your browser sends a Do Not Track signal, so receiving one changes nothing.
• Global Privacy Control (GPC): we honour GPC signals as a request to opt out of the sale or sharing of your personal information. Because we don't sell or share personal information, there is nothing further to switch off.

If we ever add analytics or other trackers, we will update this policy and our Cookie Notice first.

9. How long we keep information

We may keep information longer if we need it to resolve a dispute, enforce our terms, or comply with a legal hold.

10. Security

We use reasonable administrative, technical and physical safeguards suited to the sensitivity of the information. They include:

• field-level AES-256-GCM encryption for TINs, dates and places of birth, creators' legal names on tax forms, home and mailing addresses, mailing addresses for contracts and shipping addresses, bank account identifiers, sign-in tokens for connected social accounts, takedown requesters' contact details and tax statement files, with key rotation;
• encrypted session cookies and encrypted connections (HTTPS);
• mandatory multi-factor authentication for all staff admin access, and optional two-factor authentication for users;
• an append-only audit log of admin actions, protected at the database level, and recorded, rate-limited access to sensitive values;
• rate limits on sign-in;
• internal controls on staff access: staff can see sensitive values only for a recorded reason, staff cannot act on their own accounts or deals, and larger refunds and payments need a second staff member's approval;
• you can sign out of all devices at once; closing your account or a lock by VYBE ends every session;
• card numbers handled only by Stripe;
• screen protections in the mobile apps for sensitive screens, and app data excluded from Android backups.

No system is perfectly secure. Please use a strong, unique password and turn on two-factor authentication.

Data breaches. If a breach affects your personal information, we will notify you, and regulators where required, within the time limits set by applicable law (for example, within 30 calendar days for California residents).

11. Your choices

• Profile and settings: you can view and update most of your profile, business details, notification settings and, once payments go live, tax details in the app. Payout details are managed in your Stripe Express dashboard.
• Blocking: you can block another user, and unblock them in Settings.
• Delete your account: in Settings, in the app or on the web (vybe-co.com/account/delete).
• Directory visibility: Creators can hide from the Brand directory.
• Notifications: every email has an unsubscribe link for its category, and you can manage email and push categories in settings. Required account, tax and payout notices cannot be turned off.
• Push notifications: you can turn them off in your device settings, set quiet hours, or hide message previews.
• Cookies: you can block cookies in your browser, but you will not be able to sign in.
• Electronic tax statements: once tax forms are switched on, if you consent to electronic delivery you can withdraw consent at any time in your tax settings or by contacting support; we will then send paper copies.

12. Children

The Platform is only for adults. You must be 18 or older to create an account. We ask for your date of birth before you create an account, and, once ID checks are switched on, we also confirm Creators' age from their ID check. We do not knowingly collect personal information from anyone under 18, and the Platform is not directed to children under 13. If we learn that an account belongs to someone under 18, we lock it and delete their information within 24 hours, except where the law requires us to keep it. If you believe a minor is using VYBE, contact [email protected].

13. US state privacy rights

13.1 Who has these rights

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with consumer privacy laws have rights over their personal information. Some of these laws apply only to businesses above a certain size. Whether or not a particular law applies to VYBE yet, we offer the rights below to all US users. This includes Brands acting for their business.

13.2 Your rights

Subject to the limits the law allows, you can ask us to:

1. Know and access: tell you what personal information we have about you, the categories of sources, the purposes, and the categories of recipients, and give you a copy.
2. Correct inaccurate information.
3. Delete your personal information.
4. Portability: give you a copy in a portable, machine-readable format. Download it yourself in Settings → Account & data (a JSON file), or email [email protected]. The download holds what we keep about you and what you wrote or did on VYBE; it leaves out other people's information and security records we may not disclose, and you can ask us by email for anything it doesn't cover.
5. Opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects. We do not do any of these, so there is nothing further to switch off. You can still send an opt-out request or a GPC signal.
6. Limit the use of sensitive personal information (California). We use sensitive personal information only for purposes the law allows without offering this right, such as providing the services you asked for, verifying identity, preventing fraud and meeting legal obligations.
7. Get a list of the specific third parties we have disclosed your information to (Minnesota and Oregon residents; also available to anyone who asks).
8. Not be discriminated against for exercising your rights. We will not deny you service, charge you a different price or give you a lower quality of service because you made a request.

Limits. We may keep some information even after a deletion request, for example tax and payment records we must keep by law (section 9), records needed to prevent fraud or detect duplicate accounts, and messages that are also the other party's record of a Collaboration. We will tell you what we kept and why.

13.3 Sensitive data and consent

We process sensitive data (such as your TIN, bank account number and ID check result) only when you are a Creator, Ambassador or staff member, and only for the purposes in this policy. Where state law requires your consent to process sensitive data (for example in Connecticut), we ask for it on a separate screen before you start your ID check or enter tax details. You can withdraw consent by contacting [email protected], but we cannot pay you without the tax and identity information the law requires us to collect, and we must keep records already created for the period in section 9. We never sell sensitive data.

13.4 How to make a request

• Email [email protected] from the email address on your account, with the subject "Privacy request" and what you are asking for; or
• use the "Privacy request" link in Settings, which opens an email to us with your account details filled in.

To delete your account, you can also use Settings > Delete account (section 9).

Verification. We will verify your request by confirming you control the email address on your account. For requests involving tax or bank information, we may ask you to sign in. We will only use the information you give us for verification to process your request.

Authorized agents. You can have someone else make a request for you. We will ask the agent for your signed permission (or a valid power of attorney), and we may ask you to confirm your identity with us directly.

Timing. We will confirm receipt within 10 business days and respond within 45 days. If we need more time (up to 45 more days), we will tell you why.

13.5 Appeals

If we decline your request in whole or in part, you can appeal by replying to our decision or emailing [email protected] with the subject "Privacy appeal". A different person from the one who handled your request will review it, and we will tell you the result and our reasons in writing within 45 days. If you are not satisfied, you can contact your state attorney general.

13.6 Data from the past 12 months (California)

In the past 12 months we have collected the categories in section 3, from the sources and for the purposes listed there, and disclosed them for business purposes to the recipients listed in section 7. We have not sold or shared personal information. We have not sold or shared the personal information of anyone under 16.

14. Where we process information

VYBE is a US company and serves users in the United States. Our production systems are hosted by {{HOSTING_PROVIDER}} in {{HOSTING_REGION}}, and uploaded images are stored by Cloudflare in {{IMAGE_STORAGE_REGION}}. Some service providers (for example Stripe, Zitadel, Apple and Google) process information in the US and other countries. Wherever your information is processed, we protect it as this policy describes.

15. Changes to this policy

We will post any update on this page and change the effective date at the top. If a change materially affects how we use or disclose your personal information, we will tell you by email or in the app before it takes effect and ask you to confirm you have read the new version.

16. Contact us

• Privacy questions and requests: [email protected]
• Safety concerns: [email protected]
• General support: [email protected]
• Post: {{COMPANY_LEGAL_NAME}}, {{COMPANY_POSTAL_ADDRESS}}