Privacy

Vibely is used by companies to run their operations. That makes two kinds of person relevant, and the distinction matters throughout: users, who hold an account and sign in, and records — the leads, clients and contacts a customer stores about other people.

For a customer’s own users we are the controller. For the records they store we are a processor acting on their instructions: we do not decide what goes in, and a request to see or delete a record goes to the company that holds it, not to us.

Account details (name, email address, and a password stored only as an argon2id hash, never in a form that can be reversed), the organizations you belong to and your role in each, and the business data your company enters — leads, clients, projects, hours, expenses, invoices and payroll figures.

Sessions are opaque random tokens held only as a SHA-256 hash. A database leak yields nothing that can be replayed, and deleting a session ends it immediately rather than at the next token refresh.

Credentials stored in the project vault are encrypted with AES-256-GCM under a key this application holds separately, and each ciphertext is bound to its own record so a row copied elsewhere fails to decrypt rather than revealing the wrong secret.

No card details. Payment is handled by Stripe’s hosted checkout and no card number reaches this application at any point.

No mailbox contents. Vibely sends email and logs what it sent; it does not read anybody’s inbox, and there is no integration that would let it.

No advertising identifiers, no third-party analytics scripts, and no cross-site tracking. The only cookies set are the session cookie, the theme preference and the OAuth state token used to make sign-in safe.

Every table is isolated at the database level by row-level security keyed on the organization, not by a filter in application code — so a forgotten condition returns nothing rather than another company’s rows. Within a company, what each person sees is decided by their role.

Our own staff cannot read customer business data. The operator console runs as a database role with no read privilege on those tables, and that is enforced by the database rather than by a check in code. A support engineer who genuinely needs to see a screen must impersonate, which is time-limited, shows an unmistakable banner to anyone using the account, and writes every change into the customer’s own audit trail under their name.

A complete export — every module as CSV, plus attachments — can be requested from Settings at any time, including while an account is suspended. The download link is minted when you click it rather than emailed, because a link to a full copy of a company’s data sitting in a mailbox is a credential.

Deleted records go to a recycle bin, stay restorable for thirty days, and are then permanently removed along with any files attached to them. Closing an account removes its data on the same schedule.

Hosting and object storage (AWS), transactional email (Amazon SES), payments (Stripe), and error reporting (Sentry, with personal data scrubbed before it is sent). Nothing else receives customer data.

Material changes are announced in the product before they take effect. The date at the top of this page is the only version marker; there is no separate archive.

See also the terms of service.