Legal
Data protection and GDPR
Last updated 22 August 2026
The Sandpiper Group LTD (company number 14184250) is the data controller for VibeDex. This page is the practical detail behind our privacy policy: what we process, who helps us do it, how long we keep it, and how to exercise your rights.
Download Data protection and GDPR (PDF)Controller and contact
The Sandpiper Group LTD
Trading as VibeDex
Unit 11 Forest Gate, Chippenham, Wiltshire, England, SN15 3RS
Registered in England and Wales, company number 14184250
Status: Active | Type: Private limited Company | Incorporated: 20 June 2022
Phone: +44 20 4509 9796
Email: hello@noreply.vibedex.life
We are a small company and are not required to appoint a statutory Data Protection Officer. Data protection questions are handled by the company directors at the contact details above.
Record of processing
| Activity | Data | Lawful basis | Retention |
|---|---|---|---|
| Accounts and sign-in | Email address, password hash, sign-in timestamps, display name | Contract | Life of the account, then 30 days |
| Listings, claims and accreditation checks | Business details, owner contact email, scheme membership numbers | Contract, and legitimate interests in a trustworthy directory | 2 years after the decision |
| Reviews and saved items | Review text and rating, display name, saved listings and searches | Contract | Until you delete them or close your account |
| Location and Vibe Walk | Device coordinates and heading. Camera frames stay in your browser | Consent, via the browser permission prompt | Not stored; used in the request only |
| Anti-spam, rate limiting and security | Hashed IP address, user agent, timing signals, spam score | Legitimate interests in preventing abuse | 12 months |
| Transactional email | Email address, message metadata, delivery status | Contract | 12 months of delivery logs |
| Search performance reporting | Aggregate impressions and clicks per page, no individuals | Legitimate interests | 24 months |
We do not use personal data for advertising, we do not sell it, and we do not carry out automated decision making or profiling that has a legal or similarly significant effect on you. Spam scoring only decides whether a submission is queued for a human to review.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | EU / UK region hosting |
| Cloudflare | Hosting, CDN and edge compute | Global, UK edge |
| Resend | Transactional email from noreply.vibedex.life | EU and US |
| OpenStreetMap Foundation | Map tiles and place data | EU and UK |
| Postcodes.io / Ordnance Survey Open Data | Postcode geocoding | UK |
| Google (Search Console) | Aggregate search statistics | EU and US |
| Trustpilot | Public business rating lookups for claimed listings | EU |
Each provider is bound by a data processing agreement and acts only on our instructions. Where data leaves the UK we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses. We will update this list before adding a new sub-processor that handles personal data.
Your rights, and how to use them
You can access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent where we rely on it. Two of these are instant and self-service:
- Your account has a download button that exports everything we hold about you as JSON, and a delete button that erases your account and personal data.
- Cookie settings let you change or withdraw consent for non-essential storage at any time.
- For anything else, email hello@noreply.vibedex.life or call +44 20 4509 9796. Put "data request" in the subject line and tell us which right you are using.
We reply within one month. If a request is complex we may extend by up to two further months and will tell you why. Requests are free unless they are manifestly unfounded or excessive. We may ask you to confirm you control the email address on the account before we act, and we will not ask for more identification than we need.
Removing a business listing
Many listings come from open data such as OpenStreetMap and the Food Standards Agency, and describe a business rather than a person. If you are a sole trader and your listing includes your personal details, or you simply want it gone, use our complaints and takedown route. We action valid removals within five working days and suppress the entry so a later import does not bring it back.
Children
VibeDex is not aimed at children and we do not knowingly collect their data. You need to be 16 or over to create an account, write a review or submit a listing. Tell us if you believe a child has registered and we will remove the account.
Security measures
- Row-level database rules, so a signed-in user can only reach their own records.
- Private owner contact details held in a restricted table, never exposed publicly.
- Passwords stored hashed by our authentication provider; HTTPS everywhere.
- Admin actions gated by a separate roles table, not by anything the browser can set.
- Least-privilege service keys, held as server-side secrets and never shipped to browsers.
If something goes wrong
We investigate suspected personal data breaches immediately. Where a breach is likely to risk your rights and freedoms, we report it to the Information Commissioner's Office within 72 hours of becoming aware and tell affected people without undue delay, explaining what happened, what we are doing and what you should do. Report a suspected breach to hello@noreply.vibedex.life.
Complaining to the regulator
You can complain to the Information Commissioner's Office at any time: ico.org.uk, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you gave us the chance to put it right first.