Privacy Policy
Last updated: 6 November 2026
1. Who we are
Vibelets is operated by Growth Genius Inc., San Francisco, California, USA ("Growth Genius", "we", "us"). Email support@vibelets.ai with any question or request about your data. Our privacy contact is the same address.
2. Scope and our role
This policy covers the vibelets.ai website, the Vibelets web app and the Vibelets app for Shopify. For account, sign-in, billing and website data, we decide how the data is used (we are the controller). For data from your Shopify store, we act for you under our Data Processing Agreement, and you decide what we do with it (we are your processor).
3. Data we collect
You give us: name, business name, work email, country, support messages, and content you upload or connect, such as brand assets and notes.
From your Shopify store, only after you install the app and approve its permissions (read products and read orders):
- Store details: store name, web address, currency, and the store's contact email.
- Products: title, handle, status, type, vendor, the first 2,000 characters of the description, image links, prices, SKUs and variants.
- Orders: order number, date, currency, gross sales, discounts, returns, net sales, payment status, sales channel name, line items and refunds. We also keep whether an order was the shopper's first or a repeat order, the order's marketing source (UTM source, medium and campaign from the first and last visit), the type of page the shopper landed on (product, collection, home or other), the referring website's host name only, and whether a Facebook click ID was present. We treat these fields as potentially personal data. For them we act for you as your processor, and you are responsible for the notice and legal basis for the tracking on your own store.
- What we do not collect: shoppers' names, email addresses, phone numbers, addresses or customer IDs. We don't request those fields from Shopify.
From Meta, after you connect an ad account: account, campaign, ad set, ad and creative details, and performance data, through Meta's official tools.
When you sign in: our sign-in provider handles your email, one-time codes and, if you choose it, Google sign-in.
Automatically: usage data (pages, actions, timestamps), device data (IP address, browser, operating system) and cookies, as described in the Cookie Policy.
Billing: if you subscribe through Shopify, Shopify bills you and tells us your plan and status. We never see your card. If you subscribe directly, our payment processors, Stripe, collect your card details and billing address; we keep only the last four digits, the plan and the invoices.
4. How we use data
| Purpose | Legal basis (GDPR) |
|---|---|
| Run the Service: import your catalog, show Store vs Meta results, create plans and ads | Contract |
| Manage your plan, credits and billing status | Contract |
| Support and service emails | Contract, legitimate interests |
| Security, fraud prevention and fixing errors | Legitimate interests, legal obligation |
| Understand how the product is used, without store figures | Legitimate interests; consent where required |
| Marketing emails (you can unsubscribe any time) | Consent |
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
5. AI, and what we never do with Shopify data
We send product details (titles, descriptions, images) and your ad data to AI providers to write plans and create ads. They are listed in section 7. AI never publishes anything to your ad account without your approval.
We do not use data from Shopify, including your products, orders and store details, to:
- train, fine-tune or improve any AI or machine-learning system, ours or anyone else's
- compare or benchmark merchants against each other, or build statistics across merchants
- send to any third party except the providers in section 7, and only as needed to run the Service
Product learning ("Learn", test memory) does not use Shopify data and does not compare merchants.
6. Shopify data and privacy requests
- What we can do in your store: read products and orders. We can't change your products, orders, theme or checkout.
- Why we use it: to import your catalog and show revenue and orders next to your Meta results, for your account only.
- Shopper requests: when a shopper asks their store for their data, Shopify sends us a customers/data_request. We email the store's contact address the order numbers and amounts we hold for the orders named, as CSV and JSON, or tell the store we hold nothing. We finish within 30 days.
- Erasure requests: when a store asks Shopify to erase a shopper's data, Shopify sends customers/redact. We delete the named orders and never import them again. If the order's daily totals remain, we keep them only as anonymous sums and only on days with at least three other orders. We finish within 30 days.
- Uninstalling: we stop reading your store straight away and clear our access tokens. Shopify sends shop/redact 48 hours later and we delete your store data. If that doesn't arrive, we delete it 7 days after the uninstall. Every copy is gone within 30 days.
- Reinstalling: if you come back, we start a fresh connection.
Shoppers should contact the store that holds their order. We help the store respond.
7. Who we share data with
These companies process data for us. Error tracking and AI monitoring run on our own servers, so they are not listed here.
| Provider | What for | Data they may get |
|---|---|---|
| Amazon Web Services | Hosting, storage, email sending | All data we hold |
| Clerk | Sign-in | Name, email, sign-in events |
| Shopify | Install, store access, billing | Plan and store details |
| Meta | Reading performance, publishing ads you approve | Ad content, ad account data |
| OpenAI, Google (Gemini), Kie.ai, ElevenLabs, BytePlus (Seedance) | Writing plans, creating images, videos and voices | Product details, images, prompts. No store orders |
| Stripe | Card billing for customers who don't pay through Shopify | Billing contact; card details are held by Stripe |
| PostHog (US) | Product analytics, in the app and on the website | Pseudonymous usage events; store figures removed |
| Google Analytics | Website analytics | Website visit data |
We may also share data to follow the law, to protect our rights, or in a merger or sale, and we'll tell you first where we can. We'll give a current list of providers on request.
8. Where your data is processed
Our main servers are with Amazon Web Services in the US (us-east-1, N. Virginia). Our error tracking and AI monitoring run on our own servers in AWS Mumbai, India, and our analytics provider PostHog is in the US. Growth Genius Inc. is based in the United States. If your data moves out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum.
9. How long we keep data
| Data | Kept for |
|---|---|
| Shopify access tokens | Cleared when you uninstall |
| Shopify orders | Rolling 25 months, then deleted. Deleted early if a store is linked for 30 days without a plan |
| Shopify products | While your store is connected |
| All Shopify data after uninstall | Deleted within 30 days (usually within 7) |
| Account information | For the life of your account. Trials that are unpaid and unused for 90 days are deleted. Paying accounts with no sign-in for 12 months have Meta sync paused, not deleted |
| Campaign and ad data | Detailed performance data 13 months, then kept only as weekly or monthly summaries |
| Support chat transcripts | 12 months, then a summary only |
| Billing records | 7 years from the end of the tax year |
| Logs | Application logs 30 days; cloud activity records 365 days; security events 1 year |
Records we keep after an uninstall: your Shopify store ID, a one-way hash of your store's web address, the dates of install and uninstall, and a log of the privacy requests and deletions we carried out and when. We keep these for 3 years to show we met our legal duties. They contain no orders, products or shopper data.
10. Security
Shopify and Meta access tokens are encrypted before we store them. Our databases, cache, file storage, server disks and backups are encrypted at rest, and backups are kept 21 days. Public traffic uses HTTPS, and our databases accept only encrypted connections. Anyone with access to personal data is bound by confidentiality.
If a breach affects Shopify merchant data, we'll tell Shopify within 24 hours of becoming aware, and tell affected customers without undue delay.
11. Your rights
Depending on where you live, you can ask to see, correct, delete, restrict or move your data, object to some uses, and withdraw consent. California, Colorado, Virginia and similar laws give you comparable rights, and you won't be treated worse for using them. Email support@vibelets.ai. We'll reply within 30 days (45 for California requests where allowed), and may ask you to verify who you are. You can also complain to your data protection authority. If you are in India, the Digital Personal Data Protection Act, 2023 gives you rights over your personal data once its main duties start, expected around May 2027.
12. Cookies
See our Cookie Policy. In the EU/EEA, the UK and Switzerland, analytics cookies and similar tools stay off until you accept them. Elsewhere they are on unless you turn them off, and we honour Global Privacy Control signals. You can change your choices at any time from Cookie settings in the footer.
13. Children
Vibelets is for businesses and isn't meant for anyone under 18. If we learn we hold data from someone under 18, we delete it.
14. Changes
We'll post changes here with a new date and email you or tell you in the app before important changes take effect.
15. Contact
Growth Genius Inc., San Francisco, California, USA. Email: support@vibelets.ai.