Privacy policy

FlexVibe is operated by [Company legal name] (“FlexVibe”, “we”), and we build it in Abu Dhabi, United Arab Emirates. We decide why and how your personal data is used in FlexVibe, so we are responsible for it (the “controller”).

This policy covers the FlexVibe website, the studio and the FlexVibe agent on WhatsApp.

It doesn't cover the apps you build. You decide what data your app collects from its users, and you're responsible for telling them how you use it. Where FlexVibe stores that data for you, in your app's backend or its visit analytics, we handle it on your behalf and only to run your app.

We collect information you give us, information created as you use FlexVibe, and information from services you choose to connect.

• Account detailsYour name, email address and profile picture, and how you sign in: with an email and password, or with Google. We store passwords hashed, never in plain text.
• Sign-in sessions and devicesThe IP address and browser details of each session, so you can see your sessions and end them in Settings.
• Your projectsYour messages to the agent, the files and images you add, the plans and code FlexVibe writes, each project's version history, and your previews and published apps.
• Workspaces and teamsThe workspaces you belong to, your role in each, and the invitations you send or receive. Team owners and admins can see a log of membership changes.
• BillingYour plan, credit balance and credit history. Polar handles your card details; they never reach FlexVibe.
• UsageThe pages you view and what you click, as described in Analytics below, and technical logs of each request to the agent.
• Voice inputIf you dictate a message, we send the recording to a transcription provider to turn it into text.
• WhatsAppIf you link WhatsApp: your number, your WhatsApp profile name and your messages to FlexVibe.
• Connected servicesIf you connect a service such as Linear or Slack: the access it gives FlexVibe, stored encrypted.
• WaitlistsIf you join a waitlist: your email address, your name and what you plan to use the feature for if you add them, and whether you agreed to receive news from us.
• Messages to usWhat you send when you email us, for example about support or privacy.

• To provide FlexVibe: build, preview and publish your apps, keep their versions, run your workspaces, and charge credits for usage.
• To answer your requests with AI models, as described in “AI models and your content” below.
• To keep FlexVibe and its users safe: check access on every request, catch secret keys in messages, prevent abuse and investigate problems.
• To understand how FlexVibe is used and improve it.
• To send emails about your account and purchases, such as email verification, password resets and purchase confirmations. Polar sends payment receipts.
• To tell you when a feature you joined the waitlist for opens.
• To send you occasional product news, only if you ticked the box for it when you joined a waitlist. You can ask us to stop at any time.
• To meet legal obligations, such as keeping financial records, and to enforce our terms.

Data protection laws, including the EU and UK GDPR and the personal data protection laws of the UAE and Saudi Arabia, require a legal basis for each use of your data. We rely on these:

• Providing the serviceMost of what we do, such as running your account, building your apps and billing, is needed to provide FlexVibe under our terms.
• Legitimate interestsWe use analytics, security monitoring and abuse prevention because we need them to run a safe, working product, and we limit them so they don't override your rights.
• Your consentWe send news emails only with your consent, and you can withdraw it at any time.
• Legal obligationsWe keep billing records because tax and finance laws require them.

• Your requests to the agent, with the parts of your project it needs, go through OpenRouter to the provider of the AI model you use, such as Anthropic, Google, OpenAI or DeepSeek.
• Where it's set up, IFM (MBZUAI) turns voice messages into text and polishes the Arabic text in the apps the agent builds.
• Each model provider handles requests under its own terms. OpenRouter can send a request to any provider that hosts the model you chose.
• We don't use your projects, messages or code to train AI models, and we don't sell them.
• Before the results of the agent's tools reach a model, we mask anything that looks like a secret key.

• With the service providers listed below, which process data for us so that FlexVibe can run.
• With the members of your workspaces: they see that workspace's projects, according to their role.
• With everyone, if you make a project public. Signed-in users can then make their own copy of it. A copy includes the code, and the approved plan and design brief if there are any, but not the conversation, connections or secrets.
• With authorities or others when the law requires it, or to protect the rights and safety of our users or of FlexVibe.
• With a buyer or successor if FlexVibe is merged, acquired or sold, with the same protections as this policy.
• We don't sell personal data or share it for advertising.

Many of our service providers are based outside the UAE and Saudi Arabia, including in the United States, so your data may be processed in other countries.

When the law where you live restricts these transfers, we transfer data only on the grounds it allows, for example because the transfer is needed to provide the service you asked for, or under protections in our agreements with these providers.

• Your account details: until you delete your account.
• Your projects, their versions and their conversations: until you or your workspace delete the project, or you delete your account.
• Run activity logs, the step-by-step record of each request: deleted by a daily job after 90 days.
• Data export files: deleted 7 days after they are created.
• Billing records: kept for our financial records. If you delete your account, your credit history is kept without your user ID.
• WhatsApp: message previews and request text for 30 days; message and request records for 180 days.
• Waitlist entries: until you ask us to remove yours, or until that waitlist closes.
• Security records, such as who saved or used a stored key: kept as evidence for investigating problems, never with the key itself.
• Deleted data can stay in our database backups for a limited time before they're replaced.
• Analytics events: kept by PostHog under our account's settings.

• We use PostHog to count page views and record clicks, including the visible text of what you click. Before anything is sent, we remove query strings and fragments from links, and chat messages are excluded.
• PostHog keeps an identifier in your browser's local storage, not in a cookie. When you are signed in, events are linked to your FlexVibe user ID and interface language, not to your name or email.
• If you turn on analytics for an app you publish, visits to that app are counted with Umami, which we host ourselves.
• FlexVibe works without analytics: you can block it with your browser's tracking protection or a content blocker.

We protect your data with encryption in transit and at rest, isolated environments for your apps' code, and access checks on every request. The Security page has the details.

If a security incident affects your personal data, we'll tell you, and the authorities where the law requires it, without undue delay.

No system is perfectly secure, so keep your password safe and tell us if you notice anything unusual.

Depending on where you live, data protection law gives you the right to access your data, correct it, delete it, get a portable copy, object to or restrict some uses, and withdraw consent you gave. Here is how to use them:

• Get a copyChoose “Download my data” in Settings to get a file with your data. We delete the file 7 days after it is created.
• Correct itChange your name and profile picture in Settings, or email us to correct anything else.
• Delete your accountDelete your account in Settings. We delete your account, sign-in details, sessions and memberships, the projects in your personal workspace with their conversations, code repositories and published apps, your connected accounts, your profile picture and your data exports, and ask Polar to delete your customer record. We email you when it's done. If you're the only owner of a team workspace with other members, or you own a team workspace with an active plan, transfer it or cancel its plan first.
• What we keepProjects in team workspaces stay with the team, and billing records stay without your user ID. A few records are removed by our team rather than automatically: analytics data at PostHog, debugging traces at LangSmith, your contact at our WhatsApp provider, and access a connected service wouldn't revoke.
• Private and public projectsProjects are private unless you make them public, and you can make a public project private again at any time.
• Download your codeDownload your app's code from a project you can edit: you get its latest saved version.
• Stop news emailsTo withdraw your consent to news emails, email contact@flexvibe.dev.
• ComplainIf you're unhappy with how we handle your data, contact us first. You can also complain to a data protection authority, such as the one in your EU country, the UAE Data Office or the Saudi Data and AI Authority (SDAIA).
• How we handle requestsEmail us from the address on your account. We may ask you to confirm it's you, and we aim to reply within 30 days.

FlexVibe isn't meant for children. You need to be at least 18 to create an account, and we don't knowingly collect data from anyone younger. If you think a child has given us data, email contact@flexvibe.dev and we'll delete it.

When we change this policy, we update the date at the top. If a change affects how we use your data, we'll tell you by email or in FlexVibe before it takes effect.