Privacy policy

WYGOFAMILY LTD is the controller for the account, gameplay, and certificate data described here. Contact: support@vibesolid.app; Suite 2286, 124 City Road, London, England, EC1V 2NX.

• Account and authentication

  Email address, password hash held by our authentication provider, account and sign-in timestamps, authentication provider, and security records associated with sign-in. Our authentication provider may process session IP address and user-agent data to authenticate sessions and investigate abuse. Your password is sent over HTTPS through our server to our authentication provider; our application does not store or log the plaintext password. If you choose third-party sign-in when available, the identity and authentication providers process the sign-in and basic identity information such as your email, name, profile picture and account identifier. We do not request access to your inbox, files or contacts. Email sign-in codes are submitted to our authentication provider for verification and are not stored in our application database or logs.

• Profile and preferences

  Your selected avatar and theme, plus a generic profile label. New accounts are not named from the email address.

• Gameplay and learning records

  Scenario answers and run state, progress, scores, attempts, streak badges, checklist selections, quiz results and category scores, and certificate-exam results. Quiz results are linked by account ID; we do not store a second copy of your email with them.

• Public certificate

  Only after you choose to issue one, the exact public name you enter, credential ID, and issue date are published on a verification page. The form identifies the public fields before publication. Deleting your account removes the registry record.

• Billing and orders

  Plan, entitlement, payment-provider customer/subscription/payment/session identifiers, checkout status, and billing-event timing. Card and bank details go directly to the payment provider and do not reach VibeSolid servers.

• Security and hosting data

  Our hosting and security providers may process IP address, request metadata, and operational logs. Abuse limits store pseudonymous keyed hashes and counters, not the raw address. Short-lived verification records are used for password reset and account deletion.

• Optional analytics

  If you accept the equal-choice analytics prompt, our analytics provider receives page path, referrer, approximate country, device, browser, and operating-system information. Query strings are removed and account, sign-in, callback, and password-reset pages are excluded.

• Email and support

  Your email address, service-email content (including sign-in or recovery links and codes), and delivery records are processed to deliver account emails. If you contact support, we receive your message and any details you choose to include. Please do not email passwords, sign-in codes, full card details or identity documents.

• Contract

  Create and secure your account, save learning progress, deliver paid features, process purchases, manage subscriptions, and issue a certificate when you request it.

• Legitimate interests

  Prevent abuse and fraud, keep the service reliable, maintain minimal operational logs, enforce rate limits, and establish or defend legal claims. We limit this processing to what is necessary for those aims.

• Consent

  Optional Web Analytics runs only after you accept it. You can reject initially or reopen “Analytics settings” in the footer and withdraw consent just as easily. Withdrawal does not affect earlier lawful processing.

• Legal obligation

  Where applicable, retain the limited transaction records required for tax, accounting, refunds, disputes, or compliance.

We use the following categories of providers to operate VibeSolid. Each receives the information needed for its role; this is not permission to share your information with unrelated business partners.

• Optional identity providers

  When third-party sign-in is enabled and you choose it, that provider processes the sign-in and shares basic identity information with our authentication service. It also processes information under its own privacy policy. This does not give us access to your inbox or files.

• Authentication and database hosting

  Process account credentials, sessions, profiles, progress, checklist, exam and certificate records to provide and secure your account.

• Payment processing

  Checkout, payments, subscriptions, refunds, and the customer billing portal. The payment provider also processes transaction records for its own legal, fraud-prevention and regulatory duties.

• Application hosting and security

  Serve the website and process requests, IP addresses and operational logs for delivery, troubleshooting and abuse prevention.

• Transactional email and support mail hosting

  Deliver account and recovery emails and handle support correspondence, including recipients, message content and delivery status.

• Optional usage analytics

  Receive the limited page and device information described above only after you accept analytics. We do not use advertising or session replay.

• Certificate sharing you choose

  Selecting a social-network sharing action sends the certificate name, issue date, credential ID and public verification URL to that network. Issuing a certificate also makes its verification record public.

Providers may process information outside the UK or EEA. Applicable safeguards may include adequacy decisions and contractual safeguards, such as EU standard contractual clauses with a UK addendum where required. Contact us for the providers relevant to your data, their processing locations and the applicable transfer safeguard. We may also disclose relevant records when required by law or necessary to establish or defend legal claims.

• Account and product data

  Kept while the account exists, then deleted from the live application database through the self-serve deletion control. Temporary provider failures are retried from a restricted deletion queue. User-owned database rows, including the public certificate, cascade from that deletion.

• Deletion recovery and refunds

  A restricted deletion record holds the account identifier, request date and progress so failed deletions can be completed and restored data can be identified. Billing identifiers are cleared when deletion completes; the minimal completed-deletion record is removed after 365 days. Unfinished requests are kept until resolved. Refund references prevent delayed payment events from restoring refunded access; they are removed with the linked account, or after 90 days if not linked to an account. These records are not public.

• Payment records

  Account deletion cancels an active subscription and asks the payment provider to delete the customer object. The payment provider may retain transaction evidence it must keep for legal, tax, fraud, or dispute purposes under its own retention policy.

• Support correspondence

  Kept while needed to resolve your enquiry, handle related refunds or disputes and meet applicable record-keeping duties. You may ask us to delete correspondence that is no longer needed for those purposes.

• Short-lived security data

  Verification challenges expire after their stated short window. Rate limit buckets use windows no longer than 24 hours and expired buckets are removed during subsequent checks.

• Webhook replay ledger

  Signed payment-event IDs and event timing are retained for no more than 90 days, then removed by a daily database job. Webhook processing also performs the same cleanup as a fallback.

• Backups and logs

  Deleted data may remain in access-restricted provider backups or security logs until overwritten under the provider's backup or log lifecycle. It is kept beyond ordinary use, is not restored except for disaster recovery. Restores require a manual deletion-ledger check before the restored application is reopened; backup erasure is not instantaneous. Contact us for the current provider schedule that applies to a specific request.

In your account, you can download a JSON copy of account, gameplay, certificate, and billing-reference data, or verify your email and delete the account.

Depending on the circumstances, you may also request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw analytics consent in the footer. We normally respond within one month. You can complain to your supervisory authority; in the UK this is the Information Commissioner's Office (ICO). Email us for requests the self-serve controls do not cover.

You can object to processing based on our legitimate interests by contacting us. Account details are needed to provide signed-in features; without them you can still browse the public parts of the service.

For password sign-in, “Remember me” stores authentication cookies and a browser preference for 30 days, renewed when the session refreshes. Leaving it unchecked uses browser-session cookies. Some browsers restore these when reopening tabs; sign out on shared devices. These cookie settings do not override session expiry or revocation.

Essential authentication cookies keep you signed in. Theme, relaxation-game progress, some checklist state, and your analytics choice are stored locally in your browser. Optional usage analytics is cookieless but remains off until you accept it. Rejecting analytics is as easy as accepting it and does not change product access.

VibeSolid is not directed at children under 16. Contact us if you believe a child created an account. Material notice changes will be shown here with a revised date and, where required, an additional notice or consent request.