Privacy Policy

Vibesites(“we,” “us,” or “our”) respects your privacy. This policy explains what information we collect from and about you, how and why we process it, who we share it with, how long we keep it, and how you can ask us to delete it.

This policy applies to our website at https://vibesites.in, to our products (including RewardLoop), and to the web, app, marketing, and messaging services we deliver for our clients. Vibesites is operated by Aditya Kumar Gupta.

Who this policy covers

We handle personal information in two different roles, and your rights differ slightly depending on which applies:

• As the controller of our own data. When you visit our website, contact us, request a quote, or engage us for a project, we decide how your information is used, and this policy governs it in full.
• As a service provider to a business client.When we operate a product, a messaging channel, or a Meta Business asset on behalf of a client business (for example, running RewardLoop for a restaurant or managing a WhatsApp Business account for a brand), we process the personal information of that business's customers only on that business's instructions. In those cases the client business is the controller and its own privacy policy also applies. We will always pass on a request we cannot action ourselves to the relevant business.

Information we collect

Information you provide directly to us:

• Contact details submitted through our contact, quote, or demo forms, or over WhatsApp and email — name, email address, phone number, business name, and location
• Project details you share with us during scoping, onboarding, and delivery
• Communications you send us, including their contents and any attachments
• Account credentials and access you grant us for platforms we manage on your behalf

Information collected automatically when you use our website:

• Browser type and version, device type, operating system, and screen size
• IP address and the approximate location derived from it, plus language and time-zone settings
• Pages visited, referring URL, links clicked, and time spent on pages
• Server log data and cookie or similar identifiers used for analytics and security

Payment information: payments are processed by our payment gateway partner. We receive confirmation of a transaction — amount, status, and a reference identifier — but we do not collect or store your full card number, UPI PIN, or banking credentials.

Information collected through our products:RewardLoop, our QR-based loyalty platform, collects from a participating business's customers their name, phone number, receipt number, and a location check confirming they are at the venue, along with visit and reward-redemption history. This data is collected on behalf of, and belongs to, the participating business.

Information obtained through permissions APIs: where you connect an account to us — for example by logging in with Facebook or granting us access to your Meta Business assets — we receive the data described in the section below, limited to the permissions you approve at the time you connect.

Meta platform data and our role as a Tech Provider

Vibesites acts as a Tech Provider on the Meta platform. This means a business can connect its own Meta assets — such as a WhatsApp Business Account, a Facebook Page, an Instagram professional account, or an ad account — to our software so that we can operate those assets on its behalf. We access this data only with the explicit authorisation of the business that owns it, and only through the permissions that business approves during onboarding.

Depending on the permissions granted, we may receive and process:

• Business and account information — business portfolio details, WhatsApp Business Account and phone number details, Page and Instagram account identifiers, display names, profile and category information, and verification status
• Messaging data— the contents, metadata, and delivery, read, and failure status of messages sent to and received from the business's customers on WhatsApp, Messenger, or Instagram, along with those customers' phone numbers or platform-scoped identifiers and display names
• Template and configuration data — message templates, their approval status, quality ratings, messaging limits, and webhook configuration
• Marketing performance data — where ads permissions are granted, campaign, ad set, and ad configuration together with aggregate performance metrics for the connected ad account
• Login data — where you use Facebook Login, your name, profile picture, and email address as released by Meta and approved by you

We use Meta platform data only to provide the services the connecting business has asked us for, namely to:

• Set up, configure, and maintain the business's WhatsApp Business Account, Page, or Instagram account within our software
• Send, receive, route, and display messages between the business and its customers, including loyalty notifications, offers, reminders, order and booking updates, and customer support conversations
• Create and submit message templates and monitor their approval and quality status
• Report on delivery, engagement, and campaign performance back to the business
• Diagnose faults, prevent abuse, and meet our legal and Meta Platform Terms obligations

We do not sell Meta platform data. We do not use it to build advertising profiles, to train third-party models, or for any purpose unrelated to the service the connecting business has requested. We do not combine one client's Meta platform data with another's, and access within our team is restricted to the personnel who need it to run the service. Our use of this data is governed by the Meta Platform Terms and Developer Policies in addition to this policy.

A business can end our access at any time by removing Vibesites as a partner in its Meta Business settings, or by removing our app under its Facebook account settings. Revoking access stops any further collection immediately; to also have data we already hold deleted, use the data deletion process below.

How we use your information and why

• To respond to enquiries and prepare quotes — so we can answer you and scope the work you have asked about
• To deliver, manage, and support projects and products — to perform the contract you have entered into with us
• To operate connected platform accounts on a client's behalf — to provide the Tech Provider services described above
• To send service and project communications — updates, approvals, invoices, and support responses relating to work in progress
• To send occasional marketing about our own services — only where you have opted in or are an existing client, and always with an opt-out
• To improve our website and products — using aggregate usage patterns to fix problems and prioritise changes
• To keep our services secure and prevent fraud — including the receipt and location checks that stop fraudulent loyalty claims
• To meet legal, tax, and accounting obligations — where the law requires us to keep records

We rely on your consent, on the performance of a contract with you, on our legitimate interest in running and securing our business, or on compliance with a legal obligation, depending on which of the purposes above applies. We do not sell your personal information to third parties.

Who we share information with

We share personal information only in these circumstances:

• Service providers who work for us — hosting and infrastructure, database and authentication providers, email delivery, analytics, and payment processing. They may process data only on our instructions.
• Meta Platforms — where messages or content are sent through WhatsApp, Messenger, Instagram, or Facebook, that data is transmitted to and processed by Meta under its own terms and privacy policy.
• The business you interacted with — where we collected your data on behalf of a client business, that business receives it.
• Professional advisers and authorities — where we are legally required to disclose information, or need to establish or defend legal claims.
• A successor entity — if our business is reorganised, sold, or merged, subject to this policy continuing to apply.

WhatsApp communication

Much of our client communication happens over WhatsApp, and several of our products send messages through the WhatsApp Business Platform. Messages exchanged there are subject to WhatsApp's own privacy policy in addition to this one. Recipients of business messages can stop them at any time by replying with a stop or opt-out request, or by blocking the sending number. We retain conversation history only as long as needed to support the relevant project or service and to keep our business records.

Data retention

We keep personal information only for as long as it is needed for the purpose it was collected for. In practice, enquiry and lead data is kept for up to 24 months after our last contact with you; client project and account data for the duration of the engagement and for up to 7 years afterwards where tax and accounting law requires it; Meta platform and messaging data for as long as the connecting business keeps its account connected, plus a short technical window afterwards; and website analytics data in aggregate or pseudonymised form. When a retention period ends, we delete the data or irreversibly anonymise it.

Your rights and how to delete your data

You may ask us at any time to access, correct, export, restrict the use of, or delete your personal information, and to withdraw a consent you have previously given.

To request deletion of your data, send an email to hello@vibesites.in with the subject line “Data Deletion Request,” or submit the same request through our contact form. Please tell us:

• The email address, phone number, or account identifier the data is held under
• Which data you want deleted — everything we hold, or a specific product, account, or connection
• If the request concerns a Meta asset, the Facebook Page, Instagram account, or WhatsApp Business number involved

We acknowledge every request within 5 business days and complete verified deletion requests within 30 days, confirming to you in writing once it is done. We may need to verify your identity before acting, and we may keep a minimal record where the law requires it — for example, invoices needed for tax purposes. We will tell you if that applies to any part of your request.

Deleting data connected through Meta.If you connected your Meta assets to us, you can revoke our access at any time in your Meta Business settings, or under Settings → Apps and Websites in your Facebook account. Revoking access stops further collection; to have data we already hold deleted as well, send us a request as described above and we will delete the Meta platform data associated with your connection.

If a business collected your data using our products. Where a restaurant or other business collected your details through RewardLoop or a messaging channel we operate for it, that business decides what happens to its customer records. Contact us anyway — we will either action the deletion directly or forward your request to that business and tell you who it is.

Cookies and analytics

Our website uses cookies and similar technologies to keep the site working, remember your preferences, and understand how the site is used so we can improve it. You can block or delete cookies through your browser settings; parts of the site may not work as intended if you do. Where we use analytics, we configure it to report on usage patterns rather than to identify you individually.

Security

We protect personal information with encryption in transit, access controls and role-based permissions, restricted administrative access, and regular review of the third-party services we rely on. No system can be guaranteed completely secure, but if a breach affects your personal information we will notify you and the relevant authorities as required by law.

International transfers

We are based in India and work with clients and service providers in other countries, so your information may be stored or processed outside your country of residence. Where that happens, we take steps to ensure it remains protected to the standard described in this policy.

Children's privacy

Our website, products, and services are intended for businesses and adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated “last updated” date at the top of this page, and we will notify affected clients directly where the change is significant.

Contact us

Questions, privacy requests, and complaints about this policy can be sent to hello@vibesites.in or via WhatsApp at +1 555-453-2812. Vibesites is operated by Aditya Kumar Gupta, who is responsible for handling privacy and grievance requests and can be reached at the same email address. We aim to resolve every complaint within 30 days.