Privacy Policy
Last updated: 10/31/2026
Introduction
Vibe Flow ("we", "our", "us") operates the website at vibeflow.tech. This Privacy Policy explains how we collect, store, use, and protect your personal data when you use our services. We are based in Bangladesh and comply with applicable data protection laws. By using Vibe Flow, you agree to the practices described in this policy.
What data we collect
We collect only the data necessary to provide our service:
- Name and email address — when you submit a project request, sign up for an account, or use the contact form.
- Project details — service category, subcategory, description, and budget range you provide in your request.
- Account credentials — if you register, we store your email and a securely hashed password via Supabase Auth.
- Contact messages — when you use the contact form, we store your name, email, subject, and message.
- Usage data — anonymised page view counts for aggregate analytics. No personal identifiers are tracked.
How we collect your data
You provide data directly by filling in forms on our website (project request form, sign-up form, contact form). Usage analytics are collected automatically through our self-hosted tracking system — no third-party analytics scripts are used.
How we use your data
Your data is used exclusively to:
- Respond to your project requests and inquiries.
- Manage your account and provide access to authenticated features (dashboard, AI tools).
- Improve our services based on aggregate usage patterns.
- Communicate with you about your requests or account (we do not send marketing emails).
Data sharing
We do not sell, rent, or trade your personal data. We share data only with trusted service providers who enable our core operations:
- Supabase — database hosting, authentication, and file storage. Data is stored on Supabase servers. See Supabase Privacy Policy.
- Vercel — hosting provider for the website. See Vercel Privacy Policy.
Data retention
We retain your personal data for as long as your account is active or as needed to provide our service. Project request records are kept for reference. If you delete your account, associated data is removed within 30 days. Contact form messages are retained until you request deletion.
- Session cookie — required to keep you logged in (expires on browser close).
- CSRF token — prevents cross-site request forgery attacks.
- No third-party tracking, advertising, or analytics cookies are used.
- You can disable cookies in your browser settings, but some features may not work correctly.
Your rights
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of your data (subject to legal obligations).
- Export your data in a portable format.
- Withdraw consent for data processing where applicable.
To exercise any of these rights, email atikrj8@gmail.com. We will respond within 30 days.
Security
We implement industry-standard security measures including encryption in transit (TLS), hashed password storage via Supabase Auth, and regular security reviews. However, no online service can guarantee absolute security.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified via a notice on our website or by email. Continued use after changes constitutes acceptance of the updated policy.