This Privacy Policy explains how WorkFlow Automation Network (ABN 43 637 993 462), a sole trader based in Victoria, Australia that operates Vibe-Check (“Vibe-Check”, “we”, “us”), collects, uses, and protects personal data when you use the Service. For the purposes of the Australian Privacy Act 1988 (Cth) and, where applicable, the EU/UK General Data Protection Regulation, the data controller is WorkFlow Automation Network (ABN 43 637 993 462), Victoria, Australia. You can reach us at privacy@vibe-check-app.com.

1. What we collect

• Account data: your email address and, optionally, your name.
• Target data: the URLs you submit, ownership-verification tokens, and verification method.
• Scan results: security findings, grades, and scan history for your targets. We store likelihood assessments and aggregate counts — not the contents of data read from your systems.
• Activity & logs: activity log, webhook log, and basic usage/IP telemetry used for security, abuse prevention, and operating the Service.
• Billing data: Stripe billing metadata (plan, subscription status, customer/subscription identifiers). We do not store your card number — Stripe handles card data; we never see it.

2. Why we use it (legal bases)

• To perform our contract with you — running scans, producing reports, managing your account and billing.
• Legitimate interests — securing and improving the Service, preventing abuse and fraud.
• Consent — only where required, e.g. any optional marketing email (which you can withdraw at any time).

3. Sub-processors

We share data with the following processors strictly to operate the Service:

• Supabase — database, authentication, and file storage. DPA
• Stripe — payment processing. DPA
• Resend — transactional email delivery. DPA
• Fly.io — runs the scanning service. DPA
• Vercel — hosts the web application, processes all visitor/user HTTP traffic, and provides cookieless usage analytics. DPA
• Cloudflare — provides the Turnstile bot-protection challenge on our sign-in, sign-up, and password-reset forms, which processes your IP address and challenge interaction to distinguish humans from bots. DPA

We do not sell your personal data, and we do not use it for advertising.

4. International transfers

Our scanning infrastructure runs in Australia (Sydney, on Fly.io), our database is hosted on Supabase in Australia (Sydney, ap-southeast-2), and our web application is hosted on Vercel in Australia (Sydney, syd1). Some sub-processors (Stripe, Resend, Cloudflare, and Vercel’s global edge network) may process limited data outside Australia. Where personal data of EU/UK users is transferred outside the EEA/UK, we rely on appropriate safeguards — principally the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as incorporated into each sub-processor’s DPA linked above.

5. Cookies & analytics

We use only strictly-necessary cookies and do not use advertising or cross-site tracking cookies, so we do not show a cookie-consent banner:

• Authentication cookies (set by Supabase) keep you signed in. Without them the Service cannot function.
• Pre-launch access cookie remembers that you entered the early-access password, while the site is gated.

For usage analytics we use Vercel Web Analytics, which is privacy-first and cookieless: it records aggregate page views and performance without cookies, without cross-site tracking, and without building a profile of you. Cloudflare Turnstile (see above) may set a short-lived challenge token strictly to run the anti-bot check.

6. How long we keep it (retention)

• Scan findings & metadata: kept for the lifetime of your account so your report history remains accessible. When your account is deleted, all findings are purged as described below.
• Report PDFs: stored for the lifetime of your account and deleted when your account is deleted.
• Activity & webhook logs: retained for 30 days, then purged.
• Deleted accounts: URLs, scans, findings, badges, and stored report PDFs are hard-deleted or irreversibly anonymised within 30 days of account deletion.

7. Your rights

Depending on your location, you have rights to access, export, correct, delete, and object to processing of your personal data, and to withdraw consent. To exercise any of these — including deleting your account or requesting a copy of your data — email us at privacy@vibe-check-app.com or support@vibe-check-app.com. We respond within the period required by applicable law.

8. Payments & PCI

Payments are handled by Stripe using its hosted Checkout and Billing Portal. Card data never touches our servers, keeping us within PCI SAQ-A scope. We never see or store your card details.

9. Security & data breaches

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including access controls, encryption in transit, and least-privilege handling of credentials. No system is perfectly secure; we cannot guarantee absolute security. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme (and equivalent obligations for EU/UK users).

10. Children

The Service is intended for businesses and adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “last updated” date above and, for material changes, take reasonable steps to notify you.

12. Contact & complaints

Privacy contact: WorkFlow Automation Network (ABN 43 637 993 462), privacy@vibe-check-app.com. A postal address for formal notices is available on request. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au); EU/UK users may also complain to their local supervisory authority.