Last updated: 19 sep 2026

1. Who we are

VibeStream is operated by Stephen Turner trading as Vibestream ("we", "us"), the data controller for personal data processed through https://vibestream.stream. Contact: [CONTACT EMAIL].

2. What we collect

• Account data: email address, username, and a unique user ID, when you sign up.
• Content you upload: audio files, titles, artist names, prompt text, genre tags, and your declaration that a track was made using AI tools, and its explicit status.
• Activity data: upvotes, playlists, listening plays (which track you played and when — used for charts and abuse prevention), and stream timestamps used to enforce fair-play limits.
• Payment data: handled entirely by Stripe. We store only your subscription status and Stripe identifiers — never your card details.
• Local storage: your browser stores your session token and some preferences (e.g. logged-out state) locally on your device. We do not use third-party advertising trackers.

3. Why we process it (legal bases)

• To provide the Service you signed up for — accounts, streaming, playlists, charts (contract);
• To process subscriptions (contract);
• To keep the platform fair and secure — detecting chart manipulation, enforcing rate limits, handling takedowns (legitimate interests);
• To send essential service emails such as account confirmation and password resets (contract / legal obligation).

4. Who we share data with

We use a small number of service providers, each processing data only on our instructions:

• Supabase — authentication, database and file storage (EU/US data centres, configurable);
• Stripe — payments and subscription management (Stripe's own privacy policy applies to payment data it holds);
• Resend — delivery of transactional emails;
• Vercel — hosting of the web application;
• Render — automated audio processing (your uploads are transcoded; files are transferred and stored temporarily for this purpose only).

We may also disclose data where required by law or to protect rights and safety. We do not sell personal data, and we do not use your uploads or listening data to train AI models.

5. How long we keep it

Account and activity data are kept while your account is active. Uploaded audio is kept until you delete it, you close your account, or it is removed following a valid takedown. Listening/play records may be retained in aggregate or anonymised form for chart integrity. Backups may persist for a limited period after deletion.

6. Your rights

You have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to the UK Information Commissioner's Office (or your local EU authority). To exercise any right, email privacy@vibestream.stream — we respond within 30 days. Deleting your account removes your personal data and uploads, except where retention is legally required.

7. Children

VibeStream is not intended for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, contact us and we will remove it.

8. Security

We use encrypted connections (HTTPS/TLS), private storage buckets for original uploads, access controls and rate limiting. No service is perfectly secure, but we design to minimise what is collected and exposed.

9. Changes

We will post any changes to this policy on this page with an updated date, and announce significant changes on the Service.

10. Contact

Privacy questions or requests: privacy@vibestream.stream.