Privacy policy

1. Who we are

This privacy policy describes how Vibeking collects, uses, stores and shares personal data and Google user data. Vibeking is a service of Romet Trade, Nieuw-Loosdrechtsedijk 240 a ws01, 1231 LG Loosdrecht, the Netherlands, Chamber of Commerce (KVK) number 42158919, VAT number NL005544078B74. Questions about this statement or your data: info@vibekingdevelopment.com. Romet Trade is the controller for your account, billing and the use of this website. The measurement data about your website is processed on your behalf, to deliver the service you subscribed to.

2. Which data we process

Account data: email address, name, password (stored only as an encrypted hash), language, organisation and role, and the time of sign-in.

Signing in with Google or Microsoft: if you choose this, we receive your name, your email address, whether that address is verified and a unique account ID from Google or Microsoft, and from Google also a link to your profile photo. We use your name and email address for your account; we do not use the profile photo. We never see your Google or Microsoft password. This sign-in is separate from connecting Search Console, Google Analytics and Google Ads (section 3).

Site data: the url and domain name of the websites you add, country, language and platform.

Measurements of your website: availability and response time, page speed (Google PageSpeed Insights and Chrome UX Report), a crawl of public pages (titles, headings, status codes, links, meta tags), and the questions we ask AI assistants (ChatGPT, Claude, Perplexity, Gemini and Google AI Mode) about your site with their answers, and the Google rankings and AI Overviews for your keywords.

Google data: only when you connect a Google account yourself, see section 3.

Payment data: Mollie B.V. processes our current payments. Vibeking stores name, billing address, VAT number and invoices, plus payment reference, amount, currency, payment status, payment method, payment sequence type, any failure reason and timestamps. We also store Mollie customer, profile and mandate references and administrative metadata. For mandates we store method and status and, where provided by Mollie, the account or card holder name, the last four characters of the IBAN or last four digits of the card number and card brand. The payment providers process full account and card numbers; Vibeking does not store them. Stripe remains involved only in earlier payments and existing payment data.

Invitations: when you invite someone to your organization, we process their email address to send the invitation. An invitation expires after 7 days; expired, withdrawn and accepted invitations are deleted after 30 days.

Referrals: If you sign up with an invitation code, we process which organization referred you, the code, the time of sign-up and the payment data needed for the discount and the reward: which invoices were paid, refunded or charged back and the amounts excluding VAT. The referrer only sees the month of sign-up, your status and their own credit; your organization name only if you allow this in the app. To prevent abuse we compare email domains, websites, VAT numbers and payment method characteristics held by our payment provider, such as account number or card fingerprint, which we only compare and never store, of both organizations, without showing them to the other party. Legal basis: performance of the contract and our legitimate interest in preventing abuse. We keep this data while the reward runs and afterwards for as long as the statutory retention period for business records applies (7 years).

Contact form: name, company, email address, phone number, website and your message, plus a hashed derivative of your IP address to prevent abuse of the form.

Technical data: server logs at our hosting provider (IP address, time, requested page) for security and troubleshooting.

3. Data from Google Search Console, Google Analytics and Google Ads

You can connect a Google account in Vibeking. We then ask permission for these scopes: Search Console (read only), Google Analytics (read only), Google Ads and the email address of that Google account. Google offers no read-only scope for Google Ads. Vibeking uses the access through this connection to read, and through the connection only changes the campaign status (enabled or paused) and the amount of a non-shared campaign budget, and only on your instruction and after your approval, or if you set up an autopilot within the limits you choose there (see section 11). Vibeking never makes other changes through the connection. If you order a fix in Google Ads, the Vibeking team carries it out with a separate user that you invite in Google Ads (see article 5 of the terms and conditions).

What we retrieve: from Search Console clicks, impressions, click-through rate and position per day, per query and per page of the property you select; from Google Analytics 4 sessions, users, key events and engagement per day, per channel and per landing page of the property you select; from Google Ads impressions, clicks, cost, conversions and conversion value per campaign per day of the account you select. In addition the list of properties and accounts you can choose from and the email address of the connected Google account, so the app can show which account is connected.

What for: we show this data in your dashboards, use it for goals, tasks, alerts and the monthly report, and put it next to our own measurements. We use it for nothing else: not for advertising, not for sale to third parties and not to train models. Staff only look at your data at your request (support), for security or when the law requires it.

Storage: Google access tokens are stored encrypted; the measurement data lives in our database at Supabase on Amazon Web Services servers in Ireland (EU). Access is separated per organisation.

Who receives Google user data

We share, transfer or disclose Google user data only with the parties below, only to provide the features described in this section, and never for advertising, for sale or to train AI models.

- Supabase Inc.: hosts our database on Amazon Web Services servers in Ireland (EU) and stores the measurement data and the encrypted access tokens.

- Lovable Labs Incorporated: hosts the application that retrieves and shows the data, and runs the AI gateway that passes AI requests to the model providers below.

- OpenAI, through the Lovable AI gateway: for the monthly report receives the report data of that month (key figures from Search Console and Google Analytics, top pages and search queries, and monthly Google Ads totals) to write the summary and the three recommendations. We send these requests with the setting that asks OpenAI not to store them.

- Google (Gemini model), through the Lovable AI gateway: for the assistant "Ask Vibeking" receives your question and the data needed to answer it, which can include Search Console, Google Analytics and Google Ads figures. We keep these conversations for 90 days.

- Members of your own organisation in Vibeking, who see the dashboards of that organisation.

- Authorities, only when the law requires it.

We do not share Google user data with anyone else. We do not use Google user data to train or improve AI models, ours or anyone else's.

Retention and deletion: tokens are deleted as soon as you remove a connection on the Connections page, or delete the last site that uses the token. Measurement data is deleted as soon as you delete the site on the Sites page or have your organisation deleted. You can also revoke Vibeking's access in your Google account at https://myaccount.google.com/permissions.

Vibeking's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes and legal basis

Delivering the service and your account (performance of the contract); invoicing and administration (legal obligation, retained for 7 years); answering contact requests and securing the service (legitimate interest); statistics (Google Analytics) and ad measurement (Google Ads and the OpenAI measurement pixel) on this website only with your consent (see section 6).

5. Processors and recipients

We use these parties: Lovable Labs Incorporated (application hosting, email delivery, AI gateway), Supabase (database, servers in Ireland), Mollie B.V. (current payments), Stripe Payments Europe (earlier payments and existing payment data), Google (PageSpeed Insights, Chrome UX Report and the connected Google services), OpenAI, Perplexity and Google (Gemini) for the answer tests, and DataForSEO for rankings, search volumes, competitor data, Google AI Overviews, backlink data for your site and your competitors (domain name only), the weekly Google Maps measurements around your business location and answer tests in Google AI Mode, ChatGPT and Claude (DataForSEO passes the questions on to Google, OpenAI and Anthropic): they receive only your site's domain name, your keywords, the questions asked and the business name, place and coordinates of your location, no personal data. For your location and the businesses that appear next to it in the map measurements, we store public data from Google Maps: name, address, category, rating, number of reviews, number of photos and whether the profile is claimed. We never store review texts or names of reviewers. For the AI features that use Google user data, see section 3. For Google Analytics 4, Google Ireland Limited is our processor. For ad measurement through Google Ads, Google Ireland Limited is an independent controller. If you sign in with Google or Microsoft, their own privacy terms also apply to that sign-in. Google may process data outside the EU under the EU-US Data Privacy Framework. We have data processing agreements with these parties. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses or an adequacy decision. To find the expiry date of SSL certificates, we look up your site's domain name in the public Certificate Transparency logs through SSLMate (Cert Spotter); SSLMate receives only that domain name, no personal data. For the mail and DNS security checks (SPF, DMARC, DKIM, DNSSEC) we look up public DNS records of your site's domain through Cloudflare DNS over HTTPS (1.1.1.1); Cloudflare receives only domain names, no personal data. If you connect your social channels or social ad accounts, that connection runs through Zernio Software SL (Spain): Zernio keeps the access to those accounts and gives us only figures per account (such as followers, reach, spend and clicks), no messages from your followers, and carries out the changes you approve (see section 11); you can always remove a connection yourself. We do not sell data.

For fixes where we get access to your systems, we act as your processor; see article 7 of the terms and conditions.

6. Cookies and local storage

Necessary: your sign-in session (local storage in your browser), your language choice (cookie vk_locale), a short-lived security cookie while connecting Google (vk_oauth_nonce) and your cookie choice (vk_consent). These need no consent. Cookie vk_internal: functional, only set for the Vibeking team, keeps their own visits out of the statistics, retention 1 year, no personal data.

vk_partner (local storage): remembers that you arrived through a partner site such as athomecuracao.com, so Google Analytics can attribute your request to that partner. Only with statistics consent, 90 days, contains only the partner name. Withdrawing consent deletes it.

vk_ref: stores the invitation code when you arrive through an invitation link, so your welcome discount is correct when you sign up. Functional, 90 days, contains only the code and is not used for profiles or ads.

Google Analytics 4: only after Statistics only or Allow all do we measure visitor statistics, namely pages viewed, source, device and country. Google Analytics 4 does not store IP addresses. Google sets the cookies _ga and _ga_SCDFLVM81V with a retention period of 2 years. Google Ireland Limited is our processor and Google may process data outside the EU under the EU-US Data Privacy Framework. You can withdraw your consent at any time through Cookie preferences.

Google Ads ad measurement: only after Allow all. If you arrive on this website through an ad in Google, Google Analytics stores the click ID of that ad in the cookie _gcl_aw (90 days). Through the link between Google Analytics and Google Ads, Google Ads then sees whether you create an account, submit a contact request or pay for a subscription (with the amount excluding VAT), so we can see which ads work. We do not use this for remarketing or personalised ads: we do not ask for that consent and Google signals are off. For Google Ads, Google Ireland Limited is an independent controller; see https://policies.google.com/privacy. If you withdraw your consent through Cookie preferences, the measurement stops and we remove this cookie.

OpenAI measurement pixel (ChatGPT Ads): only on this website and only after Allow all. It tells us whether visitors who arrive through an ad in ChatGPT sign up, subscribe or get in touch. The pixel sets two cookies: __oppref (30 days) and __obref (365 days). Without consent nothing is loaded and nothing is measured. With your consent, contact details you enter in a form, such as your email address, may be hashed in your browser (SHA-256) and sent to OpenAI to attribute advertising results. OpenAI is an independent controller for that data; see OpenAI's privacy policy at https://openai.com/policies/privacy-policy/. You can withdraw consent at any time through the Cookie preferences link at the bottom of the page; the cookies are then removed. If you withdraw consent, the pixel sets the cookie __oaiq_consent (30 days) with the value false, which only records that there is no consent; it contains no identifier.

When you create an account, we store where you came from: the campaign details in the link you arrived with (utm parameters and, if the link contained one, an advertising platform's click ID), the first page you visited and the website that referred you. This tells us which channels lead to sign-ups. We use no cookies for this and store nothing on your device. We use this data internally only, do not share it with third parties and delete it together with your account. When you create your organisation you can tell us how you found us. That answer is optional; we store it with your organisation, use it internally only and delete it together with your organisation.

7. Retention periods

Account data: as long as your account exists. Measurements and Google data: as long as the site is in your account; owners and admins delete a site on the Sites page. For a deleted site we keep the domain, who deleted it, when and whether it was scanned, as long as your organisation exists, so we can answer questions and the free baseline scan stays one-time. Google tokens: until you remove the connection. Contact requests: until handled and at most two years after that. Invoices and payment data: seven years (tax retention obligation). Log of changes on your behalf (proposals, decisions and results): as long as the organization exists in Vibeking; it is deleted together with the organization. To have your account deleted, email info@vibekingdevelopment.com.

8. Security

Connections are encrypted (TLS). Google access tokens are stored encrypted. Data is separated per organisation with access rules in the database. Access to production data is limited to what is needed to deliver the service.

9. Your rights

You have the right to access, rectify, erase, restrict and port your data and to object to processing based on legitimate interest. You can withdraw consent at any time. Send your request to info@vibekingdevelopment.com; we respond within one month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Changes

We update this statement when the service changes. The date at the top shows the latest change. For material changes we inform you by email or in the app.

11. Changes on your behalf (steering)

Purpose and legal basis: to carry out changes you approved, or that fall within an autopilot if you set one up, Vibeking processes data from your connected ad and social accounts: campaign status, budgets, post texts and channel ids. Legal basis: performance of the contract.

Write access: in Google Ads Vibeking only changes the campaign status and the amount of a non-shared campaign budget through the Google connection (see section 3). Posts and ad changes on Meta, LinkedIn, TikTok and Pinterest go through our connection partner for social and ads, acting as processor (see section 5).

Log: for each change Vibeking keeps the proposal, the reason, the state before and after, who decided and through which route, the times and the result. Retention: see section 7.

Notifications: owners and admins receive an email for a new proposal, a failed change, and a change not carried out because the state had changed in the meantime. Webhooks you set up receive the same events.