Privacy Policy

The short version

• Your photos and results are deleted from our systems within 24 hours of upload.
• We strip location data (GPS/EXIF) from every photo when you upload it.
• We never use your photos to train AI models, and our AI providers are not allowed to either.
• We don't use your photos to identify you, and we don't create face-recognition templates.
• We don't sell your personal information or share it for targeted advertising.

1. Who is responsible for your information

Stack Max LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States, is responsible for your personal information (the “controller” under EU and UK data-protection law). You can reach us at contact@vibelune.app or +1 (702) 359-3841.

2. Information we collect

Information you give us

• Account information: your email address and, if you sign in with Google, the name, email address and profile picture that Google shares with us. If you sign up with email, we store your email address and a securely hashed password or sign-in link details.
• Photos and results: the photos you upload (“Uploads”), the images we create from them (“Results”), and the vibes, edit options and any text instructions you choose.
• Purchase information: your plan, purchase history, credit balance and billing country. Payments are handled by Stripe; we receive limited details such as the card brand, last four digits and expiry date, but never your full card number.
• Messages: what you send us when you contact support.

Information collected automatically

• Usage and device information: pages and features you use, date and time, browser and device type, operating system, referring page, and approximate location (country or city) derived from your IP address.
• Technical and error data: when something breaks, information about the error, your browser and device, and your IP address.
• Cookies and similar technologies: see our Cookie Policy.

We do not knowingly collect information from children under 13 (or under 16 in the EEA, UK and Switzerland). See section 11.

3. How we handle your photos

• Purpose: we use Uploads only to create the Results you ask for and show them to you.
• Location stripped: we remove GPS and other location metadata from every photo on upload, before it is processed.
• AI processing: to create Results, we send your Upload and instructions to one of our AI image providers: Google (Gemini API), OpenAI (OpenAI API) or fal (fal.ai). Which one is used can depend on the vibe or edit and on availability. We use each provider's paid API services, under terms that do not allow them to use your content to train or improve their models. A provider may keep inputs and outputs for a limited period, solely to provide the service, detect abuse and meet legal obligations, as described in its API terms; it may not use them for any other purpose.
• Automatic deletion: Uploads and Results are deleted from our systems within 24 hours of upload. Save the Results you want to keep.
• No training, no face recognition: we never use Uploads or Results to train AI models, and we don't use them to identify people or create biometric identifiers such as face-recognition templates.
• Safety checks: we use automated checks to block requests that break our Acceptable Use Policy, such as sexual content or photos that appear to show minors.

4. How we use information

We use personal information for the purposes below. If you are in the EEA, UK or Switzerland, the table also shows the legal basis we rely on.

We do not use your information for automated decisions that have legal or similarly significant effects on you. We will only send you marketing emails if you have agreed to receive them, and you can unsubscribe at any time.

5. Who we share information with

We share personal information only with the service providers that help us run Vibelune, and only what they need to do their job. They are bound by contract to protect it and to use it only for the services they provide to us.

Stripe also uses some payment information as an independent controller, for example to prevent fraud and comply with financial regulations; see Stripe's Privacy Policy. We may also disclose information if required by law or to protect the rights, safety and property of our users, the public or us, and to a successor if our business is merged or sold (in which case this policy will continue to apply to your information).

We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising.

6. Information from Google

If you sign in with Google, we receive only your name, email address and profile picture, and use them only to create and secure your account and to contact you about the Service. Vibelune's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this information for advertising, we do not sell it, and we do not use it to train AI models.

7. Cookies and analytics

We use essential cookies to keep you signed in and to process payments, and Google Analytics cookies to understand how the Service is used. In the EEA, UK and Switzerland we only set analytics cookies if you agree. Google Analytics does not store your IP address. You can opt out of Google Analytics on any site with Google's opt-out browser add-on. Details are in our Cookie Policy.

8. How long we keep information

We may keep information longer if the law requires it, or where needed to resolve disputes, prevent fraud and abuse, or enforce our agreements.

9. Security

We protect your information with industry-standard measures, including encryption in transit (HTTPS), access controls and limited retention. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If we become aware of a data breach that affects you, we will notify you and the authorities as the law requires.

10. International transfers

We are based in the United States, and our service providers may process information in the United States and other countries. When we transfer personal information from the EEA, UK or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK addendum), or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

11. Children

Vibelune is not for children under 13, or under 16 in the EEA, UK and Switzerland. We do not knowingly collect personal information from them. If you believe a child has given us personal information, contact contact@vibelune.app and we will delete it. We block edits of photos that appear to show minors.

12. Your rights and choices

For everyone

You can see and update your account information in your account settings, delete your account at any time, and ask us for a copy of your information or for it to be corrected or deleted by emailing contact@vibelune.app. You can unsubscribe from marketing emails using the link in any of them.

EEA, UK and Switzerland

You have the right to access, correct, delete, restrict or object to our processing of your personal information, to data portability, and to withdraw consent at any time (without affecting processing before you withdrew it). You also have the right to complain to your local data-protection authority, although we'd appreciate the chance to help first.

US state privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas or Oregon), you may have the right to know what personal information we collect and how we use and disclose it; to access, correct and delete it; to receive a portable copy; and to opt out of its sale, of sharing for targeted advertising, and of profiling. We do not sell or share personal information for targeted advertising, and we do not use sensitive personal information to infer characteristics about you.

In the last 12 months we have collected these categories of personal information: identifiers (such as name, email address and IP address); commercial information (such as purchases and credit balance); internet or other electronic network activity (such as usage and error data); approximate geolocation; and audio, electronic or visual information (your photos and results). We collect them from you, from your device and, if you use Google sign-in, from Google, for the purposes in section 4, and disclose them to the service providers in section 5.

How to make a request

Email contact@vibelune.app from the address on your account, or call +1 (702) 359-3841. We will verify your identity before acting on a request, and we will respond within the time the law requires (usually 30 or 45 days). You may use an authorized agent, who must show proof of your permission. If we decline your request, you can appeal by replying to our decision, and if you are still not satisfied you can contact your state attorney general. We will not discriminate against you for exercising your rights.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “last updated” date and, if the changes are significant, tell you by email or in the Service before they take effect.

14. Contact us

Stack Max LLC
30 N Gould St, Ste R, Sheridan, WY 82801, United States
Email: contact@vibelune.app
Phone: +1 (702) 359-3841