Privacy Policy

Draft, to be reviewed by a lawyer. This is a working draft prepared by Vibel for customer and internal review. It has not been reviewed by qualified legal counsel and is not a final, lawyer-approved policy.

Data We Collect

We collect account email addresses for authentication, workspace and billing metadata, connected Instagram account identifiers, encrypted Instagram access tokens, campaign settings, webhook payloads, comments needed to process campaigns, delivery logs, and operational diagnostics.

How We Use Data

We use this data to authenticate users, connect Instagram integrations, match comment keywords, send private replies through the official Meta APIs, prevent duplicate sends, troubleshoot failures, and protect the service.

Instagram And Meta Data

Vibel Reply does not ask for Instagram passwords, scrape Instagram, or use browser automation. Instagram tokens are encrypted at rest and are used only to perform actions authorized by the connected business account.

Consent, As A Record

Before we send someone a marketing message on your behalf, we record what they agreed to, when, in what words, and on what channel, in an append-only consent log: a later withdrawal is a new entry, never an edit that erases what was recorded. A comment such as “LINK” under a post is treated as a request for that one reply, on that one channel, now, not as marketing consent; we ask separately, and store that answer separately, before sending anything beyond the single reply. This record is also how we support your customers' own privacy requests: because we can show what was agreed and when, you do not have to take our word for it.

DM-To-Order Matching

If you connect both Vibel Reply and Vibel (the operations platform) for the same store, Reply shares with Vibel which conversation led to which Shopify order, using signals such as a tracked link click, a discount code, or a matched contact identifier, so you can see which DM conversations led to a sale. Vibel receives only the match itself (which conversation, which order); it does not receive the DM content, and the consent record above stays with Reply. See Vibel's own Privacy Policy for how it uses and retains that match.

Chat Checks

Where our AI drafts or sends a reply on your behalf, we run automated checks on that content (for example, against Meta's messaging rules and any guardrails you configure) before it sends, and keep a record that the check ran and what it found, so you can see why a message was sent, held, or blocked.

Link Clicks

When someone clicks a tracked link we send in a DM or campaign (the /r links your automations send), we record the click: which link, when, a hashed version of the visitor's IP address, their browser's user agent, and the referring page. The IP address is hashed before it is stored, never kept in the clear. We keep these technical details to attribute a click to the right recipient, measure campaign performance, and help spot abuse such as bot traffic, not to identify who visited. We do not share the hashed IP or user agent with Vibel or any other party; if you also connect Vibel for order matching (see DM-To-Order Matching above), only the resulting match is shared, never these fields. The hashed IP and user agent are automatically deleted (set to null) 90 days after the click; the click itself, and which link and recipient it belongs to, is kept for your campaign reporting.

Subprocessors

The production service may use hosting, database, Redis queue, email, and observability providers such as Vercel, Railway, Supabase (PostgreSQL), Redis, Resend, Meta (Instagram, Facebook Messenger and WhatsApp, for the channels you connect), Stripe (billing), Anthropic (AI replies and the Copilot), and TikTok (if you connect a TikTok account). These providers process data only as needed to run the service. See the Sub-processors page for purpose, data, and location per vendor, and the Data Processing Agreement and Security page.

Retention And Deletion

Customers can disconnect Instagram from settings, which removes the stored Instagram connection and stops campaigns. For account or data deletion, follow the Data Deletion page linked from the footer. The consent log (above) is kept as long as the contact record it belongs to exists, since it is the evidence that a message was lawfully sent; it is deleted with the contact on an erasure request, not separately. A DM-to-order match shared with Vibel is deleted on the same schedule, or sooner if you disconnect Vibel Reply.

Contact

Vibel Reply is operated by HAVA Export B.V., trading as Vibel, registered in the Netherlands at Meester Achtenstraat 21, 5963 HM Hegelsom, KvK 90977203. For privacy questions, data access requests, or deletion requests, email privacy@getvibel.com.

Assignment

We may assign or transfer this agreement, in whole or in part, to an affiliate or group company (including a successor entity operating Vibel) by giving you written notice; your rights under this agreement are not reduced by such a transfer.

Governing Law

This policy is governed by the laws of the Netherlands. Any dispute not resolved informally is submitted to the competent court in Amsterdam.