Privacy Policy

You give us:

• Mobile number (with country code), verified by a one-time password (OTP).
• Your status (student, working, looking for a job or running a business) and a short detail such as your course, role or type of business.
• Name, email address, city and years of experience, when you fill them in or when you pay.
• What you write, say or upload inside a workday: chat messages with in-app characters, answers, voice dictation (converted to text) and screenshots.
• Feedback you send us, and notes from any feedback call you agree to.

Collected automatically:

• How you got here: ad and campaign tags in the link you opened (utm_source, utm_medium, utm_campaign, utm_content) and Meta's click id (fbclid), plus when you first arrived.
• Your progress: the job or track you played, when each day started and finished, time spent, the furthest task reached, scores and your first win.
• Sharing: when you tap a share button, which platform (LinkedIn, X, WhatsApp or copy link) and your proof link.
• Device and log data: device type, browser, IP address, pages viewed, timestamps and error reports.
• Cookies and similar technologies (see section 6).

From payment: when you pay, our payment partner Razorpay shares with us your name and email (if given), payment id, amount, time and refund status. We never see or store your full card number, UPI PIN or bank login.

• To create your account, sign you in with OTP and keep your progress tied to your number on any device.
• To run the workday: generate tasks, reply as in-app characters, score your work and make your proof card.
• To take payments, unlock paid features, issue receipts and handle refunds.
• To contact you about your experience — by phone call, SMS, WhatsApp or email — for example to ask for feedback, help if you got stuck, or tell you about your progress. You can ask us to stop at any time.
• To measure and improve our ads: to understand which ads bring people who sign up and pay, and to show relevant ads (see section 4).
• To understand how the product is used, fix bugs, prevent fraud and abuse, and keep the service secure.
• To meet legal, tax and accounting duties.

VibeWork uses AI models to generate workdays and reply to you. The text you type or dictate in a workday, and screenshots you upload, are sent to AI model providers (through OpenRouter, which routes to providers such as Anthropic, OpenAI and Google) only to produce a response. We do not send your phone number or email to AI providers. Do not put sensitive personal information (such as health, financial or government ID details) into the workday. Voice dictation uses your browser's or phone's built-in speech recognition, which may be processed by your browser or operating system provider under their own privacy terms.

We use the Meta Pixel and Meta Conversions API (Meta Platforms, Inc., for Facebook and Instagram), and may use Google Analytics and Google Ads conversion tracking (Google LLC). These tell us when key steps happen — a page view, an OTP request, sign-up, starting or finishing a workday, your first win, opening checkout, paying, finishing the week or tapping share — so we can measure our ads and improve the product.

We share hashed contact data with Meta for ad measurement. With these events we may send your phone number and email address after hashing them with SHA-256 (a one-way code, so Meta receives a scrambled value, not the number or email itself), a hashed form of your VibeWork user id, Meta's cookie and click ids (fbp, fbc), your IP address and browser user agent. Meta uses this to match events to its users, measure ad results and optimise delivery, as described in Meta's Privacy Policy. Google's use is described in How Google uses information from sites that use its services.

You can control ads you see from these companies in your Meta ad preferences and Google My Ad Center, opt out of Google Analytics with the Google Analytics opt-out add-on, or block third-party cookies in your browser. You can also email us to stop sending your data to Meta or Google for advertising (section 9).

We do not sell your personal data. We share it only with service providers who help us run VibeWork, under contracts that limit their use of it:

• Supabase — hosting, database and sign-in.
• MSG91 — sending OTP SMS.
• Razorpay — payments, refunds and receipts.
• OpenRouter and the AI model providers it routes to — generating workdays and replies (section 3).
• Meta and Google — ad measurement and analytics (section 4).
• PostHog and Sentry — product analytics and error reports.
• Our hosting and email providers.

Some of these providers process data outside India. We share data across borders only as permitted by Indian law. We may also disclose data if required by law, court order or a government authority, to protect our rights or users' safety, or as part of a merger or sale of the business (with this policy continuing to apply).

Proof cards you share: when you share a proof link, anyone with the link can see your proof card (the role, your score and the name shown on it). Don't share the link if you don't want it seen.

We and our partners use cookies and similar storage:

• Essential — keep you signed in (Supabase session cookies) and remember the ad link that brought you here (vw_src, up to 90 days) so we can credit the right campaign when you sign up or pay.
• Analytics — Google Analytics (_ga, _ga_*) and PostHog, to count visits and understand usage.
• Advertising — Meta (_fbp, _fbc) and Google Ads, to measure which ads lead to sign-ups and payments.

You can delete or block cookies in your browser settings. Blocking essential cookies will sign you out.

We keep your account and progress for as long as your account is active, and delete or anonymise it within 90 days after you ask us to delete your account. Payment and tax records are kept for 8 years as Indian law requires. Logs and error reports are kept for up to 1 year. Ad and analytics partners keep data according to their own policies.

Data is encrypted in transit (HTTPS) and stored with access controls. OTPs are stored only as hashes and expire after 5 minutes. No system is perfectly secure; if a breach affects your data, we will inform you and the Data Protection Board of India as the law requires.

Under the DPDP Act you can:

• Get a summary of the personal data we hold about you and who we've shared it with.
• Correct, complete or update your data.
• Withdraw consent and ask us to delete your account and data (some records may be kept where the law requires).
• Ask us to stop contacting you, or to stop using your data for advertising and analytics.
• Nominate someone to exercise these rights if you die or become unable to.
• Raise a grievance with us, and if unresolved, with the Data Protection Board of India.

Email support@vibework.pro from the email on your account, or tell us the mobile number you signed up with. We may verify it's you with an OTP. We respond within 30 days.

VibeWork is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has signed up, email us and we will delete the account.

[Full name], Grievance Officer
[Registered business name], [Registered business address, City, State, PIN]
Email: grievance@vibework.pro
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

We may update this policy. We'll change the date at the top and, for significant changes, tell you in the app or by SMS or email before they take effect. See also our Terms of Service.