Vybe Privacy Policy

Data we collect

Data you give us

• Account and contact data: phone number (used to sign in with a one-time SMS code) and email address.
• Profile data: name, last name, username, bio, photos and videos, gender, date of birth, and Instagram, TikTok or Snapchat usernames if you add them. Your profile is visible to other users.
• Event data: events you create, view, are interested in, join or are invited to, waitlists, and your attendance.
• Ticket and payment data: tickets you buy, amounts, payment status and refunds. Card details are entered directly with Stripe and we do not store them. Organizers and promoters who receive payouts give identity and bank details directly to Stripe.
• Messages: direct and group chat messages, photos, videos and reactions you send.
• Reports and support: reports you submit or that concern you, and messages you send to us.

Data collected automatically

• Location: with your permission, your device location to show events near you; approximate location derived from your IP address; and event locations you enter.
• Device and usage data: IP address, device model, operating system, app version, a device identifier (the vybe_id cookie on the web), pages and features used, and crash reports.
• Attribution data: the referral or promoter link you used, and click identifiers from Meta or TikTok ads, if you arrived through one.

Data from others

• Other users and organizers, for example when they invite you or add you to an event.
• Stripe, about the status of payments, refunds and payouts.

Device permissions

The app may ask for access to your camera and photo library (to add photos and scan tickets), your location and notifications. These are optional; you can change them at any time in your device settings, although some features may not work without them.

How we use your data

• Provide your account and the Service, including profiles, events and chats. (Contract)
• Sell and deliver tickets, including Apple Wallet passes, refunds and organizer and promoter payouts. (Contract; legal obligation for accounting records)
• Share your details with organizers of events you join or buy tickets for, limited to the information requested at checkout. (Contract)
• Send service messages such as login codes, tickets, receipts and event updates by SMS, email or push notification. (Contract)
• Show events near you using your location. (Consent for device location; legitimate interests for approximate location)
• Keep the Service safe: check age, moderate content, handle reports, prevent fraud and abuse, and enforce our Terms. (Legitimate interests; legal obligation; vital interests)
• Understand and improve the Service with analytics and error monitoring. (Legitimate interests)
• Measure organizers' advertising through Meta and TikTok pixels on event pages. (Consent)
• Comply with the law and respond to lawful requests. (Legal obligation)

Legal bases

Each purpose above relies on one of these legal bases under Article 6(1) GDPR:

• Contract (Art. 6(1)(b)): processing needed to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): for example keeping the Service safe, preventing fraud and abuse, and understanding how the Service is used so we can improve it. We only rely on this where our interests are not overridden by yours, and you can object at any time.
• Consent (Art. 6(1)(a)): for example optional device permissions, push notifications and non-essential analytics or marketing cookies. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation (Art. 6(1)(c)): for example keeping accounting records, responding to lawful requests from authorities and reporting child sexual abuse material.
• Vital interests (Art. 6(1)(d)): to protect someone's life or physical safety, for example in an emergency involving a child.

Who we share data with

• Other users: your profile, the content you post and messages you send to them.
• Organizers: for events you join or buy tickets for, your name, contact details, ticket and the profile details they request (for example date of birth, gender or Instagram username). Organizers use this data as independent controllers.
• Service providers that process data on our behalf under data processing agreements:
  • Supabase (database, authentication and file storage)
  • Vercel (website hosting)
  • Google Cloud and Firebase (mobile app backend and push notifications)
  • Twilio (SMS login codes)
  • Resend (email)
  • PostHog, EU hosting (product analytics)
  • Sentry (error monitoring)
  • Mapbox and Google Maps (maps and address lookup)
  • Apple (Wallet pass delivery and updates)
• Stripe: processes payments and payouts. Stripe acts as an independent controller for some processing, such as fraud prevention and identity checks.
• Meta and TikTok: if an organizer has added their pixel to an event page and you have consented, information about your visit and purchase, with your email and phone number in hashed form, so the organizer can measure their ads.
• Authorities: law enforcement, courts and bodies such as the National Center for Missing & Exploited Children (NCMEC), where the law requires it or to protect someone's safety.
• Successors: a buyer or successor if our business is reorganised, merged or sold, subject to this policy.

If you connect a Google service, our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Cookies, analytics and pixels

• Essential cookies keep you signed in, remember the profile you selected and keep checkout and referral links working (including the vybe_id device cookie).
• Analytics: we use PostHog (hosted in the EU) to understand how the website and app are used, and Sentry to detect errors. You can object by contacting us or by blocking cookies in your browser.
• Marketing pixels: Meta and TikTok pixels added by organizers load only after you consent, and you can withdraw consent at any time.

We do not show third-party advertising in the Service. Our website does not respond to browser "Do Not Track" signals.

International transfers

We store your data primarily in the European Economic Area (EEA). Some of our service providers are based in, or access data from, other countries such as the United States. When data leaves the EEA, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or on the Commission's Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

How long we keep your data

We keep personal data only as long as needed for the purposes described above:

• Account and profile data: while your account exists. When you delete your account, we delete or anonymise it within 30 days.
• Messages and shared media: until you delete them or your account. Messages you sent to others may remain visible to them, attributed to a deleted account.
• Backups: deleted data may remain in encrypted backups for up to 90 days before it is overwritten.
• Reports and moderation records: as long as needed to handle the report and any appeal and to prevent banned users from returning, normally no longer than 2 years after the account is closed.
• Analytics and diagnostic data: up to 24 months.
• Ticket, payment and payout records: 5 years from the end of the calendar year of the transaction, as required by Polish tax and accounting law.
• Legal holds: longer where the law requires it or where we must preserve evidence, for example for law enforcement in a child safety case.

Security

We use technical and organisational measures to protect your data, including encryption in transit, access controls that limit who can see personal data, and monitoring for abuse. No system is completely secure, so please keep your device and login codes safe and tell us about any suspected unauthorised access.

Children

The Service is only for people aged 16 and over. We ask for your date of birth to check this. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we close the account and delete the data, except where we must keep it to protect a child or meet a legal obligation. Parents or guardians who believe their child is using the Service can contact us at csam@vybe.social.

Your rights

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• correct inaccurate data;
• have your data deleted, including by deleting your account;
• restrict processing;
• receive data you gave us in a portable format;
• object to processing based on legitimate interests, and to object at any time to direct marketing;
• withdraw consent at any time.

To use these rights, email contact@vybe.social. We will reply within one month, and may ask you to confirm your identity. You can also change most profile data and permissions directly in the app and in your device settings.

You have the right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in the country where you live or work. If you live outside the EEA (for example in a US state with a privacy law), you may have similar rights, and you can use them by contacting us.

Selling data and automated decisions

We do not sell your personal data. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We may use automated tools to help detect spam, fraud or harmful content, but a person reviews decisions to close accounts.

Changes to this policy

We may update this Privacy Policy from time to time. We will show the new effective date at the top and, for material changes, tell you in the app or by email before they take effect.

Contact us

If you have any questions about this Privacy Policy or your data, email us at contact@vybe.social or write to us at:

Vybe sp. z o.o.
Fasolowa 45/12
02-483 Warszawa
Poland