Last updated: September 22, 2026
Email address, name, organization membership and role, email verification status, and authentication identifiers, collected when you sign up and log in through our identity provider.
When you connect LinkedIn, X/Twitter, Instagram, or Threads, we store OAuth access and refresh tokens (encrypted at rest), the connected account's identifier/URN and display name, and the OAuth permission scopes you granted. We use these tokens solely to publish content and read the minimal profile/organization data needed to operate the Service (e.g., to let you search for people or organizations to @-mention).
Source content you provide (e.g., blog posts/URLs), AI-generated post drafts, images and carousel slides, scheduling and calendar data, and brand information (name, client name, logo). Uploaded and AI-generated media are stored in private cloud object storage.
Subscription plan, credit balance/usage, and Stripe customer and subscription identifiers. VibeCast does not store your full payment card details — these are handled directly by Stripe, our payment processor.
API keys (stored hashed), session and CSRF cookies, application error reports (via our error-tracking provider), and, on our public marketing site only, analytics data such as approximate location/country, browser information, and page interactions.
We do not knowingly collect data from children (see Section 8). We do not collect government ID numbers or financial account details beyond what Stripe processes on our behalf.
We use personal data to: provide and operate the Service (authenticate you, generate and publish content, manage scheduling); process payments and manage subscriptions; provide customer support; monitor and improve reliability and security (error tracking); send service-related communications (e.g., verification, billing, product updates); and, on our marketing site, measure visitor engagement with your consent where required.
We do not sell your personal data.
We share personal data with the following categories of third-party service providers, each acting as a processor on our behalf or as an independent platform you directly interact with:
| Category | Provider(s) | Data shared |
|---|---|---|
| Social publishing | LinkedIn, X/Twitter, Instagram, Threads (Meta) | Content and media you choose to publish; profile data needed to post |
| Payments | Stripe | Billing contact info, subscription/plan data (card data goes directly to Stripe) |
| AI content generation | OpenAI-compatible provider, Google Gemini, Google Vertex AI, Pollinations | Source content and prompts submitted for content/image generation |
| Presentation generation | Gamma | Post content used to generate carousel slide decks |
| Database/infrastructure hosting | Neon (Postgres), MongoDB, S3-compatible object storage, Render | Account, content, and media data, as needed to operate the Service |
| Error monitoring | Sentry | Application error reports, which may incidentally include technical context |
| Site analytics (marketing site only) | Datadog (via OpenTelemetry), Google Analytics | Visitor browsing/interaction data, gated by cookie consent for EEA/UK/CH visitors |
| Identity/authentication | Our OIDC identity provider | Login credentials and verification status |
We may also disclose data if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (with notice to you).
We retain account, content, and connected-account data for as long as your account is active. Upon account or organization deletion, we delete or anonymize personal data within a commercially reasonable period, except where retention is required for legal, billing/tax, or security purposes (e.g., records needed for dispute resolution). Disconnecting a social account deletes the associated stored access/refresh token; it does not retract content already published to that platform.
OAuth tokens are encrypted at rest. API keys are stored as hashes, not plaintext. Access to production data is restricted to authorized personnel. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
VibeCast's infrastructure is hosted in the United States. If you access the Service from outside the United States, your data will be transferred to, stored, and processed in the United States. See our GDPR Notice for the safeguards that apply to transfers of personal data originating in the EEA, UK, or Switzerland.
The Service is not directed to individuals under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
For privacy questions or to exercise your rights, contact us at support@getvibecast.com.
We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email, with an updated "Last updated" date above.