Privacy policy

1. Who we are

This privacy policy describes how Vibeking collects, uses, stores and shares personal data and Google user data. Vibeking is a service of Romet Trade, Nieuw-Loosdrechtsedijk 240 a ws01, 1231 LG Loosdrecht, the Netherlands, Chamber of Commerce (KVK) number 42158919. Questions about this statement or your data: info@vibekingdevelopment.com. Romet Trade is the controller for your account, billing and the use of this website. The measurement data about your website is processed on your behalf, to deliver the service you subscribed to.

2. Which data we process

Account data: email address, name, password (stored only as an encrypted hash), language, organisation and role, and the time of sign-in.

Site data: the url and domain name of the websites you add, country, language and platform.

Measurements of your website: availability and response time, page speed (Google PageSpeed Insights and Chrome UX Report), a crawl of public pages (titles, headings, status codes, links, meta tags), and the questions we ask AI assistants (Perplexity, ChatGPT, Gemini) about your site with their answers.

Google data: only when you connect a Google account yourself, see section 3.

Payment data: name, billing address and VAT number through Stripe. Card and bank details never reach us; Stripe processes them.

Invitations: when you invite someone to your organization, we process their email address to send the invitation. An invitation expires after 7 days; expired, withdrawn and accepted invitations are deleted after 30 days.

Contact form: name, company, email address, phone number, website and your message, plus a hashed derivative of your IP address to prevent abuse of the form.

Technical data: server logs at our hosting provider (IP address, time, requested page) for security and troubleshooting.

3. Data from Google Search Console, Google Analytics and Google Ads

You can connect a Google account in Vibeking. We then ask permission for these scopes: Search Console (read only), Google Analytics (read only), Google Ads and the email address of that Google account. Google offers no read-only scope for Google Ads; Vibeking uses that access only to read and never changes anything in your advertising account.

What we retrieve: from Search Console clicks, impressions, click-through rate and position per day, per query and per page of the property you select; from Google Analytics 4 sessions, users, key events and engagement per day, per channel and per landing page of the property you select; from Google Ads impressions, clicks, cost, conversions and conversion value per campaign per day of the account you select. In addition the list of properties and accounts you can choose from and the email address of the connected Google account, so the app can show which account is connected.

What for: we show this data in your dashboards, use it for goals, tasks, alerts and the monthly report, and put it next to our own measurements. We use it for nothing else: not for advertising, not for sale to third parties and not to train models. Staff only look at your data at your request (support), for security or when the law requires it.

Storage: Google access tokens are stored encrypted; the measurement data lives in our database at Supabase on Amazon Web Services servers in Ireland (EU). Access is separated per organisation.

Who receives Google user data

We share, transfer or disclose Google user data only with the parties below, only to provide the features described in this section, and never for advertising, for sale or to train AI models.

- Supabase Inc.: hosts our database on Amazon Web Services servers in Ireland (EU) and stores the measurement data and the encrypted access tokens.

- Lovable Labs Incorporated: hosts the application that retrieves and shows the data, and runs the AI gateway that passes AI requests to the model providers below.

- OpenAI, through the Lovable AI gateway: for the monthly report receives the report data of that month (key figures from Search Console and Google Analytics, top pages and search queries, and monthly Google Ads totals) to write the summary and the three recommendations. We send these requests with the setting that asks OpenAI not to store them.

- Google (Gemini model), through the Lovable AI gateway: for the assistant "Ask Vibeking" receives your question and the data needed to answer it, which can include Search Console, Google Analytics and Google Ads figures. We keep these conversations for 90 days.

- Members of your own organisation in Vibeking, who see the dashboards of that organisation.

- Authorities, only when the law requires it.

We do not share Google user data with anyone else. We do not use Google user data to train or improve AI models, ours or anyone else's.

Retention and deletion: tokens are deleted as soon as you remove a connection on the Connections page. Measurement data is deleted as soon as you delete the site or your organisation. You can also revoke Vibeking's access in your Google account at https://myaccount.google.com/permissions.

Vibeking's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes and legal basis

Delivering the service and your account (performance of the contract); invoicing and administration (legal obligation, retained for 7 years); answering contact requests and securing the service (legitimate interest); statistics (Google Analytics) and ad measurement (Google Ads and the OpenAI measurement pixel) on this website only with your consent (see section 6).

5. Processors and recipients

We use these parties: Lovable Labs Incorporated (application hosting, email delivery, AI gateway), Supabase (database, servers in Ireland), Stripe Payments Europe (payments and invoices), Google (PageSpeed Insights, Chrome UX Report and the connected Google services), OpenAI, Perplexity and Google (Gemini) for the answer tests: for those they only receive your site's domain name and the questions asked, no personal data. For the AI features that use Google user data, see section 3. For Google Analytics 4, Google Ireland Limited is our processor. For ad measurement through Google Ads, Google Ireland Limited is an independent controller. Google may process data outside the EU under the EU-US Data Privacy Framework. We have data processing agreements with these parties. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses or an adequacy decision. We do not sell data.

6. Cookies and local storage

Necessary: your sign-in session (local storage in your browser), your language choice (cookie vk_locale), a short-lived security cookie while connecting Google (vk_oauth_nonce) and your cookie choice (vk_consent). These need no consent. Cookie vk_internal: functional, only set for the Vibeking team, keeps their own visits out of the statistics, retention 1 year, no personal data.

Google Analytics 4: only after Statistics only or Allow all do we measure visitor statistics, namely pages viewed, source, device and country. Google Analytics 4 does not store IP addresses. Google sets the cookies _ga and _ga_SCDFLVM81V with a retention period of 2 years. Google Ireland Limited is our processor and Google may process data outside the EU under the EU-US Data Privacy Framework. You can withdraw your consent at any time through Cookie preferences.

Google Ads ad measurement: only after Allow all. If you arrive on this website through an ad in Google, Google Analytics stores the click ID of that ad in the cookie _gcl_aw (90 days). Through the link between Google Analytics and Google Ads, Google Ads then sees whether you create an account, submit a contact request or pay for a subscription (with the amount excluding VAT), so we can see which ads work. We do not use this for remarketing or personalised ads: we do not ask for that consent and Google signals are off. For Google Ads, Google Ireland Limited is an independent controller; see https://policies.google.com/privacy. If you withdraw your consent through Cookie preferences, the measurement stops and we remove this cookie.

OpenAI measurement pixel (ChatGPT Ads): only on this website and only after Allow all. It tells us whether visitors who arrive through an ad in ChatGPT sign up, subscribe or get in touch. The pixel sets two cookies: __oppref (30 days) and __obref (365 days). Without consent nothing is loaded and nothing is measured. With your consent, contact details you enter in a form, such as your email address, may be hashed in your browser (SHA-256) and sent to OpenAI to attribute advertising results. OpenAI is an independent controller for that data; see OpenAI's privacy policy at https://openai.com/policies/privacy-policy/. You can withdraw consent at any time through the Cookie preferences link at the bottom of the page; the cookies are then removed. If you withdraw consent, the pixel sets the cookie __oaiq_consent (30 days) with the value false, which only records that there is no consent; it contains no identifier.

7. Retention periods

Account data: as long as your account exists. Measurements and Google data: as long as the site is in your account. Google tokens: until you remove the connection. Contact requests: until handled and at most two years after that. Invoices and payment data: seven years (tax retention obligation). To have your account deleted, email info@vibekingdevelopment.com.

8. Security

Connections are encrypted (TLS). Google access tokens are stored encrypted. Data is separated per organisation with access rules in the database. Access to production data is limited to what is needed to deliver the service.

9. Your rights

You have the right to access, rectify, erase, restrict and port your data and to object to processing based on legitimate interest. You can withdraw consent at any time. Send your request to info@vibekingdevelopment.com; we respond within one month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Changes

We update this statement when the service changes. The date at the top shows the latest change. For material changes we inform you by email or in the app.