Privacy Policy

Vibel is installed by a merchant (“you,” “the merchant”) on a Shopify store. In most cases you are the data controller for your store and customer data, and Vibel is a data processor acting on your instructions. For account and billing data about you directly, Vibel (operated by HAVA Export B.V., trading as Vibel, registered in the Netherlands) is the controller.

Account data: your name, email, and store domain, used to create and secure your Vibel account.

Store and commerce data: read via the Shopify API under the scopes you approve at install, orders, products, inventory, fulfillments, and the customer fields needed for order and shipping analytics (name, email, address, order history). We do not request scopes beyond what the product needs.

Connected-tool data: if you optionally connect Klaviyo, Meta, Google Ads, GA4, Search Console, TikTok, Pinterest, Stripe, AfterShip, Gorgias, Zendesk, Monday, or QuickBooks Online, we read performance, ticket, or accounting data from that tool, using the access you grant, solely to power your dashboard, watchers, and reports. We do not push your Shopify or customer data into these tools, we only read from them.

Publishing you approve: if you turn on publishing for a connected account (Facebook Page, Instagram, TikTok, Pinterest, or YouTube), Vibel can publish posts, pins, or videos to that account using the permission you grant: pages_manage_posts and instagram_content_publish (Meta), video.publish (TikTok), pins:write and boards:write (Pinterest), youtube.upload (YouTube). Vibel only publishes content you created or approved in Vibel, and only after you press Publish or approve a schedule. Nothing is posted by itself. Vibel can edit or delete only posts it published for you. We store the post id and link so you can see what was published. Disconnecting the account deletes the access token; you can also revoke access in the platform's own settings at any time.

Comments on your Facebook Page: with pages_read_user_content, Vibel reads comments people leave on your own Facebook Page posts and shows them in your comments queue with a suggested reply. This is read-only: Vibel does not post, hide, or delete comments on Facebook.

Meta (Facebook) Ads: when you connect Meta, we use the Marketing API to read the list of ad accounts you manage (so you can pick which one to connect) and that account's performance data (spend, impressions, clicks, conversions, and ROAS), shown only to you inside your own dashboard. Your Meta access token is stored encrypted in our secrets vault, never exposed to the browser or to other users, and deleted when you disconnect the source.

TikTok Shop: when you connect TikTok Shop, we read your shop's order information (which can include a buyer's name, delivery address, and contact details where TikTok provides them), product catalog, fulfillment and logistics status, returns and refunds, and settlement/payout data, using read-only API scopes. This data is used solely to show you your own operations dashboard, alerts, and reports. It is stored encrypted at rest in the EU, is never used for advertising, profiling, or model training, is never sold or shared with third parties beyond the subprocessors listed below, and is deleted when you disconnect TikTok Shop or delete your account. Your TikTok Shop access token is stored encrypted in our secrets vault and removed immediately on disconnect.

Usage data: log-in activity, feature usage, and error diagnostics, used to operate and improve the product. We record approximate sign-in location signals to protect accounts against abuse.

Content you send us: if you use the AI assistant or ask-anything bar, the prompts you write and the store data needed to answer them.

To provide the service: compute your metrics, run the watcher engine, generate the priority feed, drafts, and digests, and respond to support requests. We do not sell personal data, and we do not use your data to train third-party AI models. AI processing (Anthropic's Claude API) is used only to rank, summarize, or draft content on your data; Anthropic does not train on data sent through its API.

We apply the following safeguards to all merchant data, and in particular to sensitive data such as access tokens, API keys, and data read from your connected tools:

Encryption in transit: all traffic between your browser, Vibel, and every connected platform uses TLS (HTTPS); we make no unencrypted requests.
Encryption at rest: all stored data is encrypted at rest in our managed database (Supabase/PostgreSQL). OAuth tokens, refresh tokens, and API keys are additionally stored in an encrypted secrets vault, referenced only by opaque ids, decrypted server-side at the moment of an API call, and never sent to the browser, logged, or exposed to other users.
Tenant isolation: every table is protected by database row-level security, so one merchant's data can never be read by another merchant's account.
Least privilege: we request only read-only scopes from connected platforms, and only the narrowest scopes needed for the features you use.
Access control: production data access is restricted to authorized personnel for support, security, and legal compliance only, and is logged.
Deletion: disconnecting a source deletes its stored credentials immediately; uninstalling the app or deleting your account triggers deletion of your stored data (see Retention below).
Incident response: if a breach affects your personal data, we will notify you and the competent authorities without undue delay, in line with GDPR requirements.

Vibel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect Google Analytics 4 (scope analytics.readonly) or Google Search Console (scope webmasters.readonly), we read only aggregated reporting data (sessions, engagement, conversions; query impressions, clicks, and positions) to display it in your own dashboard. This data is used solely to provide the analytics features you see; it is never used for advertising, never sold, never transferred to third parties except the subprocessors listed below as needed to run the service, and never used to train AI models. No human reads this data except with your consent, for security or abuse investigation, or where required by law. Your Google OAuth tokens are protected exactly as described above (encrypted vault, server-side only) and are deleted when you disconnect Google or uninstall Vibel; stored Google reporting data is deleted with your account.

Vibel's use and transfer of information received from Google APIs, including YouTube API data and data from Google Ads, GA4, and Search Console, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we read. If you connect your YouTube channel (Settings → Connections → YouTube), we use YouTube API Services with two read-only permissions, youtube.readonly and yt-analytics.readonly. We read your channel's id and name, the list of your own uploaded videos and Shorts (title, publish date, duration, link), and their results: views, likes, comments, shares, average view duration, and subscribers gained. If you also turn on uploading, Vibel uses youtube.upload to upload a video you approved to your own channel (private by default). Vibel never edits, deletes, or comments on your other videos.

Why. To show you which of your videos work, next to your ad and store data, in your own Vibel dashboard and trial board. The data is shown only to you and the team members you invite. It is never sold, never used for advertising, never used to train AI models, and no human reads it except with your consent, for security or abuse investigation, or where required by law.

How long we keep it. The access token is stored encrypted. Video results are refreshed by a daily sync while you are connected. When you disconnect YouTube in Vibel, we immediately revoke Vibel's access at Google and delete the YouTube data we stored for that channel, including synced videos, their metrics and any links to them. The same happens automatically if you revoke Vibel's access in your Google security settings, and we delete any YouTube data that has not been refreshed within 30 days. For everything else, see data deletion, or email privacy@getvibel.com.

How to revoke access. Disconnect YouTube in Vibel (Settings → Connections), or remove Vibel in your Google security settings.

By using the YouTube connection you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

We record product usage events of business users (pages, searches, errors) under legitimate interest to fix problems and help customers, kept 90 days. We do not record what you type into forms and we do not record sessions.

Where GDPR applies, we process merchant account data under contract (providing the service you signed up for) and legitimate interest (product security and improvement). Store and customer data read through your connected tools is processed on your instructions as processor, under the contract between you and your own customers; you remain responsible for your own lawful basis to share that data with us.

If your business needs a formal Data Processing Agreement under GDPR Article 28 for your own procurement or compliance review, see our Data Processing Agreement, which sets out the terms above in contract form, and our sub-processor list.

Account and store data are retained for as long as your Vibel account is active. Uninstalling the app or deleting your account triggers deletion of your stored data as described below and in our Security page. Audit and billing records are kept longer where we have a legal or accounting obligation to do so.

If you turn on conversion feedback for Meta, Google, Pinterest, or TikTok (Settings → Conversion feedback), Vibel sends those platforms hashed email, phone, name, city, and postcode of the customer who placed a qualifying order, along with order value and currency, so the platform can match your ad spend to the order it drove. The identifiers are hashed before they leave Vibel; we never send the plaintext customer record.

For this flow, you (the merchant) are the controller and Vibel acts as your processor, sending the data on your instruction and only to the platform(s) you choose to enable, per our Data Processing Agreement. Turning a platform off in Settings stops further sends to that platform immediately. The current destinations:

• Meta: hashed email, phone, name, city, and postcode of the customer who placed the order; order value and currency
• Google: hashed email, phone, name, city, and postcode of the customer who placed the order; order value and currency
• Pinterest: hashed email, phone, name, city, and postcode of the customer who placed the order; order value and currency
• TikTok: hashed email, phone, name, city, and postcode of the customer who placed the order; order value and currency

If you install the Vibel pixel on your storefront, it collects the visitor's IP address and browser user agent on page views and checkout events, in addition to the order-level fields described above. Where the visitor's consent allows it, we send the IP address and user agent to Meta, Pinterest, and TikTok so those platforms can match the visit to the ad that drove it; we never send them when consent does not allow it. The IP address and user agent are deleted from our systems 90 days after collection, well before the rest of the event, which follows our standard pixel-event retention (see our Security page).

If you connect Vibel Reply, a separate Vibel product for Instagram and Facebook comment-to-DM automation, you accept Vibel Reply's own terms and privacy policy at getreply.vibel.app (or reply.getvibel.com) when you sign up there; this section explains how Reply data reaches Vibel.

DM-to-order matching. Where you connect both Vibel and Vibel Reply for the same store, Vibel matches a Reply conversation to a Shopify order placed by the same shopper, using signals such as a tracked link click, a discount code, or a matched contact identifier, so you can see which DM conversations led to a sale. This matching runs on your own store's data and is shown only to you; it is not used to build a cross-brand profile of an individual shopper.

Chat checks. Where Reply's AI drafts or sends a reply, Vibel and Reply run automated checks on that content (for example, against Meta's messaging rules and your own configured guardrails) before it sends, and keep a record that the check ran and what it found, to show you why a message was sent, held, or blocked.

Consent for the people you message. Reply records, in an append-only consent log, what a person agreed to, when, and under what wording, before you send them a marketing message; a comment asking for one reply is not treated as marketing consent. See Vibel Reply's own Privacy Policy for the full detail of that record.

Retention. Reply conversation, consent, and DM-to-order match data is kept on Reply's own systems under Reply's Privacy Policy; Vibel stores only the matched order/attribution result, not the DM content itself, and deletes it on the same schedule as the rest of your account data (see Retention above).

Vibel may learn from patterns across its customer base, for example which ad formats or messaging approaches tend to perform better within a product category, to improve the recommendations every customer receives. This learning never uses your raw content, spend figures, or data in a form that identifies you or your store; a pattern is only formed by combining data from several unrelated customers, never from yours alone. You can opt out of contributing to this learning at any time in Settings, without losing access to the Service. See our Data Processing Agreement, section 3, for the contractual version of this clause.

We may assign or transfer this agreement, in whole or in part, to an affiliate or group company (including a successor entity operating Vibel) by giving you written notice; your rights under this agreement are not reduced by such a transfer.

Some subprocessors operate in the United States. Where we transfer personal data originating in the EEA or UK to the US, we rely on Standard Contractual Clauses or an equivalent safeguard maintained by that subprocessor.

As a Shopify app, Vibel implements Shopify's mandatory compliance webhooks:

customers/data_request: we log the request against the relevant store so you, the merchant, can fulfil your customer's access request; Vibel holds only order-linked fields (name, email, address, order history), not a separate customer profile.

customers/redact: we delete the stored customer's personal data (matched by customer ID or email) from our customer records and derived per-customer views for that store.

shop/redact: sent by Shopify 48 hours after uninstall; we delete that store's order data, product data, customer records, and derived customer projections, and mark the connection disconnected.

Vibel's own app and marketing pages set only the session cookie required to keep you signed in (via Supabase Auth). We do not set third-party advertising or cross-site tracking cookies on getvibel.com or in the app. If you connect an analytics or ad source (e.g. GA4, Meta), any cookies on your own storefront are set by that provider under your own configuration, not by Vibel.

If you are in the EEA, UK, or a jurisdiction with similar law, you may request access, correction, deletion, or export of your account data, or object to or restrict certain processing. For data about your store's customers, please route the request through your own store, since you are the controller of that data; contact us if you need our help fulfilling it. To exercise rights over your own Vibel account data, contact us below.

You are responsible for having a lawful basis to share your customers' data with Vibel and for your own privacy notice to your customers. Disconnecting a source or uninstalling the app stops further access and triggers deletion as described above.

We may update this policy as the product evolves. Material changes will be reflected by updating the date above; continued use after an update means you accept the revised policy.

Questions about this policy or a data request: privacy@getvibel.com.