Privacy Policy

Vibe Sender is a customer messaging and sales platform available at vibesender.io and app.vibesender.io. It is operated by JPL DIGITAL LTDA, a company registered in Brazil under CNPJ 44.004.861/0001-13 ("JPL Digital", "we", "us"). This policy explains what personal data we handle, why, with whom we share it and what rights you have. It follows the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and, for users in the European Economic Area, the GDPR.

1. Who is responsible for the data

• Our customers' own data (account, billing, usage) and data of visitors to our website: JPL Digital is the controller.
• Data of our customers' contacts (the people a business talks to through Vibe Sender on WhatsApp, Instagram or email): the business is the controller and JPL Digital acts as processor (operador), handling that data only on the business's instructions and to provide the service.

2. Data we collect

• Account data: name, email, company name and a hashed password, or your Google account email and name if you sign in with Google.
• Billing data: billing name and address, tax or VAT number, plan, invoices and payment status. Card details are collected and stored by Stripe; we never see or store full card numbers.
• Connected channels (only with your explicit authorization on Meta's and Instagram's consent screens):
  • WhatsApp: access token, WhatsApp Business Account ID, phone number ID and business ID.
  • Instagram: access token, account ID, username and profile picture; messages sent to the account and comments on the account's own posts.
  • Email: the sending domain and its DNS records, and emails forwarded to Vibe Sender by the business.
  Access tokens are stored encrypted at rest (AES-256-GCM).
• Conversation and CRM data: contact names, phone numbers, Instagram usernames, email addresses, job titles, messages, media, notes, deals and tags that the business sends, receives, imports or creates in the product.
• Ad attribution data: when a contact starts a conversation from a Click-to-WhatsApp or Instagram ad, the ad identifiers and the click ID (ctwa_clid) that Meta includes in the message.
• Usage and security data: IP address, browser, sign-in times and an audit log of important actions in the account.
• Website measurement data, only if you accept cookies: pages visited on our website and sign-up pages, the Meta and Google cookie identifiers (_fbp, _fbc, _ga), and, when you create an account, a hashed (SHA-256) copy of your email, your IP address and browser, to measure which of our ads bring customers.
• Cookies (see section 8).

3. Why we use it and legal bases

• To provide the service you contracted (performance of contract): sending and receiving messages on your behalf, CRM, automations, broadcasts, reports and support.
• Billing and tax obligations (contract and legal obligation).
• Security, fraud prevention and service improvement (legitimate interest), including aggregated product measurement on our website.
• Measuring and improving our own advertising (consent): Google Analytics, Google Tag Manager and the Meta Pixel on our website and sign-up pages, and conversion events (sign-up, trial start, payment) sent from our servers to Meta and Google. This only happens if you click Accept in the cookie notice, and you can withdraw consent at any time.
• Optional features you turn on, such as the AI agent or sending sales back to Meta: on your instruction as the business.

We do not sell personal data, and we do not use your contacts' data for our own marketing.

4. Who we share data with

Only with service providers needed to run Vibe Sender, each bound to protect the data:

• Meta Platforms: WhatsApp Cloud API, Instagram API and Embedded Signup, to deliver your messages. If you enable Send sales back to Meta, we send the Conversions API a Purchase event with the value, the currency, your WhatsApp Business Account ID and the ad click ID. No names, phone numbers or message content are sent. Separately, and only with your consent in the cookie notice, the Meta Pixel on our website and the Conversions API measure our own ads: we send Meta the sign-up, trial start and payment events of your account, with a hashed (SHA-256) copy of your email, your IP address, browser and the Meta cookie identifiers.
• Stripe: subscription payments and invoices.
• OpenAI: only when the business turns on AI features. The conversation text, and audio for transcription, are processed to generate replies. OpenAI does not use API data to train its models.
• Resend: sending and receiving email.
• Google: sign-in with Google, when you choose it; and, only with your consent, Google Analytics and Google Tag Manager for website measurement, including sign-up, trial and payment events sent from our servers (Measurement Protocol) with the Analytics cookie identifier and a pseudonymous account ID.
• Cloudflare: DNS, email routing and bot protection on sign-in and sign-up.
• DigitalOcean: hosting of our servers and database.

We may also disclose data when required by law or by a competent authority.

5. International transfers

Some of these providers process data outside Brazil and the European Economic Area, including in the United States. We rely on the safeguards allowed by the LGPD and the GDPR, such as the providers' standard contractual clauses.

6. Meta platform data

Data received from Meta (tokens, account identifiers, messages and comments) is used only to provide the features the business uses in Vibe Sender. It is stored encrypted where applicable and is not sold or used for advertising. You can revoke our access at any time: in Meta Business Suite → Settings → Integrations for WhatsApp, and in the Instagram app under Settings → Website permissions → Apps and websites for Instagram.

7. Retention and deletion

We keep data while the account is active. Raw webhook records are deleted after 14 days. Billing and tax records are kept for the period required by law (5 years in Brazil).

Data deletion: you may request deletion of your account and all associated data (credentials, contacts, conversations, logs) at any time by emailing contact@vibesender.io with the subject "Delete my data". Deletion is completed within 30 days and is irreversible, except for records we must keep by law. Contacts, lists and connected accounts can also be removed inside the product at any time.

8. Cookies

Essential first-party cookies are always used. Analytics and advertising cookies from Google and Meta are used only if you click Accept in the cookie notice; if you click Decline, they are not loaded. You can change your choice at any time with the Cookies link in the footer of our website. The product dashboard itself (after you sign in) does not load any analytics or advertising tools.

Always used (essential):

• bws_session: keeps you signed in to the app (essential).
• vs_lang, vs_moeda: remember your language and currency.
• vs_ref: remembers a referral link you arrived from, for 90 days.
• vs_ab: keeps the same version of our website for you, for aggregated measurement of which version works better.
• vs_cookies, vs_consent: remember that you have seen the cookie notice and your choice.

Only with your consent (analytics and advertising):

• _ga, _ga_* (Google Analytics): distinguish visitors and sessions, up to 2 years.
• _fbp, _fbc (Meta Pixel): identify the browser and the ad click that brought you, up to 90 days.
• Google Tag Manager may load other measurement tags covered by this same consent.

Cloudflare's bot protection may set its own strictly necessary cookie on the sign-in and sign-up pages. You can delete or block cookies in your browser settings; the app will not work without the session cookie.

9. Security

All traffic is encrypted with HTTPS/TLS. Access tokens and integration credentials are encrypted at rest. Every company only sees its own data, and access to production systems is restricted.

10. Your rights

Under the LGPD and the GDPR you may confirm whether we process your data and access it, correct it, delete it, receive it in a portable format, object to or restrict its processing, and withdraw consent where processing is based on consent. Email contact@vibesender.io; we reply within 15 days. You may also complain to the Brazilian data protection authority (ANPD) or to the authority of your country. If you are a contact of one of our customers, we will forward your request to that business, which is the controller of your data.

11. Customers' responsibilities

Businesses using Vibe Sender are responsible for having a lawful basis to message their contacts, for honoring opt-out requests, and for complying with the WhatsApp Business Messaging Policy, Instagram's policies, anti-spam laws and data protection law.

12. Children

Vibe Sender is a business tool and is not intended for people under 18.

13. Changes and contact

We may update this policy; the date above always shows the current version. Controller and data protection officer (encarregado): JPL DIGITAL LTDA, CNPJ 44.004.861/0001-13, contact@vibesender.io.