Privacy Policy

This policy explains how XPLOSION AI, SL processes personal data in providing VibeTasking. We distinguish data processed as controller to manage our relationship with users and clients from content processed on the Client's behalf under the DPA in Section 7 of the Terms.

1. Identity and contact

XPLOSION AI, SL, Tax ID B26864538, Calle Pobladores 6, Esc 4, Planta 2, Pta 4B, 41900 Camas, Spain.

Data protection contact: [email protected].

2. Data and the parties' roles

As controller, we process identification and professional contact details, account, subscription, billing and support communications, and technical and usage data necessary to manage the relationship, protect the Service and analyse its operation. These may include name, email, phone, IP address, browser, device and usage events. Technical data are not considered anonymous merely because they omit a name.

As processor, we process task content, files, communications, authorised credentials, outputs, histories and logs containing processing-mandate data on the Client's instructions. The relevant persons and categories are identified in the corresponding processing description. Children's data and other regulated data are subject to Section 6 of the Terms; this policy does not itself authorise their processing.

The agent accesses uploaded files and authorised environments and tools within the mandate. This policy does not itself authorise access to local devices or servers. Executing a task does not permit disclosure to new recipients outside authorised instructions.

3. Purposes

Data processed as controller are used to manage accounts, subscriptions, payments and support; protect security and prevent abuse; fulfil legal obligations; analyse product operation through technical data and usage events; and send service communications. Marketing communications and processing requiring consent will occur only with the appropriate legal authorisation.

Processing-mandate content is used to perform requested tasks and secure and maintain that service on the Client's behalf. We do not reuse it for advertising, commercialisation of profiles or product improvement for our own purposes. Logs containing processing-mandate content remain subject to those restrictions.

No training. We do not use Your Content or data processed on your behalf, including data obtained through Google Workspace APIs, to train, retrain or improve our own or third-party models. We require compatible commitments from subprocessors.

4. Legal bases

For data processed as controller, we rely on performance of a contract where the data subject is a party and processing is necessary; legal obligations for billing and other applicable duties; and legitimate interests, following a balancing assessment, to manage professional contacts, assist users of client entities, provide security, prevent abuse and analyse operation where appropriate. We request consent where required, for example for non-essential tracking technologies or communications requiring it; consent may be withdrawn without affecting the lawfulness of earlier processing.

The Client determines the legal basis for content processed on its behalf. The DPA documents our instructions and obligations as processor; the commercial relationship with VibeTasking is not a general legal basis to process third-party data or a substitute for special conditions applying to certain data.

Measurement preferences

Basic product analytics with PostHog is enabled by default and can be disabled through Privacy preferences in the website footer or Profile → Privacy in the app. Basic measurement does not use persistent analytics identifiers. Clicks are measured without capturing their text, and sessions are not recorded. If you enable Remember visits, PostHog uses cookies and browser storage to connect visits and keep sessions together across reloads. You can withdraw that choice in the same controls; the stored analytics identifiers are then removed. In the app, account identifiers can associate product events with your account. These data are not anonymous. Existing analytics opt-outs are respected.

Google advertising measurement is a separate choice. In the European Economic Area, the United Kingdom and Switzerland, Google tags load with denied consent defaults and may send limited cookieless signals. There, advertising cookies and identifier-based conversion uploads require the advertising choice. Outside those regions, advertising measurement and Remember visits are on by default and you can turn them off at any time from Privacy preferences. The region is determined from the country associated with your IP address, which we do not retain for this purpose. Ad personalization remains disabled. Declining Google measurement does not disable basic product analytics. The app has no consent banner or additional signup step.

Preferences, including the default outside those regions, are stored for up to 180 days in a first-party cookie shared between the website and app. With advertising permission, campaign attribution can be retained for up to 90 days. Without that permission, current-navigation campaign labels can accompany registration without retaining a Google click identifier. Account registration, authentication, billing and task records do not depend on analytics preferences. Server conversion records are retained for up to 90 days and uploads to Google check advertising permission. Minimal milestone identifiers prevent duplicate acquisition counts.

5. Recipients and international transfers

We use providers of infrastructure, execution, AI models, channels, integrations and other functions necessary for the Service. The provider register identifies their entities, functions, locations and disclosed safeguards. Their role depends on the processing: a billing provider may support our activities as controller, whereas a provider processing mandated content on our behalf is a subprocessor. The DPA's general authorisation, notices and obligations apply to the latter.

Applications contracted by the Client and authorised for us to operate are governed by the Client's relationship with their providers. Intermediaries contracted by VibeTasking that process data on our behalf remain subject to the subprocessor regime. Connecting a tool does not remove our obligations.

Hosting infrastructure in Europe does not mean all functions are processed exclusively there. Locations depend on the provider and service. For transfers subject to Chapter V GDPR, we will establish the applicable valid mechanism, such as an adequacy decision or standard contractual clauses, with necessary assessments and supplementary measures. The EU-US Data Privacy Framework applies only where it covers the particular recipient and processing. You may request information and copies of safeguards from our privacy contact. We will not make a transfer without valid safeguards.

6. Retention

Account, contact and support data are retained as necessary for the relationship and corresponding purpose. Data subject to legal obligations or necessary to address liabilities are retained for applicable periods with restricted access and without reuse for incompatible purposes. The need to retain technical logs is assessed according to their security or operational purpose.

Data processed on behalf of the Client are returned or erased under the DPA and the Client's instructions. The initial termination instruction provides up to thirty days solely for return, with erasure from active systems within thirty days and backups within ninety days of termination or an earlier instruction triggering erasure, without prejudice to shorter legal deadlines. Backups awaiting rotation are isolated from ordinary use. Data are not retained for reactivation. Only specific legally required retention is excepted under the DPA.

7. Rights

You may request access, rectification, erasure, restriction, portability or objection where applicable, and withdraw consent, by writing to [email protected]. You may complain to the Spanish Data Protection Agency.

If a request concerns data processed on a Client's behalf, we will forward it to the controller and assist under the DPA. We will not resolve it on the Client's behalf without instructions or a legal obligation.

8. AI and automated decisions

The Service generates outputs and performs actions using AI under the Client's instructions and permissions. Automatically selecting tools for a task does not itself amount to profiling individuals. If the Client uses a system to evaluate people or make decisions affecting them, it must identify and fulfil applicable obligations, including Article 22 GDPR where relevant. Acceptance of the Terms does not constitute affected persons' consent. VibeTasking retains its own transparency and compliance obligations.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and segregation of environments. The description of measures applicable to the mandate is provided under the DPA. Security requires ongoing measures and review; it does not guarantee complete absence of incidents.

10. Changes

We will keep this policy up to date and communicate material changes through appropriate channels, including email where relevant. Changes to this policy do not amend the DPA or authorise incompatible new purposes; consent will be obtained where necessary.