PRIVACY_POLICY

1. INTRODUCTION

This Privacy Policy explains how Vibetron ("we," "our," or "us") collects, uses, and protects personal data when you use our website and application at vibetron.ai and our API at api.vibetron.ai (collectively, the "Service").

We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and Italian data protection laws.

Vibetron plays two distinct roles. For the data that describes you as a user of the Service (your account, your sessions, your usage), we are the data controller: Sections 2 to 14 of this Policy apply. For the data you put into the Service (the content of your trons, your conversations with them, their memories and files) and for the personal data of other people that your trons receive (for example, someone who writes to a bot you connected to Telegram), you are the controller and we are your processor: the Data Processing Agreement (DPA) applies, and Section 3.4 of this Policy explains the boundary.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.

2. DATA CONTROLLER

The data controller responsible for your personal data is:

[COMPANY NAME] [REGISTERED ADDRESS] [VAT NUMBER / CODICE FISCALE] Italy

Contact for privacy matters:

• Email: [email protected]
• Postal address: [SAME AS ABOVE]

We have not appointed a Data Protection Officer (DPO) as we are not required to do so under Article 37 GDPR. If this changes, we will update this section.

3. WHAT PERSONAL DATA WE COLLECT

We collect and process the following categories of personal data:

3.1 Data you provide directly

• Email address — required to create an account and receive one-time login codes
• Nickname (optional) — display name shown in the Service
• Content you create — including AI agent configurations ("trons"), system prompts, skill code, manifest files, schedules, and other inputs you provide while using the Service
• API keys you provide — third-party API keys you supply to power your AI agents. They can live in three places: your personal vault, the shared vault of an organization you belong to, or written directly into an agent by you. They are stored encrypted and used only to make the calls your agents ask for. Vibetron never calls an AI model with a key of its own: every call is made with a key that belongs to a user or to an organization.
• Organization data — if you create or join an organization: its name and logo, your role in it, and the trons it hands to you

3.2 Data collected automatically

• IP address — captured by our reverse proxy and application logs for security, rate limiting, and abuse prevention
• Browser metadata — User-Agent string, browser language
• Usage data — timestamps of API requests, request paths, response status codes, a request identifier
• Session data — hashes of your session tokens and their last-used timestamps
• Model usage records — for every call your trons make to an AI model, one accounting row: when it happened, which tron and agent made it (their ids and the names you gave them, cut to 64 characters), who started it or on whose behalf it ran, the provider and model, the token counts, the cost from the price list, and which of your keys paid (its id and whether it came from your vault or an organization's). It never contains the text of your messages, prompts or answers, file names, email addresses or session titles. It powers the usage pages and the monthly budget, and survives the deletion of a tron so that a cost already incurred keeps its name.
• Activity records — events describing what happened in your account (a tron deployed, a key created, a member added), with ids and short labels, never message text

3.3 Data NOT collected

We do not collect:

• Tracking cookies for advertising purposes
• Cross-site behavioral data
• Real names, postal addresses, or phone numbers (unless you voluntarily include them in your tron content)
• Payment information at this stage (a payment processor will be used in the future and disclosed separately)

3.4 Data you process with Vibetron

Your trons receive and produce data: the messages you exchange with them in the Service, the messages other people send them through channels you connect (Telegram, Discord, the Tron API), the files they read and write, and the memories they keep. We store this data for you (conversations encrypted in the database; memories and files on disk in the tron's own folder) and we transmit it to the AI model providers you chose so that your agents can run. For this data you are the data controller (alone, or your organization is), and we act only on your instructions as your processor under Article 28 GDPR. The terms of that relationship are in our Data Processing Agreement. You are responsible for having a lawful basis to process the personal data of the people who interact with your trons, and for informing them.

4. LEGAL BASIS FOR PROCESSING

Under Article 6 GDPR, we process your personal data on the following legal bases:

You have the right to object to processing based on legitimate interest. See Section 8.

5. HOW WE PROTECT YOUR DATA

We implement technical and organizational measures appropriate to the risks, including:

• Encryption at rest — your email address and nickname, the content of your trons, your conversations with them, the keys in every vault and your agents' inline keys are encrypted in the database with AES-256-GCM, using keys derived via HKDF-SHA256 from a master key stored separately from the database. Not encrypted at the application level: the memories and files your agents keep on disk in the tron's own folder (protected by filesystem permissions and container isolation), the one-time login codes (which hold the email they were sent to for ten minutes), invitation notes, skill code you publish, and the usage and activity records described in Section 3.2.
• Blind index for lookup — emails are looked up via HMAC-SHA256 hashes, never plaintext
• Encryption in transit — all communications with the Service use HTTPS; connections to AI providers are made over HTTPS from our server
• Privacy proxy (optional) — personal data the gateway recognises is replaced with placeholders before an AI provider sees it, and images can be redacted by a service you host (Section 6.3-bis)
• Keys never enter the agent's container — since October 2026, AI model calls leave from a gateway in our API: the container holds a per-agent token, and the real provider key is read from the vault only for the duration of the call
• Network security — the API domain is proxied through Cloudflare (DDoS protection, WAF, bot mitigation); the application domain is served directly by our origin server
• Container isolation — each tron runs in its own Docker container with stripped Linux capabilities, resource limits, and no access to our private networks
• Access control — administrative access to the server uses public-key SSH authentication; no password authentication is allowed. Operator access to the Service is by role and recorded
• Per-user data isolation — every database query and filesystem operation is scoped to the authenticated user or organization
• Non-rewritable accounting — model usage records can be corrected only by adding a correction row, never by editing or deleting; the only change allowed is clearing the fields that name a person when an account or organization is deleted

We keep backups of the database and apply security patches regularly. Despite these measures, no method of transmission or storage is 100% secure. We will notify you of any data breach affecting your personal data as described in Section 12.

6. WHERE YOUR DATA IS STORED AND PROCESSED

6.1 Primary storage

Your data is stored on a server located in Falkenstein, Germany (Hetzner Online GmbH), inside the European Union/European Economic Area (EU/EEA). Backup copies made before each change to the database structure are kept by the operator in Italy.

6.2 Sub-processors

We use the following service providers (sub-processors) to operate the Service. The authoritative, dated list is kept at /subprocessors; we give organizations 30 days' notice before adding one.

6.3 AI model providers, and how your data reaches them

When one of your agents needs an AI model, the call is made by Vibetron, from our server, through a gateway in our API. The gateway:

• sends your agent's prompt (which may include your messages, your files and memories, and messages from the people talking to your bot) to the provider you chose for that agent, with the key you supplied
• reads the provider's answer in transit, in order to count the tokens and compute the cost; it does not store the text of the prompt or of the answer
• writes one usage record per call (Section 3.2)

We never substitute a key of our own: the key is always yours, or your organization's. The contract that governs what the provider does with your data is therefore your contract with that provider, and the provider is your processor, not ours. We transmit on your instruction, as your processor (see the DPA). You should review the privacy terms and the data-use settings of each provider you connect.

The providers an agent can be pointed at, with the country where each endpoint is operated and the legal entity behind it, are listed live below. Several are outside the EU/EEA, including endpoints operated from the United States, Singapore and mainland China; by choosing an endpoint you choose where that agent's data goes.

Loading the list of AI model providers…

A local model is a server you run yourself: the gateway sends the call to the address you configured, provided it is publicly reachable.

6.3-bis The privacy proxy

You (or your organization) can switch on a privacy proxy for a tron. With it on, the gateway replaces personal data it can recognise with deterministic rules — email addresses, phone numbers, IBANs, Italian tax codes and VAT numbers, payment card numbers, IP addresses, and the names you declare — with placeholders such as [EMAIL_1] before the call reaches the provider, and puts the real values back in the answer before your agents see it. The link between a placeholder and its value is kept encrypted, per chat session, and is deleted with the session. Images can be sent first to an image redaction service that you host (faces, text, licence plates, declared names); Vibetron does not see what that service does and does not store the images.

The proxy reduces the risk; it does not anonymise. Pseudonymised data is still personal data under the GDPR. Names you do not declare, personal data in a form the rules do not recognise, and the text of documents indexed in a library without the proxy reach the provider of the model or of the embeddings. Without an image redaction service, images pass unchanged. The usage record of each call says how many values were replaced and how many images were redacted or not.

6.4 Other services you connect

If you connect a tron to Telegram or Discord, messages are exchanged with those platforms through the bot account you created with them, under your agreement with them. If you attach a Model Context Protocol (MCP) server or install a plugin that calls an external service, your agent sends data to that service under your instructions. These are your providers, chosen and configured by you.

6.5 International transfers

Our own sub-processors (Section 6.2) are in the EU or transfer under the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

For AI model providers and other services you connect (Sections 6.3 and 6.4), the transfer is made by us on your instruction, to a recipient you chose. Where the recipient is outside the EU/EEA, the transfer tool (adequacy decision, Data Privacy Framework, Standard Contractual Clauses) is the one in your agreement with that recipient; for endpoints in countries with no adequacy decision, such as mainland China, you are responsible for the transfer impact assessment that the Standard Contractual Clauses require.

7. HOW LONG WE KEEP YOUR DATA

When you delete your account, your account row, your personal trons and everything attached to them are removed from the active database in one transaction, then their containers and folders are removed. Trons you built for an organization belong to the organization and are not touched. Usage records that named you are anonymized in the same transaction (amounts stay, for accounting; the fields that name you are cleared); activity records follow their 7-day retention. Backups containing your data are deleted when the backup is deleted.

When the owner deletes an organization, its trons (including the copies its members worked on, which are encrypted with the organization's key), libraries, shared keys, invitations and activity log are deleted; every member keeps their account and personal trons and returns to the personal plan they had before joining, or to Free, and is told by email. Nobody is added to an organization without accepting an invitation, and the personal trons of somebody who joins stay theirs.

8. YOUR RIGHTS UNDER THE GDPR

You have the following rights regarding your personal data:

8.1 Right of access (Art. 15)

You can request a copy of all personal data we hold about you. The Service provides a self-service export at any time (Settings → Your data → Export everything, or GET /users/me/export).

8.2 Right to rectification (Art. 16)

You can update your nickname and settings at any time through the Service. For data you cannot edit yourself (e.g., email), contact us.

8.3 Right to erasure / "right to be forgotten" (Art. 17)

You can delete your account at any time through the Service, with the effects described in Section 7. If your account belongs to an organization, deletion goes through the organization's administrator or through us, because deleting it would remove trons and keys that belong to the organization.

8.4 Right to data portability (Art. 20)

You can export your data at any time (Settings → Your data → Export everything): one zip file with your account data in JSON, every personal tron as a complete package (its document with agent memories, its workspace files and its library documents), your own libraries, your tron builder conversations, the names of your references (never their values), your usage records as CSV, and a manifest with a SHA-256 fingerprint of every file. A plain JSON export is also available. Trons that belong to an organization are the organization's and are exported by it.

8.5 Right to restrict processing (Art. 18)

You can request that we limit the processing of your data in certain circumstances.

8.6 Right to object (Art. 21)

You can object to processing based on legitimate interest. We will stop unless we have compelling legitimate grounds.

8.7 Right to withdraw consent

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

8.8 Right to lodge a complaint (Art. 77)

You can file a complaint with the supervisory authority. In Italy, this is:

Garante per la Protezione dei Dati Personali Piazza di Monte Citorio, 121 00186 Roma, Italy Website: https://www.garanteprivacy.it Email: [email protected]

8.9 How to exercise your rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request to protect your data from unauthorized access.

9. COOKIES AND LOCAL STORAGE

The Service uses localStorage to store your authentication token (vibetron_token) and basic user info (vibetron_user) so you stay logged in between sessions. This is essential for the Service to function and does not require consent under Article 5(3) of the ePrivacy Directive.

We do not use:

• Tracking cookies
• Advertising cookies
• Analytics cookies that identify individual users
• Third-party scripts or fonts loaded from third-party servers

If we add any non-essential cookies in the future, we will request your consent through a clear cookie banner.

10. CHILDREN

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us so we can delete it.

11. AUTOMATED DECISION-MAKING AND PROFILING

We do not make decisions affecting you based solely on automated processing or profiling, as defined in Article 22 GDPR.

The AI agents you create may process inputs and produce outputs autonomously, but this is performed under your control and configuration, and the results are addressed to you, not used to make decisions about you.

11-BIS. ARTIFICIAL INTELLIGENCE TRANSPARENCY

Vibetron's chat screens tell the people using them that they are talking to an AI system. From 2 December 2026 (Article 50 of Regulation (EU) 2024/1689, the AI Act), for a channel you connect (a messaging app, email, SMS) the Service provides an AI notice at the first conversation and a short AI footer on every reply, that the tron owner enables per channel; the owner is responsible for the Article 50 disclosure towards the people their trons talk to. Results of the Tron API are marked as generated by AI (a generated_by field and an X-Vibetron-Generated-By header), and so are files written by an agent. To know who has already received the notice we keep, per channel, a keyed hash of the chat or sender, never the identifier itself.

12. SECURITY INCIDENT NOTIFICATION

If a personal data breach is likely to result in a risk to your rights and freedoms, we will:

• Notify the supervisory authority (Garante) within 72 hours of becoming aware of it
• Notify you without undue delay through the email address associated with your account
• Provide details of the breach, the likely consequences, and the measures taken

Where we act as your processor, we notify you as set out in the DPA.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we do:

• We will update the "Last updated" date at the top
• For material changes, we will notify you via email or through a prominent notice in the Service before the changes take effect
• Your continued use of the Service after the changes constitutes acceptance of the updated policy

14. CONTACT US

For any privacy-related questions, requests, or complaints:

[COMPANY NAME] [REGISTERED ADDRESS] Email: [email protected]

We aim to respond to all inquiries within 30 days as required by GDPR.

*This document describes the Service as it is built. It should be reviewed by a qualified data protection lawyer before being relied upon for compliance purposes.*