Privacy Policy

This Privacy Policy applies to VibeCody, the website at vibecody.app, and related content-generation, media-rendering, publishing, scheduling, and analytics services (together, the “Services”).

Lagodish Tech, based at Złota 75A, 00-819 Warszawa (Wola), Poland (“Lagodish Tech,” “we,” “us,” or “our”), operates VibeCody and is the controller of personal data processed through the Services unless a different role is stated. This policy is intended to satisfy the GDPR, UK GDPR, Polish data-protection law, and other applicable privacy laws. We have not appointed a Data Protection Officer; privacy requests go to [email protected].

We collect information in the following categories:

• Account data: name, email address, authentication identifiers, workspace membership, language, and account settings.
• Projects and creator data: project names, brand and audience information, AI-avatar profiles, scripts, prompts, voice settings, assets, captions, disclosure selections, schedules, approvals, and revision history.
• Media: uploaded and generated images, audio, video, transcripts, render outputs, storage identifiers, file metadata, and integrity hashes.
• Connected-account data: platform account identifiers, display names, avatars, granted permissions, encrypted OAuth tokens, publication identifiers, permalinks, status events, and available platform-specific performance metrics.
• Communications and billing records: support requests, feedback, credit usage, transaction status, and related records. Payment processors handle full payment-card details; we do not store them.
• Technical and usage data: IP address, browser and device information, timestamps, requested pages, feature usage, diagnostic logs, and security events.

You may connect Google and supported social accounts through their official OAuth and API flows. Google Sign-In uses basic account identity information to create or access your VibeCody account. When you separately connect Google Analytics or Search Console, we use the authorized site and performance data to display analytics and support content planning. When you connect Google Business Profile, we use the authorized account to list manageable locations and publish only the posts you review and approve.

We request only permissions needed for the user-visible feature you choose, such as identifying the connected account, reading authorized analytics, publishing approved content, reconciling publication status, and retrieving performance metrics. OAuth tokens and any user-supplied OAuth client credentials are encrypted at rest and used only for the configured connection. We do not use private or undocumented platform endpoints, sell connected-account data, or use it for targeted advertising.

You can disconnect an account in VibeCody and revoke access in the platform’s own settings. Revocation stops future API access. You may request deletion of stored connection data at [email protected].

Our handling of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used to train generalized AI models or for advertising.

When you request generation, analysis, speech, image, or video features, the relevant inputs and assets may be sent to selected AI and media-processing providers solely to produce the requested result. The provider and model may vary by feature and workspace configuration.

Avatar images, voice samples, and generated media may depict an identifiable person. We process them to provide creator and production features, not to identify people, build faceprints, or perform biometric authentication. You must have the rights and permissions required to upload and use any person’s likeness or voice.

Do not submit sensitive personal information that is unnecessary for content production. AI outputs can contain errors; users must review content and disclosures before approval or publication.

We process information for these purposes and legal bases:

• To create accounts and provide requested generation, rendering, publishing, scheduling, and analytics features — performance of our contract with you.
• To connect third-party accounts and act on explicit publication approvals — performance of our contract and your authorization or consent.
• To secure, debug, monitor, and improve the Services, prevent abuse, and maintain reliable operations — our legitimate interests.
• To answer support requests and send service, security, or policy notices — performance of our contract and legitimate interests.
• To maintain tax, accounting, compliance, and audit records or respond to lawful requests — legal obligations and legitimate interests.

We do not make solely automated decisions about users that produce legal or similarly significant effects.

We do not sell personal information for money. We may disclose it to:

• Cloud hosting, storage, database, queue, email, security, support, payment, and error-monitoring providers acting on our behalf.
• AI, voice, image, and video providers when you invoke the corresponding feature.
• TikTok, Meta, Google, and other platforms when you connect an account or approve a platform action.
• Authorities or professional advisers where required by law or reasonably necessary to protect rights, safety, security, and the integrity of the Services.
• A successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and data-protection safeguards.

A current list of material processors is available on request.

We use strictly necessary cookies and similar storage for authentication, security, session continuity, load balancing, consent choices, and user preferences. These are required for the Services to function. The marketing website may also use non-essential analytics cookies to understand aggregate site usage, but only after you make the applicable choice in the cookie consent controls where consent is required by law.

You can reject or customize non-essential cookies through the consent controls. Browser settings can also remove or block cookies, but blocking necessary cookies may prevent sign-in or other core functionality.

Service providers and connected platforms may process information outside Poland, the European Economic Area, the United Kingdom, or your country. Where required, we rely on adequacy decisions, the European Commission’s Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, and comparable safeguards. You may request information about applicable safeguards from [email protected].

We retain information only as long as reasonably necessary for the purposes in this policy, including providing the Services, maintaining security and audit history, resolving disputes, and meeting legal obligations.

• Account, project, content, and analytics records are generally kept while the account or project remains active and for a limited period after deletion.
• OAuth tokens are retained while a connection remains active and are deleted or rendered unusable after disconnection, deletion, or provider revocation, subject to limited backup retention.
• Security and diagnostic logs are retained for a limited operational period; financial and compliance records may be kept longer where law requires.
• De-identified or aggregated data that can no longer reasonably identify a person may be retained for service analysis.

To request account or connected-platform data deletion, email [email protected]. We may verify your identity before completing a request.

We use safeguards designed to protect information, including TLS in transit, access controls, least-privilege practices, hashed passwords, encrypted OAuth credentials, immutable approval records, and operational monitoring. No system is completely secure, so we cannot guarantee absolute security. Report suspected security issues to [email protected].

Depending on your location, you may have rights to access, correct, delete, or receive a portable copy of personal information; restrict or object to certain processing; withdraw consent; and complain to a data-protection authority. You will not be discriminated against for exercising a privacy right.

Submit requests to [email protected]. If you are in Poland, you may also complain to the Urząd Ochrony Danych Osobowych (UODO). We prefer the opportunity to address your concern directly first.

Some U.S. state laws define “sale” or “sharing” broadly. We do not knowingly sell personal information for money or share it for cross-context behavioral advertising. Residents of California and other applicable states may request access, correction, deletion, portability, or an opt-out and may use an authorized agent, subject to verification.

Some browsers transmit a Do Not Track signal, for which no uniform industry standard exists. We recognize Global Privacy Control as an opt-out preference where applicable law requires it.

The Services are intended for adults and professional creators aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact [email protected] so we can investigate and delete it where appropriate.

The Services integrate with third-party platforms and may link to their websites. Their processing is governed by their own terms and privacy policies. Platform publication, moderation, visibility, analytics definitions, and availability are controlled by the relevant platform, not Lagodish Tech.

We may update this policy as the Services, providers, or legal requirements change. We will update the date above and provide additional notice when required. Material new uses of connected-platform data will be disclosed before they begin, and additional consent will be requested where required.