Privacy Policy

1. Overview

VibeCloud LLC is the controller of personal data described in this policy. We provide an AI-native platform for deploying code, applications, databases, and related services to managed infrastructure.

This notice explains our processing in clear terms, including our purposes, legal bases, recipients, retention periods, international transfers, and your rights under the GDPR and applicable Cyprus law.

2. Data We Collect

We may collect the following categories of data:

Do not upload special-category personal data or regulated data unless your agreement with us expressly permits it. You control the code and content you deploy.

3. How We Use Data

We use your data strictly for:

• Create accounts, provide deployments, databases, domains, support, and billing
• Authenticate users and operate MCP, APIs, dashboards, and infrastructure
• Protect the service, investigate incidents, prevent fraud, spam, malware, and abuse
• Monitor reliability, debug failures, improve features, and understand service usage
• Send essential service messages and, with permission where required, product updates
• Comply with law, enforce our Terms, and establish or defend legal claims

We do not sell personal data.

4. Legal Basis (GDPR)

If you are in the EEA, we process data based on:

• Performance of a contract, including account creation, deployment, support, and billing
• Our legitimate interests in securing, operating, improving, and protecting VibeCloud, balanced against your rights
• Compliance with legal obligations, including tax, accounting, sanctions, and lawful requests
• Consent for optional analytics, marketing, or other processing where consent is required; you may withdraw it at any time

5. Data Sharing

We may share data with:

• Cloud, hosting, storage, CDN, domain, database, email, support, security, and monitoring providers
• Payment processors and professional advisers such as accountants, auditors, insurers, and legal counsel
• A buyer, investor, or successor during a corporate transaction, subject to appropriate safeguards
• Courts, regulators, law enforcement, or other parties where disclosure is legally required or necessary to protect rights and safety

Processors may use personal data only on our documented instructions and under contracts requiring confidentiality, security, and GDPR-compliant safeguards. We do not sell personal data.

6. Data Retention

We retain data only as long as necessary:

• Account and subscription data for the life of the account, then normally up to 30 days after closure unless a longer period is required
• Operational and security logs generally for 30 to 180 days, depending on security and reliability needs
• Backups until overwritten under our normal backup cycle, generally within 90 days
• Billing, tax, dispute, and compliance records for the period required by Cyprus and EU law
• Deployed code and customer content until deletion by you or account termination, subject to backup cycles and legal holds

7. Security

We implement appropriate technical and organizational measures, including:

• Encryption in transit, and encryption at rest where appropriate
• Role-based access controls, least-privilege access, secret management, and audit logging
• Infrastructure isolation, monitoring, backups, vulnerability management, and incident response
• Vendor review and staff confidentiality obligations

No system is 100% secure, but we continuously improve protections.

8. International Transfers

We may use providers located outside Cyprus or the European Economic Area. This can involve an international transfer of personal data.

We ensure safeguards such as:

• An adequacy decision adopted by the European Commission
• The European Commission Standard Contractual Clauses, with supplementary measures where appropriate
• Another lawful transfer mechanism permitted by the GDPR

9. Your Rights

Depending on your location, you may have the right to:

• Be informed and obtain access to your personal data
• Correct inaccurate or incomplete personal data
• Request erasure or restriction where the GDPR conditions apply
• Object to processing based on legitimate interests and object at any time to direct marketing
• Receive eligible data in a portable, machine-readable format
• Withdraw consent without affecting earlier lawful processing
• Lodge a complaint with the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority

To exercise rights:legal@vbcld.com

10. Additional regional rights

Where another privacy law applies, you may also have rights to:

• Know the categories and sources of personal data we process
• Request access, correction, deletion, or a copy of eligible data
• Opt out of sale, sharing, or targeted advertising where applicable; VibeCloud does not sell personal data

11. Cookies

We may use minimal cookies or similar technologies for:

• Authentication
• Security
• Preferences and, where permitted, privacy-friendly analytics

Where consent is required, optional cookies are used only after your choice. You can change browser controls or any cookie settings we provide.

12. Changes

We may update this notice to reflect product, legal, or operational changes. We will post the revised date and provide additional notice where a change materially affects your rights.