Privacy Policy
Last updated: September 3, 2026
Who is responsible for your data
The VIBPS platform ("VIBPS", "we", "us") is responsible for the personal data processing described in this policy. Privacy requests can be sent to hello@vibps.com or submitted through our Privacy Request form.
What data we process
Depending on how you use VIBPS, we may process account and authentication data, profile information, app submissions, ownership claim information and verification evidence, comments and other public contributions, reports and moderation records, illegal-content notices and notifier contact details, moderation statements of reasons, support communications, technical and security information, consent records, and product-usage analytics where you have consented.
Why we process data and our legal bases
We process account, profile, submission, claim and interaction data where necessary to provide the VIBPS service and perform our agreement with you. We process security, abuse-prevention, moderation, illegal-content notice and compliance records where necessary for our legitimate interests in operating a safe and accountable platform, and where required to comply with legal obligations. We process optional product analytics only with your consent. You can withdraw analytics consent at any time through Privacy settings in the site footer.
Product analytics and consent records
If you accept analytics, VIBPS may record events such as page views, app views, launches, saves, likes, follows, comments, searches, submissions and returning visits. We use pseudonymous visitor and session identifiers to understand product usage. We do not intentionally include passwords, authentication tokens, private message content or raw search text in analytics events.
When you accept, reject or change analytics settings, VIBPS also stores a minimal consent receipt containing a random consent identifier, the analytics choice, the consent-policy version and the server time of the decision. This receipt is kept separately from product-usage analytics and is used to demonstrate privacy choices.
Illegal-content notices and moderation
If you submit an illegal-content notice, VIBPS processes the exact content location, your explanation, the notice category, the good-faith declaration and, except where applicable law permits omission, your name and email address. We use this information to assess the notice, communicate the outcome and document moderation decisions. Where VIBPS restricts content associated with an identifiable account, we may create a statement of reasons for that affected user containing the restriction, grounds, facts, use of automated means and redress information.
Cookies and similar technologies
VIBPS uses browser storage and similar technologies for functions such as authentication, privacy choices and optional analytics. Non-essential analytics storage is disabled until you consent. Details are available in our Cookie & Tracking Policy.
Public content
Profiles, published apps, comments, creator information and other content intentionally submitted for publication may be visible publicly and may be indexed by search engines. Do not publish personal information that you do not want to make public.
Unclaimed app listings
VIBPS may create discovery listings using publicly available information about apps and digital products. We aim to limit unclaimed listings to product information and avoid unnecessary personal creator data. If a listing contains personal information about you, you may ask us to correct or remove it by contacting hello@vibps.com. Where personal data was not obtained directly from you, its source may be the app's public website or another publicly accessible source.
Service providers
We use service providers to operate VIBPS. These currently include Supabase for database, authentication and storage infrastructure, and Vercel for hosting, delivery and analytics infrastructure. Providers process data as needed to provide their services to VIBPS and may use subprocessors. VIBPS maintains an internal processor and transfer register and reviews provider data-protection terms and subprocessor changes.
International transfers
Some service providers or subprocessors may process data outside the European Economic Area. Where required, transfers are protected using recognised safeguards such as adequacy decisions or the European Commission's Standard Contractual Clauses. Our current Supabase project is hosted in the United Kingdom, which is covered by an EU adequacy decision, while provider subprocessors may operate in other countries under applicable transfer safeguards.
How long we keep data
We keep personal data only for as long as needed for the purpose for which it was collected, to provide the service, resolve disputes, maintain security and moderation records, or meet legal obligations. Account and public-content data is generally kept while your account or content remains active. VIBPS product-analytics events are automatically deleted after 12 months. Completed privacy-request records are automatically deleted after 24 months. Minimal server-side consent receipts are automatically deleted after 36 months. Closed illegal-content notices and moderation statements of reasons are also automatically deleted after 36 months, subject to any longer retention that is necessary for an active dispute, legal claim or legal obligation. Consent choices in your browser remain until you change them, clear browser storage or a new consent version replaces them. Other moderation, claim and security records are reviewed periodically and may be retained longer where needed to establish, exercise or defend legal claims or meet legal obligations.
Your GDPR rights
Where the GDPR applies, you may have the right to access your personal data, correct inaccurate data, request deletion, restrict processing, receive portable data, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting processing that occurred before withdrawal.
Use the Privacy Request form or contact hello@vibps.com. We may need to verify your identity before completing a request. We normally respond within one month as required by the GDPR.
Complaints
If you believe your data-protection rights have been infringed, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski poobleščen) or another competent supervisory authority in the EU/EEA.
Children
VIBPS is not intended to rely on a child's consent where the child cannot validly provide that consent under applicable law. In Slovenia, the relevant age for independent consent to information-society services is generally 15. If we learn that personal data was collected contrary to these requirements, we will take appropriate steps to remove it.
Security and incidents
We use reasonable technical and organisational measures intended to protect personal data and maintain an internal process for assessing and responding to suspected personal-data breaches. No online service can guarantee absolute security.
Changes to this policy
We may update this policy as VIBPS evolves. Material changes will be reflected by changing the date at the top of this page and may require a new consent choice where appropriate.