Privacy Policy
Our commitment to protecting your privacy and personal data
Version 2.0 · Effective 27 October 2026
1. Who is responsible for your data
CHEN PING ("Vibestrap", "we", "us", or "our") is the data controller for the personal information described in this policy.
- Legal entity: CHEN PING
- Registered address: Fujian, China
- Country / region of registration: China
- Privacy contact: support@vibestrap.dev
- Data protection officer: not appointed (we do not carry out large-scale systematic monitoring or large-scale processing of special categories of data)
This policy covers the website and application at https://vibestrap.dev, the AI workbench, dashboard, and related APIs (together, the "Service"). Please read it before you use the Service. We may update it, and we will tell you about material changes as described in section 14.
2. What we collect
2.1 Information you give us
- Account information: your name, email address, password (stored only as a salted hash), and avatar. If you sign in with Google, we receive your basic profile from Google — name, email address, profile image, and a Google account identifier.
- API keys: if you create API keys for the Service, we store a hash of the key and its label, never the key itself.
- Billing information: the plan or credits you bought, payment status, amounts, currency, and the transaction identifiers returned by our payment providers. We do not receive or store full card numbers.
- Content you submit: prompts and messages you send to AI features, documents you paste or upload for document Q&A, files you store in your account, and the outputs generated for you.
- Support and contact messages: the content of messages you send through the contact form or by email, including any attachments.
- Newsletter and waitlist details: your email address and, where you provide it, your name.
2.2 Information we collect automatically
- Device and network information: IP address, browser type and version, operating system, language, time zone, and referring URL.
- Usage information: pages and features you use, actions you take, AI requests you make, credits you spend, and the timing of those events.
- Log and diagnostic data: request timestamps, error records, and performance measurements.
- Cookie choices: the consent categories you selected and when you selected them.
2.3 Information we generate
- Your credit balance and the ledger of credit grants, consumption, expirations, and refunds.
- Your AI conversations and their messages, so you can reopen a transcript.
- Affiliate referral attribution, if you arrive through a referral link.
We do not intentionally collect special categories of personal data (such as health data, biometric data, or data revealing political or religious beliefs). Please do not submit them to the Service.
3. How and why we use your information
| Purpose | Legal basis |
|---|---|
| Creating your account, authenticating you, and providing the Service | Performance of a contract |
| Processing payments, issuing credits, and maintaining billing records | Performance of a contract |
| Running AI requests and metering credit consumption | Performance of a contract |
| Storing and serving the files you upload | Performance of a contract |
| Answering support requests and contact messages | Performance of a contract or our legitimate interests |
| Service notices: billing, security, and policy changes | Legal obligation or our legitimate interests |
| Security, fraud prevention, abuse detection, and rate limiting | Our legitimate interests |
| Product analytics and improving features | Our legitimate interests |
| Affiliate attribution and commission accounting | Your consent, where required, or our legitimate interests |
| Sending the newsletter and product marketing | Your consent |
| Complying with tax, accounting, and other legal obligations | Legal obligation |
| Establishing, exercising, or defending legal claims | Our legitimate interests |
We may aggregate or de-identify information so that it can no longer be linked to you, and use the result for statistics and product decisions. Where we rely on legitimate interests, we balance those interests against your rights and allow you to object as described in section 8.
4. Cookies and similar technologies
We use cookies and local storage for the purposes below. Non-essential categories are off until you opt in through our cookie banner, and you can change your choice at any time from Cookie preferences in the footer.
| Category | Purpose | Optional |
|---|---|---|
| Necessary | Sign-in session, security, loading and language preferences, and remembering your cookie choice | No |
| Analytics | Google Analytics and Microsoft Clarity, used to understand which pages and features are used | Yes |
| Marketing | Affiliate referral attribution | Yes |
We also use privacy-friendly analytics (Cloudflare Web Analytics, Plausible, and Umami where enabled) that do not set advertising cookies and do not track you across sites; these do not require consent.
We honour the Global Privacy Control signal: if your browser sends it, optional cookies stay off unless you turn them on. When you withdraw consent for a category, we clear the cookies in that category. Blocking necessary cookies may prevent parts of the Service from working. Our Cookie Policy has the fuller description of cookie types and how to manage them in your browser.
5. Who we share information with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with:
- Infrastructure providers — Cloudflare, which hosts our application, database (D1), file storage (R2), and cache (KV) on our behalf.
- Payment providers — Waffo Pancake, Stripe, or Creem, depending on the checkout you use. Card data is processed exclusively by these PCI-DSS compliant providers and never reaches our servers.
- AI model providers — Cloudflare Workers AI, OpenRouter (which routes requests to the model vendors behind it), or OpenAI and Anthropic when you connect your own credentials. Your prompts, and the context needed to answer them, are sent to those providers to generate a response.
- Email providers — our transactional email and newsletter providers, which deliver verification, receipt, and notification messages.
- Analytics providers — the services listed in section 4, subject to the consent choices described there.
- Affiliate platforms — only where you arrive through a referral link, to attribute the referral.
- Legal and regulatory recipients — courts, regulators, law enforcement, or professional advisers, where the law requires it or where necessary to establish, exercise, or defend legal claims.
- A successor entity — if we are involved in a merger, acquisition, or sale of assets, we will notify you before your information becomes subject to a different privacy policy.
- Anyone you ask us to share with — where you give us explicit consent.
Our providers act under contracts that limit them to processing your information for the purposes we specify.
6. AI processing
AI features are powered by third-party models. When you use them, the content of your request — and any document or file you attach — is sent to the provider that generates the response. We do not use your inputs or outputs to train AI models without your explicit consent. Third-party providers may retain request data for a limited period under their own policies, for example for abuse monitoring; we choose providers that publish such policies and we do not grant them rights to use your content beyond operating their service.
Outputs can be inaccurate or incomplete. See section 12 of our Terms of Service before relying on them.
7. How long we keep information
| Data | Retention period | What happens at the end |
|---|---|---|
| Account profile, credentials, and API keys | While your account is open | Deleted within 30 days of account deletion |
| AI conversations, messages, and outputs | Until you delete them or close your account | Deleted within 30 days of account deletion |
| Files you uploaded | Until you delete them or close your account | Deleted within 30 days of account deletion |
| Credit balance and credit ledger | While your account is open; ledger entries kept for 7 years where required for accounting | Deleted or anonymised |
| Payment, invoice, and tax records | Up to 7 years after the transaction, as tax and accounting law requires | Deleted or archived under statutory rules |
| Support and contact messages | 24 months after the conversation ends | Deleted |
| Security and access logs | 30 days | Deleted |
| Newsletter subscription | Until you unsubscribe | Deleted within 30 days of unsubscribing |
| Cookie consent record | 12 months | Refreshed or deleted |
If you delete your account, we delete or anonymise the data listed above except where we must keep it to comply with the law, resolve disputes, prevent fraud, or enforce our agreements.
8. Your rights
Depending on where you live, you may have the following rights. To exercise any of them, email support@vibestrap.dev; we respond within 30 calendar days, and we may ask you to verify that the request comes from the account owner.
| Right | What it means |
|---|---|
| Access | Get a copy of the personal information we hold about you |
| Correction | Fix information that is inaccurate or incomplete |
| Deletion | Ask us to delete your information, subject to legal retention duties |
| Restriction | Ask us to pause processing while a concern is investigated |
| Portability | Receive your information in a structured, machine-readable format |
| Objection | Object to processing based on our legitimate interests |
| Withdraw consent | Withdraw a consent you gave earlier, such as analytics cookies or the newsletter |
| Non-discrimination | Not be treated worse for exercising your rights |
You can also export and delete much of your data yourself from the dashboard. If you are not satisfied with our response, you may complain to your local data protection authority.
9. Marketing and unsubscribing
We send the newsletter and product announcements only when you opt in, either at registration or through the newsletter form. Every marketing email includes an unsubscribe link, and you can also unsubscribe from the footer of the website or by emailing support@vibestrap.dev. Unsubscribing does not affect service messages such as receipts, security alerts, and policy notices.
10. International transfers
We and our providers process information in several countries, including the United States, the European Union, and the Asia-Pacific region. Where personal information leaves your jurisdiction, we rely on appropriate safeguards — for example Standard Contractual Clauses approved by the European Commission, transfer impact assessments, and additional technical measures such as encryption in transit — and we require recipients to apply a comparable level of protection.
11. Children
The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from anyone under that age. If you believe a child has provided us with personal information, contact support@vibestrap.dev and we will delete it.
12. Security
We protect your information with measures that include:
- transport encryption (TLS/HTTPS) for all traffic to the Service;
- salted password hashing and hashed API keys, never plaintext secrets;
- access control on a least-privilege basis, with credentials restricted to the systems that need them;
- segmented storage, with uploaded files kept in private object storage and served through authenticated access;
- logging and monitoring of administrative actions;
- dependency and vulnerability review as part of our release process.
No system is completely secure. If a breach affects your rights and freedoms, we notify you and the relevant authority without undue delay and, where the law requires it, within 72 hours of becoming aware of it.
13. Third-party links and integrations
The Service may link to or integrate with third-party sites and services. This policy applies only to information we collect ourselves. We are not responsible for the privacy practices of other sites, and we recommend that you read their policies before use.
14. Changes to this policy
We may update this policy to reflect changes in the Service or the law. We notify you by email or in-product notice at least 15 days before material changes take effect, and we update the version and effective date at the top of this page.
15. Contact
- Privacy and data requests: support@vibestrap.dev
- Support: support@vibestrap.dev
- Contact form: /contact
- Post: CHEN PING, Fujian, China
Last updated: 27 October 2026 · Version 2.0 · Vibestrap · https://vibestrap.dev