Privacy policy
Effective October 17, 2026
Who we are
vibereview (vibereview.io and vibereview.co.za) is operated by Starkey Software, Inc., a Delaware corporation ("we", "us"). We decide how and why the personal information described here is used, which makes us the "controller" under data protection laws such as the GDPR (the "responsible party" under South Africa's POPIA).
Contact us about anything in this policy at hello@vibereview.io.
What we collect and why
When you visit the site
Our hosting provider records standard request information (IP address, browser type, the page requested and the time) to deliver the site and protect it from abuse. We use Vercel Web Analytics to count page views and see which pages are useful. It doesn't use cookies, and according to Vercel it doesn't identify you or follow you across other websites.
We also count a few actions anonymously: opening the example report, sending the booking form and booking a call. If you arrived from one of our search ads, the link includes the ad campaign's name, and these counts record that name so we can tell which ads are useful. None of this is linked to you, and we don't use advertising cookies or the Google ads tag.
When you book a fit call
The booking form asks for your name, email, a link to your app or repository, the tools you used, your target launch date, and what worries you about launching. You choose what to share beyond your name and email. We use this to prepare for the call and recommend the right review. The scheduler is provided by Cal.com, and the details you enter are passed to it to create the booking. If you contact us by email instead, we receive whatever you include in your message.
When you become a client
To deliver a review we need your name, email, company details and billing information, plus read-only access to your code, hosting and related services. Invoices and payments are handled by Stripe. We never see or store your full card details.
Your code, data and anything else we access during an engagement are confidential and covered by our NDA and engagement terms. We access them only to perform the review. When the engagement ends, we ask you to revoke our access, and we delete any copies of your code within 30 days unless you ask us to keep them.
What we don't do
- We don't sell or rent personal information, or share it for cross-context behavioral advertising.
- We don't use advertising cookies, tracking pixels or fingerprinting.
- We don't use your code or data to train AI models, and we don't share them with anyone outside the engagement.
Legal bases (UK and EU visitors)
If you're in the UK, the EU or the EEA, we rely on these legal bases under the GDPR:
- Taking steps at your request before a contract, and performing our contract with you: handling your booking and delivering your review.
- Legitimate interests: keeping the site secure, understanding which pages are useful in aggregate, and replying to messages you send. We've balanced these against your rights, and the data involved is minimal.
- Legal obligation: keeping invoices and financial records for tax purposes.
Who we share it with
We use a small number of service providers who process personal information on our behalf, under contracts that require them to protect it:
| Provider | What for | Where |
|---|---|---|
| Vercel, Inc. | Website hosting and privacy-friendly analytics | United States and global edge network |
| Cal.com, Inc. | Scheduling fit calls | United States |
| Proton AG | Switzerland | |
| Stripe, Inc. | Invoicing and payments for clients | United States |
Fit calls take place on the video service named in your booking confirmation, which handles the call under its own privacy policy. We may also disclose information if required by law, or to protect our rights, or in connection with a sale or reorganization of our business, in which case this policy would continue to apply to your information.
Cookies
This site doesn't set any cookies of its own, and our analytics are cookieless, so there's no cookie banner. If you choose to open the scheduler, Cal.com's embedded booking page may set cookies it needs to work, under Cal.com's privacy policy. Links to other sites, such as LinkedIn, are governed by those sites' own policies.
Because we don't track you across sites, we don't change our behavior in response to Do Not Track signals; there's nothing to switch off.
How long we keep it
- Enquiries and fit call details that don't lead to an engagement: deleted within 24 months of our last contact.
- Client contact and engagement records: kept for the engagement and up to 7 years afterwards for tax and legal purposes.
- Your code and data accessed during a review: deleted within 30 days of the engagement ending, as described above.
- Hosting logs and analytics: kept by Vercel for its standard retention periods.
International transfers
We're based in the United States, and our providers may process information in the US and other countries. Where we transfer personal information from the UK, the EU or the EEA, we rely on adequacy decisions (for example for Switzerland, or for US companies certified under the EU-US Data Privacy Framework and its UK extension) or on standard contractual clauses.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent where we rely on it. South African residents have these rights under the Protection of Personal Information Act (POPIA). US residents of states with privacy laws have similar rights to know, correct and delete, and we won't treat you differently for using them.
To make a request, email hello@vibereview.io. We'll reply within 30 days, and we may need to confirm your identity first. If you're unhappy with our response, you can complain to your local data protection authority: for example the ICO in the UK, or the Information Regulator in South Africa.
Security
We protect information the way we tell clients to: encryption in transit, least-privilege and read-only access, multi-factor authentication on our accounts, a strict Content Security Policy on this site, and deleting data we no longer need. No system is perfectly secure, but if a breach affecting your information occurs, we'll tell you and the relevant authorities as the law requires.
Children
This site and our services are for businesses and aren't directed at children under 16. We don't knowingly collect their information. If you think we have, contact us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the effective date at the top. If a change materially affects how we use information you've already given us, we'll tell you directly.