Privacy Policy — VibeSell
Effective as of 28 October 2026
Article 1 – Who processes your data
The VibeSell service (the "Service") is published by AXELERIO, a French simplified joint-stock company (SAS) registered with the Ajaccio Trade and Companies Register under number 827 574 930, whose registered office is located at M3E, 4 avenue du Mont Thabor, 20090 Ajaccio, France ("VibeSell" or "we"). VibeSell is the controller of the processing it carries out on its own behalf, described in Articles 3 to 8, in accordance with Regulation (EU) 2016/679 (the "GDPR") and Law No. 78-17 of 6 January 1978 ("Informatique et Libertés").
Contact: vibesellit@gmail.com or by post to the registered office. VibeSell has not appointed a data protection officer.
Article 2 – Data subjects
This policy concerns:
- visitors to vibesell.it and docs.vibesell.it;
- customers of the Service and their users, including when they use an MCP-compatible assistant.
The data of the recipients of campaigns sent by our customers (the "Prospects") is processed on behalf of those customers, with VibeSell acting as processor. Article 9 is devoted to them.
Article 3 – Data, purposes, legal bases and retention periods
The data comes from you, from your use of the Service or from our payment provider. We collect only what we need for the purposes below.
| Purpose | Data | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|---|
| Account and provision of the Service | Email address, hashed password or Google identifier, language, sign-up source (UTM); workspace content (offer, website analysed, target, sequences, campaigns, replies) | Contract | Lifetime of the account; deletion within 30 days upon request, otherwise no later than 12 months after the subscription ends |
| Payment and invoicing | Name, company, billing address, payment history and payment incidents (bank cards are processed by Stripe only) | Contract; legal obligation | 10 years (Article L. 123-22 of the French Commercial Code) |
| Connection from an MCP assistant | Connected application, access tokens, permissions, log of requested actions | Contract | Until revoked; log: lifetime of the account |
| Support | Messages exchanged through the in-app messaging or by email | Contract | Lifetime of the account |
| Service and onboarding emails | Email address, language, progress in the Service | Legitimate interest (supporting you); unsubscribe option in every email | Lifetime of the account |
| Security and abuse prevention | Sessions, anonymous visits, technical campaign metrics (bounces, complaints, unsubscribes) | Legitimate interest (security, reputation of the sending domains, protection of recipients) | Sessions: 30 days after expiry; anonymous visits: 7 days |
| Audience measurement, session recording, advertising measurement | Browsing and usage data, tracker identifiers | Consent | See the Cookie Policy |
| Defence of our rights | Data relevant to the dispute | Legitimate interest | Limitation period |
No decision producing legal effects concerning you or similarly significantly affecting you is based solely on automated processing (Art. 22 GDPR).
Article 4 – Recipients
Your data is accessible only to authorised members of the team and to the service providers listed below, who act on our instructions. We do not sell or rent your data.
| Service provider | Role | Data location |
|---|---|---|
| Google Cloud (Cloud Run, Memorystore) | Hosting of the application and API | Netherlands |
| Neon (on Amazon Web Services) | Database | United States |
| Firebase Hosting (Google) | Hosting of the website | Global network |
| Stripe | Payment and invoicing | European Union and United States |
| Instantly (Foo Monk LLC) | Prospect search, sending domains and mailboxes, sending and warm-up | United States |
| Microsoft (Azure OpenAI) | Conversational agent | United States |
| Google (Gemini) | Fallback conversational agent | United States |
| Resend | Service emails | United States |
| PostHog | Audience measurement, session recording | United States |
| Google (Google Identity) | Sign-in with a Google account | United States |
Data may also be disclosed to competent authorities upon lawful request, and to the purchaser of all or part of the business.
Article 5 – Transfers outside the European Union
Several service providers process data in the United States (Article 4), including Neon, which hosts the database, and Instantly. These transfers are based on the European Commission's adequacy decision on the EU–US Data Privacy Framework where the provider has adhered to it and, failing that, on the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), to which Instantly's data processing agreement in particular refers. A copy of the safeguards may be obtained on request.
Article 6 – Artificial intelligence
The assistant in the application is an artificial intelligence agent, and the first replies from support are produced by such an agent (Microsoft's Azure OpenAI and, as a fallback, Google's Gemini). They process the information you provide (offer, target, content of your website) to propose a strategy and draft emails, which you approve before anything is sent. A member of the team takes over where necessary. We select offerings whose terms exclude the use of your data to train the models.
If you connect the Service to a third-party assistant, the information sent to it at your request is processed by its publisher, in accordance with its own policy.
Article 7 – Cookies
Some trackers are set only with your consent. The list of trackers and how to manage your choices are set out in the Cookie Policy (vibesell.it/legal/en/cookie-policy).
Article 8 – Security
We apply measures appropriate to the risks: encryption of communications, access restricted to authorised persons, separation of workspaces, third-party connections through OAuth with revocable permissions. In the event of a data breach, we make the notifications required by Articles 33 and 34 of the GDPR.
Article 9 – You have received an email sent through VibeSell
Controller: the company that wrote to you, identified in the message. It chooses the recipients and the content. VibeSell acts on its behalf.
Data: last name, first name, job title, company, business email address, LinkedIn profile URL, exchanges following the email.
Source: business contact databases of Instantly (Foo Monk LLC, United States), imported for that company and not reused for other customers.
Purpose and legal basis: presenting you with an offer related to your professional activity, based on the legitimate interest of the sending company.
Retention period: deletion from Instantly's systems fourteen (14) days after the end of the campaign; in the sending company's workspace, no later than twelve (12) months after the end of its subscription.
To stop being contacted, simply reply to the email: a refusal stops the sequence and excludes you from that company's later campaigns. Your other rights are exercised with that company; if you write to vibesellit@gmail.com, we forward your request to it.
Article 10 – Your rights
You have the rights of access, rectification, erasure, restriction, objection (in particular, at any time, to direct marketing and to processing based on legitimate interest), portability and withdrawal of consent, and the right to give instructions on what happens to your data after your death.
Write to vibesellit@gmail.com or to the registered office. We respond within one (1) month, a period that may be extended by two (2) months for complex or numerous requests. Proof of identity may be requested where there is reasonable doubt.
You may lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr) or with the data protection authority of your country of residence. If you reside outside the European Union, you also have the rights provided by your local law.
Article 11 – Updates
We may amend this policy, in particular to reflect changes to the Service or to the regulations. The version date appears at the top. Customers are informed by email of any material change before it takes effect.