Privacy Policy

Last updated: November 2, 2026

Who is responsible for your data

The VIBPS platform ("VIBPS", "we", "us") is responsible for the personal data processing described in this policy. Privacy requests can be sent to hello@vibps.com or submitted through our Privacy Request form.

What data we process

Depending on how you use VIBPS, we may process account and authentication data, profile information, app submissions, ownership claim information and verification evidence, comments and other public contributions, reports and moderation records, illegal-content notices and notifier contact details, moderation statements of reasons, support communications, technical and security information, consent records, and product-usage analytics where you have consented.

Why we process data and our legal bases

We process account, profile, submission, claim and interaction data where necessary to provide the VIBPS service and perform our agreement with you. We process security, abuse-prevention, moderation, illegal-content notice and compliance records where necessary for our legitimate interests in operating a safe and accountable platform, and where required to comply with legal obligations. We process optional product analytics only with your consent. You can withdraw analytics consent at any time through Privacy settings in the site footer.

Product analytics and consent records

If you accept analytics, VIBPS uses its Supabase-backed event store, Vercel Analytics and Google Analytics 4 to measure page views, app views, launches, saves, likes, follows, comments, searches, submissions and returning visits. These services may receive pseudonymous browser identifiers, page paths, limited campaign parameters, device and browser information, and approximate location derived from network information. Public app and creator page addresses may be included in page analytics. VIBPS does not intentionally send passwords, authentication tokens, private message content, raw search text, email addresses or internal account identifiers to Google Analytics.

When you accept, reject or change analytics settings, VIBPS also stores a minimal consent receipt containing a random consent identifier, the analytics choice, the consent-policy version and the server time of the decision. This receipt is kept separately from product-usage analytics and is used to demonstrate privacy choices.

Illegal-content notices and moderation

If you submit an illegal-content notice, VIBPS processes the exact content location, your explanation, the notice category, the good-faith declaration and, except where applicable law permits omission, your name and email address. We use this information to assess the notice, communicate the outcome and document moderation decisions. Where VIBPS restricts content associated with an identifiable account, we may create a statement of reasons for that affected user containing the restriction, grounds, facts, use of automated means and redress information.

Cookies and similar technologies

VIBPS uses browser storage and similar technologies for functions such as authentication, privacy choices and optional analytics. Non-essential analytics storage is disabled until you consent. Details are available in our Cookie & Tracking Policy.

Public content

Profiles, published apps, comments, creator information and other content intentionally submitted for publication may be visible publicly and may be indexed by search engines. Do not publish personal information that you do not want to make public.

Unclaimed app listings

VIBPS may create discovery listings using publicly available information about apps and digital products. We aim to limit unclaimed listings to product information and avoid unnecessary personal creator data. If a listing contains personal information about you, you may ask us to correct or remove it by contacting hello@vibps.com. Where personal data was not obtained directly from you, its source may be the app's public website or another publicly accessible source.

Service providers

We use service providers to operate VIBPS. These currently include Supabase for database, authentication and storage infrastructure, Vercel for hosting, delivery and consented analytics, and Google for consented Google Analytics 4. Providers may use subprocessors. VIBPS maintains an internal processor and transfer register and reviews provider data-protection terms and subprocessor changes. Google's information about its data practices is available in its Privacy Policy.

International transfers

Some service providers or subprocessors may process data outside the European Economic Area. Where required, transfers are protected using recognised safeguards such as adequacy decisions or the European Commission's Standard Contractual Clauses. Our current Supabase project is hosted in the United Kingdom, which is covered by an EU adequacy decision, while provider subprocessors may operate in other countries under applicable transfer safeguards.

How long we keep data

We keep personal data only for as long as needed for its purpose. Account and public-content data is generally kept while your account or content remains active. VIBPS first-party analytics events are automatically deleted after 12 months. Google Analytics 4 user-level and event-level data is configured for 14 months; its standard aggregated reports may remain available longer. Google Analytics cookies are configured to expire after one year unless removed earlier through your privacy choice or browser controls. Completed privacy-request records are automatically deleted after 24 months. Minimal server-side consent receipts are automatically deleted after 36 months. Closed illegal-content notices and moderation statements of reasons are also automatically deleted after 36 months, subject to any longer retention necessary for an active dispute, legal claim or legal obligation. Consent choices in your browser remain until you change them, clear browser storage or a new consent version replaces them. Other moderation, claim and security records are reviewed periodically.

Your GDPR rights

Where the GDPR applies, you may have the right to access your personal data, correct inaccurate data, request deletion, restrict processing, receive portable data, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting processing that occurred before withdrawal.

Use the Privacy Request form or contact hello@vibps.com. We may need to verify your identity before completing a request. We normally respond within one month as required by the GDPR.

Complaints

If you believe your data-protection rights have been infringed, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski poobleščen) or another competent supervisory authority in the EU/EEA.

Children

VIBPS is not intended to rely on a child's consent where the child cannot validly provide that consent under applicable law. In Slovenia, the relevant age for independent consent to information-society services is generally 15. If we learn that personal data was collected contrary to these requirements, we will take appropriate steps to remove it.

Security and incidents

We use reasonable technical and organisational measures intended to protect personal data and maintain an internal process for assessing and responding to suspected personal-data breaches. No online service can guarantee absolute security.

Changes to this policy

We may update this policy as VIBPS evolves. Material changes will be reflected by changing the date at the top of this page and may require a new consent choice where appropriate.