Privacy Policy

1. Who we are

vybe is a platform where independent fitness creators sell memberships to their own audiences. It is operated by VYBE LTD, a private limited company registered in England and Wales under company number 17295820, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

In this policy, "we", "us" and "vybe" mean VYBE LTD. A "creator" is a business or individual running a page on vybe. A "member" is somebody who has signed up to a creator's page.

You can reach us at hello@joinvybe.co. Our data protection contact is hello@joinvybe.co. Our registration with the Information Commissioner's Office is [ICO REGISTRATION NUMBER]. Whatever that registration says, you can complain to the ICO about us at any time — see section 17.

2. Who controls your data — read this first

vybe is built so that a creator runs their own business on it. That has a direct consequence for your data, and it decides who you go to when something is wrong.

3. If you are a member: what a creator holds about you

What is held depends on what you do. Broadly, on a creator's page vybe stores:

• Your identity. Name, email address, and a profile photo if you upload one. A location field if the creator or you fill it in.
• Your membership. Which tier you are on, when you joined, your current billing period, whether the membership is active, paused, past due or cancelled, and any gift code you redeemed.
• Your payments. Amount, currency, date, status, and the Stripe payment reference. Card details are never held by vybe — see section 9.
• What you do on the page. Programme enrolments, lessons completed, workout sessions and personal records you log, content you viewed, challenge entries, points and badges.
• What you write.Community posts, replies, likes, comments, poll votes, and messages between you and the creator's team.
• Notifications and email preferences, including whether you have opted out of marketing email.
• Private coaching notes the creator writes about you. These are their notes, not yours, but they are still personal data about you — see section 4.

Why, and on what basis

The creator sets the lawful basis for their own use of your data. Typically it will be performance of a contract (running the membership you paid for), legal obligation (keeping accounting records), and legitimate interests (running and improving their page). Marketing email is normally sent on the basis of your consent or a soft opt-in, and you can opt out at any time.

vybe does not decide any of that. We process the data to provide the software, and we do not sell it or use it to build profiles for advertising.

4. If you are a member: your rights, and how to use them

Under UK data protection law you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to certain processing, and ask for it in a portable format. Two of those are built into vybe and you can use them yourself, right now, without asking anyone:

• Export your data.From your account on a creator's page you can download a machine-readable copy of what that creator holds about you.
• Delete your account. Also from your account. This runs the erasure described in section 5.

A creator's owner or admin can also remove a member. Editors on a creator's team cannot — they have no access to member details at all.

One honest exception in the export

The automated export does not include the creator's private coaching notes about you. That is not a claim they are exempt — a subject access request does cover opinions held about you. They are left out because coaching notes routinely name other people (a training partner, a family situation, another member's complaint), and third-party data cannot be released without either that person's consent or a redaction judgement that software cannot make. The export tells you they exist and have been withheld.

If you want those notes, ask the creator in writing. They must respond within one month. If you cannot get an answer, contact us at hello@joinvybe.co.

5. What deletion actually does — including what survives

"Delete" is usually written vaguely. Here is exactly what happens, because some of it is not deletion and you should know that before you rely on it.

Deleted

Your profile, membership record, uploaded avatar and files, progress and workout logs, likes, poll votes, messages, notifications, and — unless it is still in use elsewhere — your vybe sign-in.

Kept, but anonymised — payment records

Records of money that changed hands are not only your data; they are the creator's accounting records. HMRC requires businesses to keep records — commonly cited as six years, and the exact period vybe applies is [FINANCIAL RECORD RETENTION]. Deleting a paid transaction would falsify the creator's books.

So the money facts stay — amount, currency, status, date, Stripe reference — and the personal identifiers are stripped: your member link, your name, your email, gift messages. What is left is an anonymised row an accountant can add up but which no longer identifies you. It is grouped under a reference that points at nothing. We rely on the legal-obligation exemption to erasure in UK GDPR Article 17(3)(b) for this. [SOLICITOR TO CONFIRM BASIS AND PERIOD]

Kept, but emptied — community posts

If you posted in a community and other members replied underneath, deleting the post outright would delete their words too, which are not yours to remove. Instead the post is emptied: the text is genuinely removed and your authorship is dropped, leaving a marker so the thread other people wrote still makes sense.

Not deleted by us — your details at Stripe

This is the part most policies gloss over. Payments run through Stripe, and Stripe keeps its own copy of your name and email address as an independent controller for its own legal and anti-fraud obligations. Deleting your vybe account does not delete that copy, and vybe does not delete it for you.

If you want to know what Stripe holds or ask them to remove it, you need to go to Stripe directly — their privacy policy is at stripe.com/privacy. We would rather tell you plainly than let you believe the deletion was more complete than it is.

The receipt

Each deletion writes an audit record so the creator can evidence that it happened. It contains no personal data — a date, what was done, and counts.

6. If you are a creator or a staff member: what we hold

Here vybe is the controller. We hold:

• Your account. Name, email address, profile photo, password (stored hashed by our authentication provider — we never see it), and your role on a page.
• Your page. Brand name, handle, slug, branding, settings, and everything you publish through it.
• Your team. Who you invited, what role they hold, and who invited them.
• Your payouts. The identifier of your connected Stripe account, and its status. Your bank details are held by Stripe, not by vybe.
• Records of account events — including a permanent, unalterable record if you request closure of your page.

We process this to provide the platform to you (performance of our contract), to meet our own legal and accounting obligations, and in our legitimate interests in keeping the platform secure and preventing abuse.

Roles on your team

vybe has three staff roles, and the line between them is money and personal data. Owner can do everything, including payouts and closing the page. Admin can see members, messages, tiers and pricing, but not payouts. Editorcan build and publish content only — no member details, no money. Choose accordingly: adding somebody as an admin gives them your members' personal data.

7. If you are a creator: your obligations

Because you are the controller of your members' data, some duties are yours and cannot be delegated to us:

• Give your members their own privacy information, saying who you are and how you use their data. This policy covers vybe's role; it does not cover yours.
• Register with the ICO and pay the data protection fee if you are required to.
• Answer members' requests about their data within one month.
• Handle coaching notes carefully. They frequently contain health information and references to other people.
• Tell us without delay if you become aware of a personal data breach involving your members.

The processing terms between us — what we may do with your members' data, and on what instructions — are in the creator terms on our Terms of Service page. [SOLICITOR: CONFIRM WHETHER A SEPARATE ARTICLE 28 DATA PROCESSING AGREEMENT IS REQUIRED]

8. This website

If you apply to be a Founding Creator through the form on this site, we store the name, email, social handle and the answers you give, and we email ourselves a copy so we can reply. We use that to assess and respond to your application. We keep applications for [WAITLIST RETENTION].

This marketing site sets no cookies of its own and runs no analytics or advertising trackers. Our hosting provider processes standard server request logs.

9. Payments and Stripe

All payments run through Stripe. Checkout is hosted by Stripe, which means your card details never reach vybe — we never see them and never store them.

Payments use Stripe Connect. A member pays the creator directly on the creator's own connected Stripe account, and vybe takes a percentage platform fee from the payment. That structure has two consequences for data:

• Stripe holds payment data both for the creator and for itself, as its own controller, including members' names and email addresses. It keeps that data under its own policy and retention rules, which we do not control and cannot override.
• What vybe stores is a shadow of the payment, not the payment itself: amount, currency, date, status and the Stripe reference.

Stripe's privacy policy: stripe.com/privacy.

10. Who else processes data

These are the companies that handle data on our behalf. This list is drawn from what the software actually connects to, not from a template.

Creators can also embed video from third parties such as YouTube or Vimeo in their content. When you play an embedded video, that provider receives a request from your browser and applies its own privacy policy.

We will update this list when it changes. [SOLICITOR: CONFIRM WHETHER PRIOR NOTICE OF NEW SUB-PROCESSORS IS REQUIRED FOR CREATORS]

11. Where data is held

Our database, sign-in and file storage are hosted with Supabase in the United Kingdom (London, eu-west-2). We have deliberately not stated a region here: the choice is recorded in our own engineering notes as an open decision rather than a settled one, and stating an unverified region in a privacy policy would be a false statement.

Our other providers — Stripe, Postmark, Vercel and, where a creator connects it, Google — operate internationally and may process data outside the UK. Where that happens, transfers rely on the safeguards those providers put in place. [SOLICITOR: CONFIRM TRANSFER MECHANISM — UK IDTA / EU SCCs PLUS UK ADDENDUM / ADEQUACY]

12. How long we keep it

We keep personal data only while there is a reason to. In practice:

• Member data— for as long as the membership exists, and then until the member or the creator deletes it. A creator closing their page triggers erasure of their members' data at the end of the wind-down.
• Anonymised payment records — [FINANCIAL RECORD RETENTION], for tax and accounting. These no longer identify anyone.
• Creator accounts — for as long as the account is open, and then [CREATOR RECORD RETENTION].
• Waitlist applications — [WAITLIST RETENTION].
• Age confirmation records — [AGE CONFIRMATION RETENTION]. None are held yet; see section 15.
• Closure and deletion audit records — kept indefinitely. They contain no personal data, and their whole purpose is to evidence that a deletion happened.

We have deliberately not invented periods for the items still marked as placeholders. They need to be set as policy first, not written into a document and hoped for.

13. Cookies

This marketing site sets no cookies of its own. There is no analytics, advertising or tracking on it.

When you sign in — as a member on a creator's page, or as a creator in the panel — cookies are set to keep you signed in. These are strictly necessary: without them, signing in would not work. Consent is not required for them, and there is nothing to opt out of short of not signing in.

If we ever add analytics or marketing cookies, we will ask for consent first and update this page.

14. Security

Data is separated per creator at the database level, so one creator's staff cannot read another's members. Access inside a creator's team is limited by role — an editor cannot open the member list. Passwords are hashed by our authentication provider and are never visible to us. Traffic is encrypted in transit. Sensitive endpoints are rate limited.

We do not hold ISO 27001, SOC 2, or any other security certification, and we are not going to imply otherwise. No system is completely secure. If you believe you have found a vulnerability, email hello@joinvybe.co and we will take it seriously.

15. Age

You must be 18 or over to hold a vybe account, whether as a creator or as a member, and you need the legal capacity to enter into a contract to buy a membership. vybe is not intended for under-18s.

Two plain reasons. A contract with someone under 18 is not reliably enforceable, and a membership on vybe is a paid contract. And vybe is not designed to meet the additional protections children are entitled to under UK data protection law.

If we learn that an account belongs to someone under 18, we will close it. Where it is a member's account, the creator can be asked to refund at their discretion — vybe never issues refunds itself, and any refund comes out of the creator's own balance.

If you believe a child has an account, tell us at hello@joinvybe.co.

Age confirmation for mature content

Some content on vybe is legitimate but not suitable for every viewer — physique photography, frank coaching on hormones or postnatal recovery, graphic rehabilitation imagery. Creators will be able to mark that content as mature, and to see it you will have to confirm you are 18 or over. The terms for creators are in section 4 of our Terms of Service.

When you confirm, we will store the fact that you confirmed and the date and time you did it, against your account. That is personal data, which is why it is set out here. We will keep it for [AGE CONFIRMATION RETENTION]. We will not ask you for a document, a date of birth or any other identity data to make that confirmation.

16. Changes to this policy

We will update this page when what we do changes, and change the "last updated" date at the top. If a change materially affects you, we will tell you directly rather than relying on you noticing.

17. How to complain

If it is about how a creator has used your data, raise it with the creator first — they are the controller and they can actually fix it. If you get nowhere, or the complaint is about vybe, email hello@joinvybe.co and we will respond within [RESPONSE TIME].

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk. You do not have to come to us first, though it is usually quicker if you do.