Privacy Policy

1. Data we collect

• Account data — name, email, hashed password (or your Google name and email if you use Google sign-in).
• X account data via OAuth — handle, profile, posts, follower and engagement metrics, and — with your authorization — the ability to publish posts you create. We never post without your action.
• Content you create — drafts, projects, topics, story angles, voice samples, watch-list accounts and scheduled posts.
• Billing data via Stripe — we store your Stripe customer ID and subscription status. We never store your card number.
• Usage and device data — feature usage, AI/API usage for cost accounting, logs and essential authentication cookies.

2. How and why we use it (legal bases)

• Provide the service (performance of a contract).
• Transactional email via Resend (contract).
• AI features — your prompts, drafts and voice samples are sent to xAI (Grok) and, as a fallback, OpenAI, to generate and refine content. We do not sell your data or use it to train third-party models beyond providing the feature.
• Product improvement and security (legitimate interest).
• Feedback you send us (legitimate interest).

3. Sub-processors

• Lovable Cloud / Supabase — hosting, database, authentication (EU/US)
• Stripe — payments (US/EU)
• xAI — AI generation (US)
• OpenAI — AI fallback (US)
• Resend — email (US)
• X / Twitter — account connection and publishing (US)

Transfers outside the EU rely on appropriate safeguards (e.g. Standard Contractual Clauses).

4. Retention

We keep your data while your account is active. On deletion we delete or anonymize it within 30–90 days, except records we are required to keep by law (e.g. invoices).

5. Your GDPR rights

You may access, rectify, erase, restrict, port, object to processing of your data and withdraw consent — email q.project@hotmail.com. You may also lodge a complaint with the CNIL (cnil.fr).

6. Security

We use row-level access controls, encrypted connections, and store OAuth tokens server-side only. No system is perfectly secure; we will notify you of a breach as required by law.

7. Children

VibeBoost is not intended for anyone under 16.

8. Changes

We post the new date on this page and email you about material changes.