Privacy Policy

1. Who we are

JustVybe ("we", "us", "our") is a UK-based social platform operated by [YOUR COMPANY NAME], registered in England and Wales (Company No. [COMPANY NUMBER]). Our registered address is [REGISTERED ADDRESS].

We are the data controller for the personal data you provide to us. This means we decide how and why your data is processed. For privacy-related questions, contact us at privacy@justvybe.space.

This policy applies to all users of JustVybe, wherever you are located. It covers data processed under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the EU GDPR (for users in the European Economic Area), and applicable US privacy laws including the California Consumer Privacy Act (CCPA/CPRA).

2. What data we collect

We collect the following categories of personal data:

Account and identity data

• Username, display name, email address, hashed password, date of registration.
• Email verification status; password reset tokens (stored as one-way hashes, expire in 1 hour).

Profile data (provided voluntarily)

• Avatar image, cover photo, biography, occupation, social media links.
• Phone number, home postcode, full home address (address lines, city, county).
• Approximate location (latitude/longitude derived from your postcode — used to show nearby content).
• Booking contact email, artist genres.

Content you create

• Vibes (events/posts), comments, direct messages, group posts, reviews.
• Property, job, car, room, classified, and service listings.
• Uploaded images and videos.

Activity and usage data

• Pages visited, features used, search queries, listing views.
• IP address, browser type, device type, operating system, and referrer URL (collected on each request).
• Session activity timestamps; login history (IP address, user agent, last active).

Transaction and subscription data

• Subscription plan, billing period, subscription status, renewal dates.
• Stripe customer ID and subscription ID (we do not store card numbers — these are held by Stripe).
• Order history and line items for purchases made through the platform.

Communications

• Direct messages sent between users.
• Quote requests and enquiry messages sent to businesses or service providers.
• Support tickets and correspondence with us.

Referral and affiliate data

• If you arrive via an affiliate referral link, we record the referral code (stored in a cookie, jv_ref, for 30 days) to attribute any resulting subscription to the affiliate.
• If you are an affiliate, we store your referral code, earnings, and payout history.

Business claim verification documents

If you choose the document upload method when claiming a business listing, you upload a proof-of-ownership document (for example a Companies House letter, utility bill, or official correspondence).

• Your document is stored in a private, non-public area of our servers and is only accessible to JustVybe staff for the purpose of verifying your claim.
• We accept JPEG, PNG, and PDF files up to 10 MB. We record the file name, MIME type, file size, and a SHA-256 checksum for integrity purposes.
• Once a decision is made on your claim — whether approved or rejected — your document is permanently deleted from our servers.
• We do not share your document with the business, other users, or any third party.
• The legal basis for processing this document is legitimate interests (verifying ownership of business listings to maintain platform integrity).

3. How we use your data

We do not use your data for automated individual decision-making or profiling that produces legal or similarly significant effects.

We do not send marketing emails. All emails from JustVybe are transactional or notification-based, and most can be turned off in Settings → Notifications.

4. Cookies

We use cookies to keep you logged in, protect forms from CSRF attacks, store your cookie preference, and (with your consent) collect anonymised analytics. Please see our Cookie Policy for a full list of cookies and how to manage your preferences.

5. Who we share your data with

We do not sell your personal data. We do not share your personal data with advertisers or data brokers. We share data only in the following circumstances:

• Stripe — payment processing and subscription management. Stripe acts as a data processor on our behalf and is certified to PCI DSS standards. See Stripe's Privacy Policy.
• postcodes.io — postcode-to-coordinates conversion. We send postcode data to this service; no other personal data is transmitted.
• Our hosting provider — servers are located in the UK or EEA. As a data processor, our host only processes data on our instructions.
• Email delivery provider — transactional emails (password resets, notifications) are delivered via our email service provider, which acts as a data processor.
• Law enforcement and regulators — where required by law, court order, or to protect the safety of users or the public.
• Other users — your public profile information (username, display name, avatar, bio, public posts) is visible to other users of the platform. Direct messages are visible only to the recipient. Listing details are publicly visible.

6. International data transfers

Our primary servers are located in the UK or EEA. Where we transfer personal data to third-party processors outside the UK/EEA (for example, if Stripe processes data in the US), we ensure appropriate safeguards are in place — such as the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), or transfers to countries with an adequacy decision.

The UK has an adequacy decision for transfers to the EEA, meaning UK-to-EEA transfers do not require additional safeguards. If you are in the EEA, your data may be transferred to and processed in the UK under the EU's adequacy decision for the UK.

7. How long we keep your data

• Account data — retained for as long as your account is active.
• On account deletion — your personal data (profile, posts, messages, images) is hard-deleted within 30 days, subject to the exceptions below.
• Financial records — transaction history and billing records are retained for 7 years to comply with HMRC requirements, even after account deletion. These records are held securely and not used for any other purpose.
• Support tickets and legal correspondence — retained for up to 3 years.
• Security logs (IP addresses, session records) — retained for up to 90 days for fraud detection and security purposes.
• Aggregated, anonymised analytics data — retained indefinitely as it cannot identify individuals.

8. Your rights (UK and EU)

Under UK GDPR and EU GDPR you have the following rights:

• Right of access — download a copy of your data from Settings → Export my data.
• Right to rectification — update your data at any time in Settings.
• Right to erasure — delete your account from Settings → Delete account, or contact us to request deletion of specific data.
• Right to restrict processing — contact us to request that we pause processing of your data in certain circumstances.
• Right to data portability — your data export is provided in JSON format.
• Right to object — you can object to processing based on legitimate interests by contacting us. You can also opt out of most notifications in Settings.
• Rights related to automated decision-making — we do not use automated decision-making that produces legal or similarly significant effects.

To exercise any right, contact us at privacy@justvybe.space. We will respond within one month. In complex cases we may extend this by a further two months, with notice.

You also have the right to lodge a complaint with a supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk or 0303 123 1113.
• EU: Your national data protection authority (find yours at edpb.europa.eu).

9. California residents (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to know — the categories and specific pieces of personal information we have collected about you, and the purposes for which it is used. See Sections 2 and 3 of this policy.
• Right to delete — request deletion of your personal information. You can do this from Settings or by emailing privacy@justvybe.space.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share your personal information with third parties for cross-context behavioural advertising. No opt-out link is required, but you may contact us to confirm this.
• Right to limit use of sensitive personal information — we do not use sensitive personal information (such as precise geolocation) beyond what is necessary to provide the service.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise your California rights, email privacy@justvybe.space with "California Privacy Request" in the subject line. We will verify your identity before processing your request and respond within 45 days (extendable by a further 45 days with notice).

Categories of personal information collected (CCPA categories):

• Identifiers (name, username, email, IP address)
• Commercial information (purchase history, subscription status)
• Internet or other electronic network activity (usage data, search queries)
• Geolocation data (derived from postcode, not precise GPS)
• Inferences drawn from the above (to personalise local content)

We do not collect biometric, health, financial account, or precise GPS location data.

10. Security

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit.
• Bcrypt password hashing (cost factor 12).
• CSRF token protection on all state-changing requests.
• Rate limiting on authentication and sensitive endpoints.
• Server-side session management with IP and user-agent tracking.
• No storage of payment card details (delegated entirely to Stripe).

No method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security, but we will notify you and relevant authorities of any personal data breach in accordance with our legal obligations (within 72 hours to the ICO where required).

11. Children

JustVybe is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@justvybe.space immediately and we will delete that information.

Users aged 13–17 should review this policy with a parent or guardian. We apply additional care when processing data that may relate to minors.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via the platform or by email at least 14 days before the changes take effect. Continued use of JustVybe after changes take effect constitutes acceptance of the revised policy. The "last updated" date at the top of this page reflects the most recent revision.

13. Contact us

For any privacy-related enquiries:

• Email: privacy@justvybe.space
• Post: [REGISTERED ADDRESS]