← Start a workspace · En français · Hosted terms
# Vibe In One Privacy Policy 1.0 **In force since 7 September 2026.** This is the privacy policy for the **hosted** Vibe In One service — a workspace at `<name>.<zone>` that we run for you — and for our website. It says what personal information we hold, why, for how long, where it goes, and what you can make us do about it. It sits beside [the hosted terms](/terms), which are the agreement about the service itself; where the terms describe what we store, this policy describes what we do with the part of it that is about a person. This policy is published in English and in French. The French version is at `/privacy/fr` and is the one offered first to a customer in Québec. --- ## In short * **The person responsible is named, and it is a person.** Lawrence Collier, `admin@vibeinone.ca`. Write there about anything on this page. * **We do not read your workspace's contents**, nothing automated reads them, nothing trains on them, and we do not sell or share them. * **We hold almost nothing of our own about you**: an address for the workspace, a row saying whether it is being paid for, and ordinary server logs. Everything else that is personal information sits inside your own workspace and is yours. * **We never see a card number.** Stripe takes the payment and holds the billing details. * **Your data lives on Cloudflare's network**, which means it is stored and processed outside Québec and may be outside Canada. That is a design fact of the product and section 6 explains it rather than hiding it. * **You can demand a copy, a correction, or deletion**, and be told what we hold. Section 8 says how, and what we will answer within thirty days. * **If we ever lose control of personal information**, we keep a register of it, and we tell the Commission d'accès à l'information and the people affected when the risk is serious. --- ## 1. Who is responsible Vibe In One is operated by **Lawrence Collier**, in Québec, Canada. In this policy **we** and **us** mean that business, and **you** means the organisation whose workspace it is, or the person reading it, as the sentence requires. Québec's *Act respecting the protection of personal information in the private sector* requires a business to have a **person in charge of the protection of personal information**, and to publish who it is. Here that is: > **Lawrence Collier**, person in charge of the protection of personal > information > `admin@vibeinone.ca` That is the address for an access request, a correction, a complaint, a question about this policy, or a report that something has gone wrong. It is one person's inbox and it will be answered by that person. ## 2. Two kinds of personal information, and they are not the same The distinction runs through everything below and it is worth getting right before the lists: * **What we hold about our customer** — the address of a workspace, the administrator's email, what our payment provider says about the invoice, an operator's note about a support conversation. This is ours to explain, and sections 3 to 9 are about it. * **What is inside a workspace** — the accounts, the cards, the pages, the comments, the time entries, the names your own people type. That is *yours*. We hold it **on your behalf and for no purpose of our own**: we are the service provider, you decide what goes in and why, and we act on your instructions. Section 10 says what that means for a request from one of your own people. ## 3. What we collect, and why **When you create a workspace.** The address you chose, the username of the first administrator, and — if you gave one — an email address. The email is optional and is used for one thing: reaching you about the workspace itself, because every reason we would have to write to you (an unpaid invoice, a workspace about to be purged, a workspace that will not start) is a reason we cannot get into the workspace to look one up. **When you pay.** We hold what our payment provider tells us: whether the subscription is in good standing, when it last changed, and an opaque reference for it. **We never receive or store a card number.** Stripe is the seller of record for the transaction (hosted terms, section 4) and holds the billing details under its own privacy policy. **When you use the service.** Ordinary operational logs at the edge — hostnames, paths, status codes, timings, errors and the IP address a request came from. They are what makes an outage diagnosable. They are not a copy of your content and are not kept as one. **When you write to us.** The email itself, and whatever you put in it. **When you visit our website.** A cookie for a signed-in session, and a `localStorage` entry remembering whether you chose the light or dark theme. There is no analytics pipeline, no advertising network, no tracking pixel and no third-party script on our pages — not on the home page, not on the signup page, and not in the application. Nothing here builds a profile of anybody and nothing follows you to another site. **What we do not collect.** We have no usage telemetry, hosted or self-hosted. We do not buy personal information from anybody, we do not enrich what you gave us from another source, and we make no decision about you by automated means alone. ## 4. What we use it for Only these, and each is the reason it was collected: * running your workspace and keeping it available; * invoicing you, and knowing whether an invoice was paid; * writing to you about your own workspace; * answering your support requests and doing what you asked us to do in them; * keeping the service secure — spotting abuse, an attack, or an account being broken into; * meeting an obligation the law puts on us. We do not use it to market anything to anybody else, we do not sell, rent or share it, and we do not train any model on it or let anybody else do so. ## 5. Who else touches it * **Cloudflare** — the platform the service runs on: the storage your workspace lives in, the object storage your files live in, and the network in front of both. Cloudflare processes the data on our instructions to provide that infrastructure. * **Stripe** — the seller of record for a subscription and the payment processor behind it. It receives what a purchase requires: an email address, billing details, and the amount. That is the whole list. The AI provider, GitHub account, SMTP server and runner machines your workspace talks to are **yours**, configured by you in your own Settings, and are not our sub-processors; what they do with what you send them is between you and them. We will hand personal information to a public authority only where the law requires it, and where we are permitted to tell you that it happened, we will. ## 6. Where it is, and what that means **Your workspace lives on Cloudflare's network, in the location nearest whoever first used it.** It is not pinned to Québec or to Canada, and it may be stored and processed outside both. We do not offer a region guarantee today and will not pretend to. This is a communication of personal information outside Québec, and the law requires us to assess it before making it rather than to disclose it afterwards. We have written that assessment down; it weighs the sensitivity of what is held, the purposes it is used for, the protection measures around it — including contractual ones — and the legal regime that applies where it lands. Ask at `admin@vibeinone.ca` and we will tell you what it concluded. **If where your data physically sits is a requirement you have to satisfy, raise it before you sign up rather than after.** It is a conversation, and it is one the answer may be no to. ## 7. How long we keep it * **A workspace's contents** last as long as the workspace. When you ask us to delete it, it stops immediately and its data — the database, every file under its prefix, and every snapshot of it — is destroyed thirty days later, with no copy kept anywhere (hosted terms, section 9). There is no undo, and that is the point. * **Your workspace's own nightly snapshots** are kept for **seven days** and then deleted. They are encrypted with a key derived for that workspace alone, they are listed and downloadable in your own Settings → Backups, and they go when the workspace goes. * **The row about the workspace itself** is destroyed with it. * **Billing records** are kept for as long as tax and accounting law requires them to be kept, which in Canada is six years from the end of the year they relate to, and then destroyed. * **Operational logs** are short-lived by construction: they live in the platform's own log retention and are not copied anywhere else. * **Email you send us** is kept while it is useful for the thing it was about, and not as a permanent record of you. Beyond those, the platform keeps point-in-time recovery for your workspace's storage within its own retention window. Nothing copies your database anywhere else — not to another account, not to a laptop, and not anywhere an operator can read it. ## 8. What you can make us do Whoever you are, and wherever you are: * **Know what we hold.** Ask, and we will tell you what personal information about you we have and what we do with it. * **Have a copy of it**, in a structured, commonly used technological format, where it was collected from you rather than created by us. * **Have it corrected** if it is inaccurate, incomplete or ambiguous. * **Withdraw a consent** you gave us, for anything we are not obliged to keep doing. * **Have it deleted**, or have us stop spreading it, where the law gives you that right. * **Be told the reasons** for any decision we make about you, and by whom it was made. No decision here is made by automated processing alone; if that ever changes, this policy will say so before it does, and you will be able to make your point of view heard to a person. * **Complain**, and not only to us. In Québec, to the **Commission d'accès à l'information du Québec**; elsewhere in Canada, to the **Office of the Privacy Commissioner of Canada**. You do not have to go through us first. **How to ask:** write to `admin@vibeinone.ca`. We will answer **within thirty days**. There is no charge. We may need to satisfy ourselves that you are who you say you are, and we will ask for the least that establishes it. If we refuse a request, in whole or in part, we will say which part, why, and how to have that refusal reviewed. ## 9. Security, and what happens when it fails **What we do.** Passwords and runner tokens are stored only as hashes, so nobody here can read one back — including us, and including when you have lost it. Secrets you put in Settings are encrypted at rest with AES-256-GCM; the key is held by the deployment, which is us, so that protects the values if the storage behind them were ever disclosed and does not put them beyond our reach (hosted terms, section 7 is blunt about this, and so is this policy). Every workspace is a separate database with nothing between it and any other. Access to the platform underneath is held by one person and is not shared. The product defaults to the highest degree of confidentiality it can without anybody having to configure it. **What we do not do.** We do not read your workspace's contents. We look inside a workspace only when you ask us to, in writing, for a problem you have reported, and only as far as that problem needs. That is a rule rather than a mechanism, and it would be dishonest to imply otherwise: an operator can, unavoidably, reach the storage a hosted service runs on. **When something goes wrong.** We keep a **register of confidentiality incidents**, as the law requires, and every incident goes in it whether or not it turns out to be serious. Where an incident presents a risk of serious injury we will notify the **Commission d'accès à l'information** and every person affected **promptly**, and tell you what happened, what was involved, what we have done and what you should do. If you think something has gone wrong, tell us at `admin@vibeinone.ca` — that is the fastest route to the person who can act on it. ## 10. If you are somebody in a customer's workspace If you have an account in a workspace that somebody else pays for, the personal information in that workspace is held **for your organisation**, and your organisation decides what is in it. So: * Ask **them** first for access, correction or deletion of what is in the workspace. Their own administrator can do all three from inside it, without us. * If they cannot, or if your request is about what *we* hold rather than what is in the workspace, write to `admin@vibeinone.ca` and we will help. Where we hold it on their behalf, we will point them at your request rather than act behind them, and we will tell you that is what we have done. * Nothing above takes away your right to complain to the Commission d'accès à l'information or to the Office of the Privacy Commissioner of Canada. ## 11. Children Vibe In One is a tool sold to organisations for their work, and is not directed at children. We do not knowingly collect personal information about a child under 14, and if we learn that we hold any, we will destroy it. ## 12. Changes to this policy We can change this policy. When a change matters — a new purpose, a new recipient, a new place the data goes — we will tell the address on the account **at least thirty days before it takes effect**, exactly as section 13 of the hosted terms promises for the terms themselves. The current version is always the one at `/privacy` on the address you signed up at, and it carries a version number and a date at the top. We keep every earlier version and will send you any of them on request. ## 13. Getting in touch **`admin@vibeinone.ca`** — for an access request, a correction, a complaint, a question about this page, or a report that something has gone wrong. It reaches Lawrence Collier, who is the person in charge of the protection of personal information, and it is answered by a person.