1. Who We Are
VybeVerse ("we", "us", "our") is a creator platform operated from the United Kingdom. We provide tools that allow creators to build their online presence, sell digital products, and grow their audience. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website at vybeverse.com and related services.
For any privacy-related queries, contact us at legal@vybeverse.com.
2. Information We Collect
2.1 Information You Provide
When you create an account or use our services, we may collect your name, email address, username, display name, profile photo, location, bio, and niche category. Creators may also provide banner images, product descriptions, product files, and social links.
2.2 Payment Information
All payment processing is handled by Stripe. We do not collect, store, or have access to your full credit card number, CVV, or banking details. Stripe processes your payment information in accordance with PCI-DSS standards. We receive only a confirmation of the transaction, the amount, and a transaction identifier.
2.3 Automatically Collected Information
When you visit our website, we automatically collect certain technical data including your IP address, browser type, device information, and pages visited. This data helps us maintain and improve our services.
2.4 Cookies and Similar Technologies
We use cookies and similar technologies to operate our platform, understand how it is used, and improve your experience. Cookies are small text files stored on your device when you visit a website. We use the following categories of cookies:
- Strictly necessary cookies: Required for the platform to function. These include authentication cookies set by Clerk (to keep you logged in), security cookies set by Cloudflare (to protect against bot attacks and abuse), payment cookies set by Stripe (for fraud prevention during checkout), hosting cookies set by Vercel (in limited cases such as preview deployments), and consent management cookies set by CookieYes (to remember your cookie preferences). These cookies cannot be disabled as they are essential for the service.
- Analytics: We use Vercel Analytics and Vercel Speed Insights to understand aggregate usage patterns and monitor site performance. These tools are privacy-friendly and do not set tracking cookies or collect personally identifiable information. We also use Google Analytics 4 (GA4) to understand how visitors discover and use our platform. GA4 sets cookies (such as
_gaand_ga_*) to distinguish unique visitors and measure session activity. GA4 cookies are only set after you accept analytics cookies through our consent banner. We have configured GA4 with IP anonymisation, sensitive data redaction (auth tokens, session IDs), and Google Consent Mode v2 to ensure no tracking occurs without your explicit consent. In addition, we use PostHog for product analytics, including session recordings, heatmaps, and user behaviour analysis. PostHog sets cookies (such asph_*_posthog) to identify unique users and track session activity. PostHog cookies are only set after you accept analytics cookies through our consent banner. We have configured PostHog to NOT collect IP addresses, to mask all form inputs in session recordings (passwords, emails, payment information), and to redact sensitive data. PostHog data is processed on EU servers.
We do not use third-party advertising cookies, retargeting cookies, or cookies that share data with social media platforms (such as Meta Pixel or TikTok Pixel). While Google Analytics 4 supports advertising features, we have explicitly disabled them — Google Signals is off, ads personalisation features are disabled, and we do not run any advertising campaigns at this time. If we introduce advertising in the future, we will update this Privacy Policy and request your consent through the cookie banner before any advertising cookies are set.
When you first visit VybeVerse, you will see a cookie consent banner that allows you to accept or reject non-essential cookies. You can change your preferences at any time by clicking the Cookie Preferences link in the footer of any page. Cookie preferences are managed via CookieYes, our consent management platform.
3. How We Use Your Information
We use the information we collect to:
- Create and manage your account
- Process transactions and deliver digital products
- Display creator profiles and product pages
- Provide customer support
- Send essential service communications (order confirmations, account updates)
- Maintain platform security and prevent fraud
- Comply with legal obligations
We do not sell, rent, or share your personal data with third parties for marketing purposes.
4. Legal Basis for Processing (UK GDPR)
We process your personal data under the following legal bases:
- Contract performance: Processing necessary to provide our services to you, such as account creation, transaction processing, and product delivery.
- Legitimate interests: Maintaining platform security, preventing fraud, and improving our services.
- Legal obligation: Complying with applicable UK laws and regulations.
- Consent: Where you have given explicit consent, such as providing your email for a free product download (lead magnets).
5. Third-Party Services
We use the following third-party services to operate our platform. Each provider processes data in accordance with their own privacy policies:
- Clerk— Authentication and user management. Processes your email, name, and profile photo. Clerk may set additional cookies on its own domains (such as clerk.vybeverse.com) for authentication, security, and to operate its own analytics. These cookies are governed by Clerk's privacy policy, which is available at clerk.com/legal/privacy.
- Stripe — Payment processing. Handles all payment card data securely under PCI-DSS compliance. We use Stripe Connect to facilitate creator payouts.
- Cloudinary — Secure file storage for digital products and images. Product files are stored privately and accessed only via time-limited signed URLs.
- Xano — Backend database. Stores account information, product data, orders, and platform records.
- Vercel — Website hosting and deployment. Vercel may set technical cookies in limited deployment scenarios (such as preview environments).
- Cloudflare — Domain management and bot protection. Cloudflare may set security cookies (via our authentication provider) to detect and prevent automated attacks, bot traffic, and abuse. These cookies do not collect personal information beyond what is necessary for security.
- Sentry — Error monitoring and performance tracking. Sentry collects technical data such as page URLs, browser types, and error stack traces to help us detect and fix bugs. We have configured Sentry to NOT collect IP addresses, cookies, or personally identifiable information. Data is stored on EU servers and retained for 30 days. Legal basis: legitimate interest in maintaining a stable platform.
- CookieYes — Cookie consent management platform. CookieYes stores your cookie preferences (a pseudonymous consent ID and your consent choices) to remember whether you have accepted or rejected cookies on subsequent visits. CookieYes is GDPR-compliant and stores consent records on EU servers.
- PostHog — Product analytics, session replay, and heatmaps. We use PostHog to understand how creators and visitors interact with VybeVerse, identify usability issues, and improve the platform. PostHog processes data including page views, button clicks, navigation paths, session recordings (with form inputs masked), and pseudonymous user identifiers (Clerk user ID, email, name, and signup date for signed-in users). PostHog acts as a data processor on our behalf under a Data Processing Agreement with PostHog Inc. Data is processed and stored on EU servers (Frankfurt) in compliance with UK GDPR. We have disabled IP address collection, enabled input masking in session recordings, and disabled console log capture to minimise data collection. PostHog cookies and tracking are only activated after you accept analytics cookies through our consent banner. Read more at PostHog's Privacy Policy.
- Google Analytics 4 (GA4) — Web analytics. We use GA4 to measure aggregate visitor behaviour, page views, and traffic sources. GA4 acts as a data processor on our behalf under a Data Processing Agreement signed with Google Ireland Limited (EU entity). Data is processed in compliance with UK GDPR. GA4 cookies are only set after you provide consent through our cookie banner. We have disabled Google Signals, advertising features, and granular location collection to minimise data collection. Data retention is set to 14 months. Read more at Google's Privacy Policy.
- Google Search Console— Search performance monitoring. We use Search Console to monitor how our website appears in Google Search results, including organic search queries, impressions, and click-through rates. Search Console does not set cookies on our website; it operates by analysing Google's own search index data. Search Console is linked to our GA4 property to provide consolidated reporting on organic traffic.
6. When We Share Your Data
We share your data only in the following circumstances:
- With creators: When you download a free product, your name and email address are shared with the creator who offered that product (lead magnets).
- With service providers: The third-party services listed above, solely for the purpose of operating our platform.
- Legal requirements: When required by law, regulation, or legal process.
- With Stripe: Creator payment data is shared with Stripe for the purpose of processing payments via Stripe Connect. Creator payouts are currently available in the United Kingdom and United States via Stripe Connect. We may expand to additional countries in the future.
Creator profiles, display names, usernames, bios, and profile photos are publicly visible by design. Product listings, including titles, descriptions, and pricing, are publicly accessible on creator profile pages.
7. Data Retention
We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain certain records for legal, tax, or regulatory purposes (such as transaction records, which may be retained for up to 7 years).
8. Your Rights Under UK GDPR
As a UK-based platform, we comply with the UK General Data Protection Regulation. You have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure:Request deletion of your personal data ("right to be forgotten").
- Right to restrict processing: Request that we limit how we use your data.
- Right to data portability: Request your data in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interests.
To exercise any of these rights, email us at legal@vybeverse.com. We will respond within 30 days.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
9. Data Security
We take reasonable technical and organisational measures to protect your personal data, including HTTPS encryption across our entire platform, secure authentication via Clerk, private file storage with time-limited access URLs via Cloudinary, and PCI-DSS compliant payment processing via Stripe. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
10. Children's Privacy
VybeVerse is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will take steps to delete that information promptly.
11. International Data Transfers
Some of our third-party service providers (Clerk, Stripe, Cloudinary, Vercel, Xano, Cloudflare) may process data outside the United Kingdom. Where data is transferred internationally, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions, in compliance with UK GDPR requirements. Sentry, CookieYes, Google Analytics (via Google Ireland Limited), and PostHog process data on EU servers, which provides equivalent protection under UK GDPR.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically. Your continued use of VybeVerse after changes are posted constitutes your acceptance of the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:
- Email: legal@vybeverse.com
- General support: support@vybeverse.com