1. Overview
Vibestreet Pty Ltd (ABN 52 681 839 029) (“we”, “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and disclose your personal information in accordance with the Privacy Act 1988 (Cth) and the General Data Protection Regulation (GDPR).
2. Information We Collect
2.1 Information You Provide
- Account: name, email, password hash
- Creator KYC: professional credentials, verification documents
- Payment: handled by Stripe (we never store card data)
- Communications: support requests, feedback
2.2 Information Collected Automatically
- Usage data: pages visited, skills installed, API calls
- Device data: IP address, browser type, operating system
- Cookies: see our Cookie Policy
3. How We Use Your Information
- Provide and maintain the Service
- Process transactions and payouts
- Verify creator credentials (KYC/KYB)
- Detect and prevent fraud, abuse, and security incidents
- Send service updates and (with consent) marketing communications
- Comply with legal obligations
4. Legal Basis for Processing (GDPR)
- Performance of contract: Account creation, transactions
- Legal obligation: KYC/AML compliance, tax records
- Consent: Marketing, analytics, non-essential cookies
- Legitimate interests: Security, fraud prevention
5. Data Sharing
We share data with: Stripe (payments), Supabase (database), Cloudflare (CDN/storage), Upstash (Redis), and Meilisearch (search). Sub-processor DPAs are available on request.
6. Data Retention
Account data: retained while your account is active. Transaction records: 7 years (tax compliance). Audit logs: 7 years. Analytics: 24 months. You may request deletion at any time (subject to legal retention requirements).
7. Your Rights
- Access: Request a copy of your data (Art. 15 GDPR)
- Rectification: Correct inaccurate data (Art. 16)
- Erasure: Request deletion (Art. 17) — “right to be forgotten”
- Portability: Export your data (Art. 20)
- Objection: Object to processing (Art. 21)
- Withdraw consent: At any time via Settings → Consent
8. Data Residency
User data is stored in accordance with our Data Residency policy. Cross-region access is logged and auditable. See our Data Processing Agreement for details.
9. Security
We implement Ed25519 signing, TLS encryption, PCI-DSS SAQ-A compliance, Row Level Security (PostgreSQL), and automated anomaly detection.
10. International Transfers
Data may be transferred outside your country of residence. We rely on Standard Contractual Clauses (SCCs) and adequacy decisions for such transfers.
11. Contact
Privacy enquiries: privacy@vibestreet.dev. Data Protection Officer: dpo@vibestreet.dev