Privacy statement

Last updated: 1 November 2026

Your prompts, conversation history and generated code are processed to build vibelets. Information shared through a vibelet may also be visible to its owner and other authorised participants. Use non-sensitive test data in experimental features.

1. Who is responsible?

Locoda Oy (Finnish Business ID 3493423-1) is the controller for Vibelets account administration, service operation and security. Contact: support@vibelets.app.

A person or organisation using a vibelet to collect information for its own purposes may separately be responsible for that collection. Contact that vibelet's owner about their purposes and access decisions, or contact us for help identifying the relevant party. The allocation of responsibilities depends on the actual processing, not simply on these terms.

2. Information processed

• Payments and automatic top-up: Stripe processes payments and stores full payment-card details, billing addresses and business tax identification details you provide. Stripe uses billing details to calculate applicable taxes and issue invoices. Vibelets stores references linking your account to your saved payment method, invoices and transactions, a partially hidden card description, purchase records, net and tax amounts, invoice numbers and receipt links, free and purchased credit balances, automatic top-up settings and a record of when and on what terms you authorised automatic purchases. We do not store full card numbers or security codes. If you enable automatic top-up, we use your saved payment reference to initiate purchases within your selected monthly monetary limit. Payment and billing information is processed to perform your agreement and meet applicable legal obligations. See Stripe's privacy policy for its processing.
• Payments in vibelets: If a vibelet owner sells products, services or access, Stripe handles seller registration, identity checks and checkout. Vibelets keeps the seller's payment-account reference, approved products and prices, order details as they were when purchased, a reference to the buyer's account or guest visit, payment and refund/dispute references, platform fees, payment status and purchased access. For product/service orders, we also receive the customer's name and email provided at checkout and show them only to the selling vibelet owner for order handling and customer service. Generated vibelets can read only the current buyer's payment status, without these contact details. These records are used to process and check payments, help the seller fulfil purchases, grant or revoke access where applicable, and handle refunds and disputes. Test payments and real payments are kept separate. Payment records may need to be retained after an app or account is deleted for accounting, refunds, disputes and applicable legal obligations. We do not receive full card numbers or the identity documents provided to Stripe. The vibelet owner is the seller and is responsible for their own processing of customer information.
• Account and sign-in information: name, email address, account reference, account status, preferences and sign-in records. Microsoft's sign-in service handles email codes and enabled external providers such as Google. Vibelets does not receive your Google password or collect a new account password.
• Organisation and data-processing agreement correspondence: where you act for an organisation or another controller, the organisation's legal name and address, business identifier where applicable, account reference, representative and privacy-contact details, processing role and authority information you supply by email. Locoda uses this information to administer the service and data-processing agreement, handle instructions and enquiries and meet its accountability obligations. Do not include unnecessary app records or identity-document copies in the notification.
• Optional Google Sheets connections: Google account references, name and email address; encrypted credentials allowing the connection to work; selected spreadsheet and tab references, titles, column headings, permissions and records of requested actions; and cell values needed for those actions. See Google Sheets connections below for access, sharing, storage and disconnection details.
• Optional marketing emails: if you opt in, Vibelets may email you about new features and ideas for using vibelets. We store your choice, the time it changed, its source and the consent wording version. The choice is off by default and is not required to create an account or use the service. You can withdraw or grant permission anytime in your profile. Signing in again does not reset a saved choice.
• Service emails: we use your email address to provide and manage your account and the services you request. These messages can include sign-in codes, security and payment notices, replies to support requests, invitations or notifications connected with your use, and important service or terms changes. They may also include non-promotional instructions needed to use an affected feature or respond to a change in the service you already use. Necessary service emails do not depend on your marketing-email choice. General newsletters, promotional feature announcements and emails encouraging you to return or try more features follow the optional marketing choice above.
• Creation history: your building requests, clarification answers, conversations, generated apps and their code, saved versions, dates and times, and records of AI usage.
• Vibelet content: saved information, uploaded files and details about those files, including who uploaded them where known, filenames, sizes and dates.
• Optional service feedback: your message, attached files, account reference, name and verified email when available, and an optional reference to your own vibelet. We notify our support team by email and keep feedback and attachments in restricted-access support records. In the live service, feedback text and related details are also copied to our internal reporting system; attachment files remain in the support file store. Feedback is used to handle support requests and improve the service, and is not published to other users.
• Content and issue reports: the reported vibelet or gallery address, category, explanation, good-faith statement, name and contact email when provided or required, receipt reference, and internal handling records. You can report without an account. Contact addresses entered in the form are not verified. Reports are kept separately from general feedback, are available to authorised administrators and are not automatically copied to the general feedback reporting system. We use them to investigate issues, prevent abuse and assess harmful or illegal content, based on our legitimate interests and, where applicable, legal obligations. To limit abusive repeated submissions, we use visit references or references calculated from network addresses; these can still be personal information. Reports and handling notes are kept while needed to investigate, document decisions and handle disputes; there is currently no fixed automatic deletion period. Account or vibelet deletion does not automatically delete these separate records. Contact us to request access or deletion.
• Collaboration: membership, invitations, share-link permissions and temporary presence information, including state supplied by the vibelet.
• Community discussions: threads, replies, public profile names and posting/edit timestamps are visible to everyone, including visitors who are not signed in. We retain an internal account reference for ownership and abuse controls. Reports, reporting account references, moderation reasons and moderator audit records are private to authorised administrators. Discussion content is used to provide the community feature; reports and proportionate rate-limit records help prevent abuse. After account deletion, remaining posts display “Former member” instead of the profile name. Contact support about removing personal information from posts.
• Technical information: connection and request details such as IP addresses, browser information, errors and security/service records. Our server error records are designed to leave out your building requests, email addresses, file contents and detailed error information returned by providers. Where needed, identifiers are replaced with indirect references; these can still be linked to a person and are not treated as anonymous. Previously collected records may remain until their retention period ends. Conversations, support records and business records are kept separately from these error records.
• Usage statistics: with your separate analytics choice, Microsoft provides measurement of studio and marketing-site page views and selected studio actions. General page-view measurement leaves out extra information in web addresses, such as search or tracking parameters, as well as building requests and file contents. Separate optional campaign measurement uses selected campaign references from links, as described below. Records needed to operate the service can include published vibelet versions, sharing actions, indirect creator references, AI usage and estimated AI cost; these are separate from optional browser analytics.
• Optional voice features: microphone audio sent for conversion to text, the resulting text and reply text sent to create spoken audio. Vibelets does not intentionally keep audio recordings; converted text becomes part of the conversation if you send it.

Where an organisation or person determines why and how personal data is collected through a vibelet, that party may be the controller and Locoda may act as its processor under applicable processing arrangements. The account holder may be acting for that organisation. Our contract with an account holder is not itself a legal basis for collecting other people’s information. The controller must determine and communicate the appropriate basis for its collection.

3. Purposes and legal bases

For our own controller processing, we process account and requested service information where necessary to perform a contract with the individual concerned (GDPR Article 6(1)(b)). Where we process app or conversation content on a customer controller’s behalf, that controller determines the legal basis and we follow documented instructions; our contract with the account holder is not a blanket legal basis for third-party personal data. We process proportionate operational and security data to prevent abuse, diagnose faults and maintain the service (legitimate interests, Article 6(1)(f)), balancing those interests against your rights. We may retain or disclose information when required by law (Article 6(1)(c)). Where a feature or processing activity requires consent, we will ask separately and allow withdrawal; accepting terms is not blanket consent to personal-data processing.

Microphone use is optional and requires browser permission. You can deny or revoke that permission and use text instead. Account details and prompts are needed for the corresponding account and generation features; without them those features cannot be provided.

4. AI, hosting and recipients

When you connect Vibelets to ChatGPT or another compatible assistant or app, that service sends your building requests, clarification answers and selected task content to Vibelets. We use your signed-in account and permissions to find accessible apps and carry out requested builds, changes and sharing actions. Vibelets does not independently retrieve your full ChatGPT conversation. App details and building responses are returned to the connected service; app data and permitted profile information can also be shown through its interactive preview. Information shown in a preview instead of the chat can still be processed by that service's provider. Its own terms and privacy policy also apply. Manage the connection in that service's settings; the account, app-deletion and data-request controls described here apply to information stored by Vibelets.

We use Microsoft's cloud services to host Vibelets, store information, handle account sign-in and provide some AI and speech features. Building or editing an app sends relevant conversation content to the selected OpenAI or Microsoft AI service, with existing app code and selected attachments when needed. When used, TypeSafe processes relevant request text, app titles, limited conversation context and details about attachments to analyse and prepare AI-assisted actions. These inputs may contain personal data. Speech features send audio or text to Microsoft's speech service. Information you include in a building request or app code may therefore reach these providers. For app-generation requests, we turn off optional storage of AI response history at the provider; providers may still retain information for service operation, abuse prevention and other purposes under their own rules.

While you type in the builder, unfinished drafts and limited conversation context may be sent to TypeSafe to assess whether your request is ready to build. These assessments do not deduct your credits. We do not add unfinished drafts to your creation history for this feature. We temporarily keep the assessment results and indirect references to the draft, without keeping the unfinished text in those assessment records.

Live voice conversations send audio to the selected voice AI provider for processing. During voice planning, the current plan summary and open questions may also be sent to TypeSafe to assess readiness without deducting your credits. For this assessment, we keep only the current summary and result while the voice session is active, and remove them when it ends. This does not add the voice conversation or a written transcript to your creation history.

Service administrators and providers may access information as needed for operation, support, security and legal obligations. Other users receive information according to your sharing settings and the vibelet's behaviour; permitted profile information can be supplied to the vibelet you use. If a generated app connects to an external service, information sent to that service is also subject to its own practices. Review an app before sharing sensitive information with it.

4.1 Google Sheets connections

Connecting Google Sheets is optional and separate from signing in to Vibelets with Google. We use your Google account reference, name and verified email address to identify the connected account. You allow access to files selected through Google's file-selection window. This permission does not grant access to all files in your Google Drive. Each vibelet is further restricted to the spreadsheet, tab and read, add or update actions you enable.

The connection accesses spreadsheet and tab titles, column headings and the selected tab's cell values to provide the spreadsheet features you request. Approved column headings and permissions are supplied to the builder so it can create the app. Adding or updating rows sends the requested values to Google. The connection may add its own row references to the spreadsheet to track updates and avoid duplicating repeated requests.

If you share a vibelet with reading enabled, users allowed to access that vibelet can receive data from the selected tab without connecting their own Google accounts. A public vibelet can therefore expose that data to public visitors. Adding and updating also depend on the operation permissions you enable and the user's write access. Review the selected tab and sharing permissions before enabling access.

We keep connection settings, account details, spreadsheet and tab references, column headings, permissions and records of requested actions in restricted-access storage. The credentials that let the connection work are encrypted when stored. Google's file-selection window uses temporary authorisation; generated vibelets and their visitors do not receive your connection credentials. The connection does not automatically keep a permanent copy of the spreadsheet's cell contents. Information you ask a vibelet to save, send or include in an AI request is handled according to that feature and the other sections of this statement.

Ordinary spreadsheet operations do not require AI. If you request an AI feature that uses spreadsheet content, the content submitted for that feature may be sent to the AI providers described above. We do not sell Google API data, use it for advertising, or use it to train general-purpose AI models. Vibelets staff access to Google content is limited to specific support you authorize, necessary security or abuse investigations, or legal requirements.

Vibelets' use and sharing of Google API data follow the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace user data and developer policy.

4.2 Public website lookups

When you request a public website lookup, a service operated by Vibelets visits the website and sends the requested address, search details and ordinary browser connection information. The website's operator may process those requests under its own privacy terms. The AI provider receives your lookup instructions and selected information from the pages to guide the lookup. The visit uses a separate, temporary session; your own browser logins and connected-account credentials are not supplied to the website. Temporary lookup instructions and detailed lookup records are normally removed after 24 hours, and a limited lookup history after 30 days. Results saved in a vibelet follow that vibelet's normal retention; billing and security records follow the periods described below.

5. Processing locations

Our providers may process information in Europe and other regions. The Microsoft service used for account sign-in has Europe selected as its data location; this does not mean that all AI processing, support or service records stay in Finland or the European Economic Area (EEA). Where providers process personal data outside the EEA, applicable safeguards, such as a recognised adequate level of protection or standard contractual clauses, must apply. You can contact us for information about the arrangements relevant to your data and copies of applicable safeguards.

6. Retention and deletion

Deleting an app or account first closes access to it. We then remove its information and retry any interrupted cleanup. A request may remain pending while ongoing work stops or usage charges are checked. Cleanup includes app records, generated apps and code, earlier saved versions, historical file copies and related app files. It does not undo changes already made in external services or recall independent copies. Completed temporary building-status records and unused temporary preview files are normally removed after seven days; unfinished work or necessary usage checks can delay their removal.

Deleted files in our main customer-data store may remain recoverable for 14 days. The service used for operational diagnostics is currently configured to keep its records for 90 days, with the period depending on the record category. Removing active information does not immediately remove every recovery copy or previously collected service record. We keep limited records of completed deletions to prevent old work or sign-ins from bringing deleted content back, and review whether those records are still needed.

Google Sheets disconnection and deletion: In Vibelet settings → Vibelet connections, remove the Sheets connection from a vibelet to stop new spreadsheet requests from that app. Disconnecting the Google Sheets account from all vibelets disables its connections and removes the saved credentials that allowed access. Account details and records of earlier actions can remain under the retention criteria below. You can also revoke Vibelets' permission in your Google account connections; this can affect other connections using the same Google application. Deleting your Vibelets account removes its active connection credentials and settings. These actions do not undo changes already made or delete spreadsheet contents, added row references, or copies already saved or sent to other recipients. Manage the original spreadsheet in Google Sheets and any saved copies through the relevant app or recipient. Service records and recovery copies follow the retention and deletion limitations below.

Feedback is kept as a separate support record while needed to handle requests and improve the service. There is currently no fixed automatic deletion period. Deleting an account or vibelet does not automatically remove feedback already submitted or its email, storage and reporting copies. Contact us to request access or deletion of these records.

Account information, conversations, generated versions and app data are kept while needed to provide the corresponding account or vibelet, until deleted, or until the relevant service or test data is retired. The service does not currently apply a fixed automatic inactivity-deletion period to this content. You can delete conversations and use the account-removal function; contact us for other deletion requests. Shared records, copies made by recipients, identity-provider records, logs and backups are not necessarily removed by the same operation.

Records needed to operate the service, including usage statistics linked to indirect account references, are kept for the period set for the relevant record type and while needed to provide the service or investigate incidents. Deleting a conversation or account does not automatically remove these separate usage records or every service record or recovery copy. We assess requests for the affected information and any legal requirement to retain it; contact us for the period or criteria applying to a specific record. Temporary information about who is currently present stops appearing when it expires and is periodically removed.

Invitation and campaign rewards: If you follow an invitation or partner campaign link, we save an invitation reference in a cookie for up to 30 days to apply the offer when you create an account. We record the referring account, campaign, qualifying registration, build or sharing action, and credit award so rewards can be delivered once and interrupted processing can finish. Campaign credits may carry over between months. Account removal deletes personal campaign links, records linking you to the invitation or campaign, and pending awards. We retain calculated references derived from email addresses to prevent repeated new-account bonuses; these can still be personal information. This processing supports the offer you followed and is separate from optional browser analytics.

7. Cookies and browser storage

The studio and shared vibelets use necessary cookies for sign-in and access. Your browser also saves your language, interface settings and account-display preferences. Sign-in providers may set their own cookies. The marketing website does not need a sign-in cookie. These items support features you request and do not depend on analytics consent.

Browser analytics provided by Microsoft starts on the studio, shared-vibelet pages and marketing website only after you choose “Allow analytics”. It measures page views and a small set of studio actions, leaving out building requests, file contents and extra details in web addresses, such as search parameters. Selected campaign references from links are used separately for the optional campaign measurement described below. This analytics does not use its own cookies or automatically collect detailed request and error records. Connection information, such as your IP address and browser details, may still reach Microsoft when measurements are sent. Rejecting or withdrawing consent stops future browser analytics; it does not erase information already sent. Records needed to operate and secure the service, and separate usage counts, continue independently. These counts include daily opens per vibelet and share link, without recording the viewer's identity in that counter.

Your browser stores each site's analytics choice and its date for up to 180 days, then asks again. The marketing website and studio have separate choices; shared vibelets use the studio choice. Use Cookie settings here or in the studio profile, shared-vibelet footer or website footer to change your choice at any time. We do not use advertising cookies. Generated vibelets can have their own browser-storage behaviour.

Optional campaign measurement: after you allow analytics, we save selected campaign, channel and post references in a cookie and your browser for up to 30 days. The website can pass these references to Studio. With Studio analytics consent, we link an indirect account reference to accepted building requests, your first successfully saved own vibelet, registration and confirmed real credit purchases, including amount and currency. We associate each action with the most recent recognised campaign visit within 30 days. These campaign records do not contain building-request text, email addresses, full web addresses or the full address of the page you came from. Temporary visit, build and payment-tracking records expire after 30–35 days; records of measured actions expire after 395 days. We keep an indirect account reference showing that a first vibelet has already been created until the account is deleted, so that action is not counted repeatedly. Withdrawal stops new measurement and removes the optional browser reference, but does not automatically erase earlier lawfully collected records. Account deletion removes associated identifiable campaign records. This optional measurement is separate from invitation rewards and necessary payment/account records.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Where consent is the basis, you can withdraw it without affecting earlier lawful processing. Contact us using the details above; we may need proportionate information to verify your identity. Requests are handled within the time limits required by law.

You can complain to the Finnish Office of the Data Protection Ombudsman or your local data-protection authority. Vibelet generation is automated, but is not intended to make decisions about people with legal or similarly significant effects.

9. Updates

We will update this statement as the service evolves and show the revision date above. Material changes will be communicated where required. Contact us before using the service for processing that needs additional contractual or organisational safeguards.