Privacy policy
Last updated: 6 November 2026
This policy explains what personal data Vibe9.co collects, why, who we share it with and what rights you have. It covers the website at vibe9.co, the Vibe9 application and the public demo.
Who we are
Vibe9.co is operated by PMC Tomasz Pasko, Zywiecka 14 Street, 34-321 Lekawica, Poland, tax ID PL5532328643 ("Vibe9", "we", "us"). We are the controller of the personal data described in this policy.
For anything about your data, write to t.pasko@gmail.com.
The short version
- Vibe9 reports on Meta (Facebook and Instagram) ad accounts. We ask Meta for read-only access and never change your campaigns, budgets or ads.
- We keep the data needed to run your account and your dashboards, and we delete dashboard data 90 days after you archive a dashboard or your subscription ends.
- We do not sell personal data and we do not use your ad account data for advertising.
- The website uses cookies to sign you in. Only if you accept in the cookie banner, it also uses the Meta Pixel to measure our own advertising.
What data we collect
Account data. Your email address and, if you sign in with Google, your name and profile picture. We use your email to sign you in with a one-time link and to send you service messages.
Workspace and team data. The names of your workspaces and dashboards, the roles of the people you invite, and the email addresses of people you invite. If you invite someone, you confirm that you may share their email address with us for that purpose.
Facebook connection data. When you connect Facebook, we receive your Facebook user ID and name, the permissions you granted and an access token. The token is stored encrypted and is only used by our servers to read the ad accounts you chose.
Ad account data. For each ad account you connect: its ID, name, currency and time zone; the names, statuses and budgets of its campaigns, ad sets and ads; daily performance figures such as spend, impressions, clicks, purchases, purchase value and video plays; and thumbnails of your ad creatives. This is aggregated advertising performance. It does not identify the people who saw your ads.
Insights. The written reviews generated for your dashboards, together with the figures they were written from.
Billing data. Our payment provider, Stripe, collects your payment details. We store only the Stripe customer and subscription IDs and the status of your subscription. We never see or store your full card number.
Activity and security data. A record of actions in your workspace (for example settings changes, invitations, generated insights and deleted versions), and technical logs kept by our hosting and database providers, which can include IP addresses, browser information and timestamps.
Why we use it and our legal bases
- To provide the service you signed up for: accounts, sign-in, dashboards, reports, insights, sharing and billing. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
- To keep the service secure and working: preventing abuse, keeping audit records, fixing errors and planning capacity. Legal basis: our legitimate interest in running a secure and reliable service (Article 6(1)(f) GDPR).
- To meet legal obligations, such as keeping invoices and accounting records. Legal basis: legal obligation (Article 6(1)(c) GDPR).
- To send you service emails: sign-in links, invitations, notices about your connection or billing, and, if you turn them on, notifications that new insights are ready. Legal basis: performance of our contract, and your choice where an email can be switched off.
- To measure our own advertising with the Meta Pixel and Meta's Conversions API: only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time under Cookie settings in the footer of the website, the sign-in page and these legal pages.
How we use data from Meta
We access your ad accounts through Meta's Marketing API with the ads_read permission, which is read-only. We use the data only to build the reports and insights you see in Vibe9 and to show them to the people you invite or share them with. We do not sell it, use it to build profiles or use it for advertising, and we do not combine it with data from other customers.
You can disconnect at any time, either in Vibe9 (Connections) or in your Facebook settings under Business integrations. When you remove Vibe9 in Facebook, we stop syncing. When Meta sends us a data deletion request for you, we delete your stored connections and every dashboard that depended only on them, and we give you a link to check the status of the deletion.
How we use AI
When you or a scheduled job generates insights, we send Anthropic's Claude API the dashboard name, currency, targets, the period, and the names and figures of the ads in that period. We do not send your email address or the names of your team members. Anthropic processes this data as our service provider to write the review and returns it to us. The review is saved in your dashboard.
How we measure our advertising
We advertise Vibe9 on Facebook and Instagram. If you choose Accept in the cookie banner, our website and application load the Meta Pixel, which records the pages you view and these steps: requesting a sign-in link, creating a workspace, opening checkout, starting a free trial, the first payment, and opening the sample-data demo. Our server also sends these steps to Meta's Conversions API, together with your email address in hashed form (SHA-256), your IP address, your browser's user agent and Meta's cookie identifiers, so that Meta can tell us which ads led to them.
If you choose Reject, or make no choice, the pixel does not load and none of this is sent. Meta processes this data under its own terms and privacy policy (facebook.com/privacy/policy). This is separate from the data we read from your own ad accounts, which we never use for our advertising.
Who we share data with
We use the following service providers, who process data on our behalf and only for the purposes above:
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | European Union (Frankfurt, Germany) |
| Vercel | Hosting of the website and application | Global network |
| Meta Platforms | Source of your ad data and Facebook Login; with your consent, the Meta Pixel and Conversions API for measuring our ads | Ireland and United States |
| Anthropic | AI model that writes insights | United States |
| Stripe | Payments, invoices and the customer portal | Ireland and United States |
| Resend | Sending sign-in links and service emails | United States |
If you sign in with Google, Google processes your sign-in under its own privacy policy.
We may also disclose data when the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.
International transfers
Some providers process data outside the European Economic Area. Where they do, we rely on the safeguards each provider offers, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
How long we keep data
- Your account is kept while you use Vibe9. You can ask us to delete it at any time.
- Dashboard data (ad data, previews, insights) is deleted 90 days after you archive the dashboard, or 90 days after your subscription ends.
- Background job records and usage logs are deleted after 30 days.
- Facebook access tokens are deleted when you remove the connection or when Meta asks us to delete your data.
- Invoices and accounting records are kept for as long as tax and accounting law requires.
- Backups made by our database provider are overwritten on their regular schedule.
Your rights
Depending on where you live, you have the right to access your data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you gave. To use any of these rights, write to t.pasko@gmail.com. We will reply within one month.
You also have the right to complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). If you are in the United Kingdom, you can contact the Information Commissioner's Office; in Australia, the Office of the Australian Information Commissioner.
Security
Data is encrypted in transit. Facebook access tokens are stored encrypted and can be read only by our server code. Access to each workspace and dashboard is enforced in the database itself, so a person sees only the dashboards they belong to or were invited to. Share links are random, can expire and can be revoked.
Cookies
The website and application use these cookies:
| Cookie | Purpose | Duration |
|---|---|---|
sb-…-auth-token | Keeps you signed in | Until you sign out or the session expires |
meta_oauth_state | Protects the Facebook connection step against forgery | A few minutes, only while you connect Facebook |
vibe9_consent | Remembers your choice in the cookie banner | 6 months |
_fbp | Meta Pixel: measures our ads. Set only after you accept | 90 days |
_fbc | Meta Pixel: remembers the ad you arrived from. Set only after you accept | 90 days |
The first three are strictly necessary. The Meta Pixel cookies are set only after you choose Accept, and you can change your choice at any time with Cookie settings in the footer of the website, the sign-in page and these legal pages. Our fonts are hosted by us, so loading the site does not contact third-party font services.
Children
Vibe9 is a tool for businesses and is not intended for anyone under 16. We do not knowingly collect data about children.
Changes to this policy
We may update this policy when the service or the law changes. We will change the date at the top, and if the change is significant we will tell signed-in users by email or in the application before it takes effect.
Contact
PMC Tomasz Pasko, Zywiecka 14 Street, 34-321 Lekawica, Poland. Email: t.pasko@gmail.com.