Privacy Policy

The data controller is DREAMEC STUDIOS LTD, a company registered in England and Wales under company number 17304431, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For anything relating to your personal data, contact randy@dreamec.com. For general product support, contact support@vibebay.ai.

This policy is written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018, and, where it applies to you, the EU General Data Protection Regulation.

• Account data: name, email address, password (stored as a hash), role, profile photo, country, and language and currency preferences.
• Profile and listing data: for talent, your bio, skills, portfolio items, pricing, and optional trust signals you choose to add, such as a phone number, GitHub username, LinkedIn URL, or portfolio link.
• Transaction data: orders, amounts, fees, credits, payout records, and invoices. Card numbers go directly to our payment processor and are never stored by us.
• Content data: task briefs, messages, files you attach, deliveries, reviews, and reports you submit.
• Usage data: pages visited, features used, device and browser type, and approximate location derived from IP address.
• Support data: emails and messages you send our team, and reports made about you or by you.

We do not intentionally collect special category data (such as health or political opinions) and ask you not to include it in briefs, messages, or profiles.

• To provide the marketplace, process orders, hold escrow, and pay talent. Lawful basis: performance of a contract.
• To verify talent, prevent fraud, enforce our terms, and keep the Platform safe. Lawful basis: legitimate interests in running a safe and trustworthy marketplace.
• To send service messages about your account, orders, and changes to terms. Lawful basis: performance of a contract and legal obligation.
• To send marketing emails, where you have opted in. Lawful basis: consent, which you can withdraw at any time.
• To keep accounting and tax records. Lawful basis: legal obligation.
• To analyse how the product is used so we can improve it. Lawful basis: legitimate interests in improving the Platform, using data that is aggregated or pseudonymised where possible.
• To power AI features, such as VibeBay Agents and the assistant. Prompts and relevant context are processed by our AI provider to generate responses. Lawful basis: performance of a contract for features you invoke, and legitimate interests in providing them safely.

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time, see the Your Data Rights page.

We never sell your personal data. We share it only with the providers we need to run VibeBay, with other users as part of normal marketplace activity (for example, your profile and reviews are visible to clients, and a talent you hire sees your brief and messages), and with authorities where the law requires it.

Our processors are:

• Supabase, for authentication, database, and file storage.
• Stripe, for payment processing and payouts. Stripe acts as an independent controller for the payment data it processes.
• Netlify, for hosting and content delivery.
• Anthropic, for AI processing behind VibeBay Agents and the assistant.
• Resend, for the transactional email we send you.

Each provider processes personal data under a contract that meets UK and EU GDPR requirements. If we ever sell or reorganise the business, personal data may transfer to the new owner under the same protections, and we will tell you before that happens.

Some of our providers process data outside the United Kingdom and the European Economic Area, mainly in the United States. Where they do, we rely on adequacy regulations (including the UK-US Data Bridge and the EU-US Data Privacy Framework where the provider is certified) or on the International Data Transfer Agreement and Standard Contractual Clauses, with additional safeguards where needed.

Naming them is more useful than describing them, so here is every transfer that happens as a normal part of using VibeBay, what leaves, and what protects it:

• Supabase (database, authentication, file storage). Data is held in the region we selected for the project; the provider is US-incorporated, so support and administrative access can occur from the United States. Safeguard: Standard Contractual Clauses plus the UK Addendum, under the provider's data processing agreement.
• Stripe (payments and payouts). Payment and identity data reaches Stripe in the United States and Ireland. Stripe acts as an independent controller for the payment data it processes, not only as our processor, so its own privacy policy also applies to that data. Safeguard: EU-US Data Privacy Framework and the UK extension, plus Standard Contractual Clauses.
• Netlify (hosting and content delivery). Requests are served from edge locations worldwide, so the connection metadata described above (IP address, user agent) is processed in whichever region is nearest to you. Safeguard: Standard Contractual Clauses plus the UK Addendum.
• Anthropic (AI processing behind VibeBay Agents and the assistant). Prompt content is processed in the United States. Safeguard: Standard Contractual Clauses. Anthropic does not train its models on this content under our agreement.
• Resend (transactional email). Your email address and the content of the message we send you are processed in the United States. Safeguard: Standard Contractual Clauses plus the UK Addendum.

We do not transfer personal data to a country without one of these safeguards in place. If a provider changes where it processes data, or a safeguard we rely on is invalidated, we assess the transfer again before it continues and change provider if we have to.

You can ask randy@dreamec.com for a copy of the safeguard applied to any specific transfer.

• Account and profile data: for as long as your account is open, then deleted or anonymised within 90 days of closure.
• Messages and order content: for as long as your account is open, because disputes can reference old orders, then deleted with the account.
• Transaction and invoicing records: 6 years after the end of the relevant financial year, as UK tax law requires.
• Fraud, enforcement, and dispute records: up to 6 years after the event, so we can respond to legal claims.
• Usage analytics: aggregated or deleted within 26 months.
• Support correspondence: 2 years after the ticket closes.

Where deletion is requested earlier, we honour it except where we must keep specific records to meet a legal obligation or to establish, exercise, or defend legal claims.

We use a small set of cookies and browser storage: essential ones that keep you signed in and remember choices like currency and language, and optional analytics that help us understand how the product is used.

The cookie banner lets you accept all cookies or essential only, and you can change your mind at any time from the Your privacy choices link in the footer or on the Your Data Rights page. We honour your choice until you change it.

We use encryption in transit, access controls, least-privilege staff access, and logging across our systems. Payment card data is handled entirely by Stripe, which is PCI-DSS certified.

No system is perfectly secure. If a breach occurs that risks your rights, we will notify the Information Commissioner's Office within 72 hours as required, and tell you directly without undue delay if the risk to you is high.

Under UK and EU GDPR you have the right to access your data, correct it, delete it, restrict or object to our processing, take your data with you in a portable format, and withdraw consent where processing is based on consent. None of these cost anything in normal circumstances.

The Your Data Rights page explains each right and how to exercise it. The short version: email randy@dreamec.com from the address on your account and we will respond within 30 days.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). If you are in the EU, you can complain to the authority in your country. We would appreciate the chance to resolve your concern first, but you do not have to give us one.

VibeBay is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, tell us at support@vibebay.ai and we will remove it.

We use automated systems to rank search results, calculate scores and levels, and flag suspicious activity for human review. We do not make decisions with legal or similarly significant effects about you by purely automated means. Account suspensions and report outcomes always involve a human.

One address, read by a person, for everything on this page: privacy requests, questions about a transfer, complaints, and anything you think we have got wrong.

• Data protection contact: randy@dreamec.com. This is the responsible person at DREAMEC STUDIOS LTD who handles privacy matters. We answer within 30 days and usually much sooner.
• Data Protection Officer: we have not appointed one. Our processing does not currently meet the thresholds in Article 37 UK GDPR that make an appointment mandatory, and we would rather say that than imply a role nobody holds. If that changes, this line will name the person and how to reach them.
• Postal: Data Protection, DREAMEC STUDIOS LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
• General product support, which is not the right route for a privacy request but will be passed on: support@vibebay.ai.

We handle correspondence in English. If English is difficult for you, write in your own language and tell us so; we will translate rather than turn you away.

The rest of this policy applies to everyone. This section adds what specific regions require on top, and it grows as VibeBay opens in more places. Nothing in an annex reduces anything above it.

United Kingdom. The controller is established in the UK and the ICO (ico.org.uk) is our supervisory authority. You can complain to them directly and you do not have to come to us first.

European Economic Area. We offer services to people in the EEA from outside it. We have not yet appointed an Article 27 representative in the Union; the appointment is in progress and this line will name them and their address once it is made. Until then, write to randy@dreamec.com, and you keep the right to complain to the supervisory authority in your own country.

Singapore. Personal data of Singapore residents is handled in line with the Personal Data Protection Act 2012 alongside this policy. Data protection queries go to randy@dreamec.com, which serves as our data protection contact for PDPA purposes until a local officer is named.

Malaysia. Personal data of Malaysian residents is handled in line with the Personal Data Protection Act 2010 alongside this policy. Queries go to randy@dreamec.com. Where the PDPA requires consent for a specific processing purpose, we ask for it separately rather than inferring it from your use of the Platform.

Australia. We handle personal information in line with the Australian Privacy Principles alongside this policy, including the requirement to tell you when we disclose your information to an overseas recipient. The recipients are listed under International transfers above.

United States. We do not sell personal data and we do not share it for cross-context behavioural advertising, as those terms are defined in California law. Where a state privacy law gives you rights to know, delete, correct, or opt out, exercise them at randy@dreamec.com and we will not discriminate against you for doing so.

We will update this policy as the product and the law change. Significant changes will be announced through the Platform or by email before they take effect, and the version and date at the top always tell you what you are reading.