Privacy policy

Data controller and who to contact

For any question about this policy, to exercise your rights, or to raise a concern about how we handle data, email hello@noreply.vibedex.life or call +44 20 4509 9796. We aim to acknowledge enquiries within two working days and respond fully within one month.

What personal data we collect

• Account details. Email address, password hash and sign-in timestamps when you register, plus your display name if you set one. Google sign-in gives us your email address and basic profile details from Google.
• Business and claim details. The business name, address, phone, email, website, hours, description, photos and any accreditation number you submit when you add or claim a listing.
• Reviews and saved items. Reviews you write, saved listings and saved searches.
• Location. If you allow it, your device location is used to sort results by distance and to run Vibe Walk. Vibe Walk processes the camera feed in your browser only; we never receive or store camera images.
• Technical and anti-spam data. IP address, browser and device information, pages requested, referring page and submission timestamps, used to keep the site secure and to score spam.
• Local storage on your device. Recent searches and install prompt state stay on your device and are not sent to us.

How and why we use your data

• To provide the service. Running your account, publishing listings and reviews, and handling claims. Basis: performance of a contract with you.
• To keep the directory trustworthy. Verifying ownership, checking accreditation numbers, moderating content, preventing spam and abuse, and keeping the service secure. Basis: legitimate interests in a trustworthy directory.
• To send service emails. Verification, password resets, claim outcomes and notifications about your listing. Basis: performance of a contract, and legitimate interests for moderation notices.
• To improve performance. Measuring and improving search performance using aggregate statistics. Basis: legitimate interests.
• To use your device location. Sorting results by distance and running Vibe Walk. Basis: your consent, given through your browser or device permission prompt, which you can withdraw at any time in your device settings.
• To comply with the law. Meeting legal obligations and responding to lawful requests. Basis: legal obligation.

Business information published in listings

Listing details such as trading name, business address, business phone and website are published so people can find the business. Contact details submitted for verification, for example a private owner email address, are held separately and are not published. Where a sole trader's business details are also personal data, we rely on legitimate interests in maintaining a public directory, and you can ask us to remove or amend the listing.

Cookies and similar technologies

We use essential cookies to keep you signed in and to protect forms from spam. We only use analytics or preference cookies where you have given consent through our cookie banner. You can change your choice at any time via the cookie policy page. Local storage for recent searches and install state stays on your device and is not sent to us.

Who we share your data with

We use a small number of processors who act on our instructions and only process data for the purposes set out above:

• Hosting and database provider for account, listing and review data.
• Email delivery provider for transactional email from noreply.vibedex.life.
• Map tile and geocoding providers for location-based features.
• Google Search Console for aggregate search performance statistics.

We do not sell personal data and we do not share it for third-party advertising. We may disclose information where the law requires it or to protect our rights.

International transfers

Some providers process data outside the UK. Where they do, transfers rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU standard contractual clauses, with appropriate safeguards in place.

How long we keep your data

• Account data: while your account is open, then up to 30 days after deletion.
• Listings and reviews: while published, and in backups for up to 30 days after removal.
• Claim and accreditation evidence: up to 2 years after the decision, as an audit trail.
• Anti-spam and security logs: up to 12 months.
• Email delivery logs: up to 12 months.

Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right to be informed. This privacy policy and our data protection page tell you what we process and why.
• Right of access. You can ask for a copy of the personal data we hold about you.
• Right to rectification. You can ask us to correct inaccurate or incomplete data.
• Right to erasure. You can ask us to delete your personal data in certain circumstances.
• Right to restrict processing. You can ask us to limit how we use your data while a concern is resolved.
• Right to data portability. You can receive your data in a structured, machine-readable format.
• Right to object. You can object to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making. We do not make solely automated decisions that produce legal or similarly significant effects. Spam scoring is used to flag submissions for human review.

To exercise any right, email hello@noreply.vibedex.life or call +44 20 4509 9796. We will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Manage your data yourself

Signed in, your account page lets you download everything we hold about you as a JSON file and delete your account and personal data on the spot. Our data protection page lists our sub-processors, retention periods and lawful bases in full.

Children

VibeDex is not aimed at children. You need to be 16 or over to create an account, write a review or submit a listing.

Security

Access to data is controlled by row-level database rules, passwords are stored hashed, traffic runs over HTTPS, and private contact fields are held in a restricted table separate from public listing data. No system is perfectly secure, so please tell us straight away if you spot a problem.

Changes to this privacy policy

We update this policy when our processing changes. The updated date at the top shows the current version. Significant changes will also be announced by email to registered account holders where appropriate.