Privacy policy

Who to contact

What we collect

• Account details. Email address, password hash and sign-in timestamps when you register, plus your display name if you set one. Google sign-in gives us your email address and basic profile details from Google.
• Business and claim details. The business name, address, phone, email, website, hours, description, photos and any accreditation number you submit when you add or claim a listing.
• Reviews and saved items. Reviews you write, saved listings and saved searches.
• Location. If you allow it, your device location is used to sort results by distance and to run Vibe Walk. Vibe Walk processes the camera feed in your browser only; we never receive or store camera images.
• Technical and anti-spam data. IP address, browser and device information, pages requested, referring page and submission timestamps, used to keep the site secure and to score spam.
• Local storage on your device. Recent searches and install prompt state stay on your device and are not sent to us.

Why we use it, and our lawful basis

• To run your account, publish listings and reviews, and handle claims. Basis: performance of a contract with you.
• To verify ownership, check accreditation numbers, moderate content, prevent spam and abuse, and keep the service secure. Basis: legitimate interests in a trustworthy directory.
• To send service emails such as verification, password resets, claim outcomes and notifications about your listing. Basis: performance of a contract, and legitimate interests for moderation notices.
• To measure and improve search performance using aggregate statistics. Basis: legitimate interests.
• To use your device location. Basis: your consent, given through your browser or device permission prompt, which you can withdraw at any time in your device settings.
• To meet legal obligations and respond to lawful requests. Basis: legal obligation.

Business information in listings

Listing details such as trading name, business address, business phone and website are published so people can find the business. Contact details submitted for verification, for example a private owner email address, are held separately and are not published. Where a sole trader's business details are also personal data, we rely on legitimate interests in maintaining a public directory, and you can ask us to remove or amend the listing.

Who we share it with

We use a small number of processors who act on our instructions: our hosting and database provider, our email delivery provider for transactional email from noreply.vibedex.life, our map tile and geocoding providers, and Google Search Console for aggregate search statistics. We do not sell personal data and we do not share it for third-party advertising. We may disclose information where the law requires it or to protect our rights.

International transfers

Some providers process data outside the UK. Where they do, transfers rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU standard contractual clauses, with appropriate safeguards in place.

How long we keep it

• Account data: while your account is open, then up to 30 days after deletion.
• Listings and reviews: while published, and in backups for up to 30 days after removal.
• Claim and accreditation evidence: up to 2 years after the decision, as an audit trail.
• Anti-spam and security logs: up to 12 months.
• Email delivery logs: up to 12 months.

Your rights

Under UK GDPR you can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Where processing rests on consent, you can withdraw it at any time. Email hello@noreply.vibedex.life or call +44 20 4509 9796 and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

VibeDex is not aimed at children. You need to be 16 or over to create an account, write a review or submit a listing.

Security

Access to data is controlled by row-level database rules, passwords are stored hashed, traffic runs over HTTPS, and private contact fields are held in a restricted table separate from public listing data. No system is perfectly secure, so please tell us straight away if you spot a problem.

Changes

We update this policy when our processing changes. The updated date at the top shows the current version.