Privacy policy

1 In short

• We do not sell data. This site and the platform set no cookies and use no analytics or advertising trackers. See chapter 11.
• Your email address, phone number and rate are shielded from brands. Brands see a limited version of your profile without those three fields.
• Performance figures come from a screenshot you send yourself, or a brand enters them itself. Pikobello fetches nothing from Instagram, TikTok or YouTube and has no access to your accounts there.
• Brands and agencies can import lists of creators. People added that way signed nothing for it and get no message about the import itself. Read chapter 3: it is the part most likely to concern you without your knowing.
• Through Discover, brands and agencies can search for Belgian creators in SocialScout, another service of Boostique BV. If a brand invites you that way, you get at most one email from that brand, unless you reply. The brand never sees your email address. See chapter 4.
• Every email from us that is not about your own account has an unsubscribe link at the bottom. One click is enough and you get no more such emails, from any brand. See chapter 7.
• An agency may work for a brand and represent you at the same time. You are shown this before you apply.
• If you connect ChatGPT or Claude to Pikobello yourself, what that assistant reads in your workspace goes to OpenAI or Anthropic, under your own account with that provider. See section 2.10.
• Part of the processing happens in the United States: at Resend and Anthropic, and for WhatsApp also at Meta. Vercel, a US company, runs our servers in Paris. See chapter 10.
• You can ask for your data, have it corrected or have it deleted through hendrik@vibelab.be.

2 What data we keep

2.1 Account

To let you sign in, we keep your email address and an encrypted version of your password, together with the date your account was created and whether you are on the platform as a brand, as a creator or as a member of an agency. This happens in Supabase Auth, the authentication service the platform uses.

An account you create as a creator through WhatsApp has no email address and no password. For that account we keep your phone number, see chapter 6.

When you create your account, you confirm that you are 18 or older and that you agree to the terms of use and this privacy policy. We keep when you did that, the name you gave, which workspace it was for and which version of the terms applied at the time.

2.2 Creator profile

A creator profile can hold the following fields:

• name, username, short biography and profile picture;
• email address, phone number and rate;
• languages and time zone;
• handle, follower count and engagement rate per platform, for Instagram, TikTok and YouTube;
• whether the profile is active, and when it was created and changed.

What brands get to see of that profile is a shorter list. The database holds a separate, shielded version of your profile. Your email address, phone number and rate are deliberately left out of it. Those three fields are technically out of reach for a brand, even with a valid login. Visible are: name, biography, username, profile picture, languages, time zone, the three handles with their follower counts and engagement rates, whether your profile is active, and the date it was created.

That shielded version of your profile is visible to:

• you;
• a brand you have an active working relationship with;
• a brand whose campaign you applied to, also while that application has not been reviewed yet and also when it is eventually turned down;
• an agency that represents you, after you confirmed that representation yourself.

A brand you have nothing to do with cannot look up your profile and cannot check whether it exists.

2.3 Company profile

For a brand we keep its name, website, logo, two brand colours and a web address fragment. For an agency we keep its name, web address fragment, website and logo, and for each member which role and which permissions that person has within the agency.

2.4 Campaigns and applications

A campaign holds a title, a description, requirements, a payment structure, a budget, deadlines, a maximum number of applications, a status and whether it is public or by invitation only.

When you apply, we keep your proposal as free text, the amount you ask for, the platforms you want to publish on, the time you applied, the status of your application and, if it is turned down, the reason the brand gave. All of that is visible to the brand behind the campaign and to you.

2.5 Delivered work

A deliverable goes through five states: draft, changes requested, approved, published and rejected. We keep the platform, the type of content, the draft link, the link to the published post, the publication date, your own notes on the deliverable, the brand's feedback and the times it was submitted and reviewed.

The draft link is never overwritten at publication, so it stays visible afterwards exactly what the brand approved. Who may take which step is fixed in the database: the brand approves, asks for changes or rejects, and only you can mark a deliverable you submitted as published.

A brand, or an agency working for that brand, can add a published post of yours itself, with the link and the date, for example when you sent it outside the platform. Such a post is marked as added by the brand, and nobody can change that mark afterwards. If you are on that brand's list without an accepted application, the platform records you as accepted for it, with a note that the brand added you.

2.6 Performance figures from your own statistics

This is the most sensitive part of the platform, so it is described in full.

When you put a screenshot of your own statistics into your AI assistant, that assistant's model reads the figures from the image and sends them on to us as numbers. The image itself does not end up in our database today. What we do keep, per published post:

• for Instagram: views, accounts reached, percentage of followers and non-followers, total interactions, likes, comments, saves, shares, accounts engaged, profile activity, new followers, reel interactions and the split of interactions between followers and non-followers;
• for TikTok: video views, total watch time, average watch time, percentage who watched the full video, new followers, likes, comments, shares, saves, the split of traffic across For You, Following, search, your profile, sound and other sources, the search terms people came in through and the moment viewers drop off;
• for YouTube: views, watch hours, likes, comments, shares and subscribers;
• how the figures reached us, through which channel you passed them on, how confident the model was in its reading, and possibly the piece of raw text the model recognised in the image.

That last field deserves a warning: if the model sends along text from your screenshot, that text is stored as it is. If something irrelevant is visible in the image, it can be stored with it.

A brand, or an agency working for that brand, can also enter figures for your published post itself, for example from a screenshot you sent outside the platform.

Public figures we check ourselves. When a deliverable is published on TikTok, Instagram or YouTube, Pikobello also follows the public numbers of that post: views, likes and comments, and on TikTok also shares and saves. We check them 2 hours after publication, after a day, every day for two weeks and then every week until day 90. For TikTok and Instagram we do that through SocialScout, a service of Boostique BV itself (see chapter 4); for YouTube we ask Google's YouTube Data API. To SocialScout we send only the link of the post and your handle, never the brand, the campaign, the deal, your contact details or the figures from your screenshots. SocialScout keeps the post, its numbers and a copy of the video in private storage, and so does Pikobello, for the brand that ran the campaign. If you opted out of SocialScout, it keeps nothing about you: it passes the numbers and the video on to us and deletes its own copy within 48 hours. If you have your own Pikobello account, or published a post in a campaign, SocialScout also follows you as a public creator and refreshes your public profile every week. When you delete your account, we ask SocialScout to stop; if you were only in SocialScout because of Pikobello, you leave it.

The database checks your figures and adds flags to them. Those checks block nothing, they annotate. The database computes them itself, so nobody can send them along, suppress them or change them afterwards. The brand sees them together with the figures. These are the flags:

A flag is no accusation. It means the numbers do not add up with each other, which is usually a reading error by the model. You see the flag in the same conversation, in plain language, so you can correct it right away.

2.7 Messages

Messages within a campaign hold the text, who sent them, in which role, which campaign and application they belong to, when they were sent and when they were read. They are visible to the two parties in that conversation.

A message from a brand or agency can also reach you through WhatsApp or by email, see chapter 6 and chapter 7. If you answer through the link in such an email, your answer lands in the same conversation.

2.8 Connector keys

To connect Pikobello to your AI assistant, you get a key. We never store that key in readable form: only an irreversible encrypted fingerprint of it is in the database, together with the label you gave it, the date it was created, when it was last used and when it was revoked. The key itself is shown once, when it is created. After that, we cannot read it either. If you lose it, you create a new one and revoke the old one.

Whoever holds the key acts on the platform as you. Revoke it in your settings or through hendrik@vibelab.be as soon as you suspect it has been shared. Brands and agencies have their own kind of key, with the same rules.

2.9 Assistant in the workspace

Brands and agencies can ask an assistant questions in their workspace and use it to prepare work. What you type, the page you are on and the data the assistant looks up for it go to Anthropic, the provider of the AI model that answers. That is data from your own workspace: campaigns, applications, delivered work, figures, your roster and messages, including what creators wrote in them. This happens under our agreement with Anthropic. The assistant has the same access as you and sees nothing you cannot open yourself.

Anything a creator gets to see or hear, such as a message, an invitation, a decision on an application or on delivered work, or a payment, only happens after you confirm it yourself on a card. We keep your conversations with your account, so you can open them again later. Only you see them, and only while you still have access to the workspace where you had them. You can rename or delete a conversation at any time, and they disappear together with your account. For each question we also keep who asked it, when, how much the model processed and which steps it took, with an irreversible fingerprint of what it looked up. We keep the cards with what was on them and whether you confirmed them, and when the assistant could not do something, a short description of the question. That lets us trace what happened and see which help is still missing.

2.10 AI assistants you connect yourself

You can connect Pikobello to ChatGPT from OpenAI or to Claude from Anthropic, from your own account with that provider. To do so, you sign in to Pikobello and choose one workspace: a brand you manage, an agency with all its clients, or your creator profile. The connection exists only after you approve that choice. From then on, the assistant works in that workspace with your access and sees nothing you cannot open yourself.

What goes to the provider. When you ask the assistant something, it reads what it needs for that through Pikobello, from the workspace you chose. For a brand or agency, that means campaigns, applications, delivered work, figures, payments, your roster and messages, including what creators wrote in them, and the results when you search for new creators. For a creator profile, it means your own profile, campaigns, applications, deliverables, figures and messages. What the assistant reads goes to OpenAI or Anthropic together with what you type. That happens under your own account and agreement with that provider, and under your responsibility. Their terms and privacy policy say what they do with it. Through this connection, Pikobello sends them nothing on its own initiative: they receive only what your assistant asks for, at the moment it asks.

If you are a creator, be aware that a brand or agency you work with can make such a connection. What that brand or agency may see about you, as described in section 2.2 and chapter 9, can then reach the provider of their assistant. If you have your own account, your email address, phone number and rate are not part of that, because the brand cannot read them either.

What the assistant can change. The assistant can also do work, such as setting up a campaign as a draft, reviewing an application, inviting creators or sending a message. In a brand or agency workspace, Pikobello asks the assistant to show a preview first, without changing anything, and to carry out the change only after you agree. That applies to everything that reaches a creator, such as a message, an invitation, a decision on an application or deliverable, or a payment you record. ChatGPT and Claude also ask for your permission by default before they use a tool that changes something. You manage that setting with them. The assistant cannot move money: recording a payment is a note, and no payment runs through the platform.

What we keep. For each connection we keep which app made it, with what that app says about itself, such as its name and the address you return to after signing in. We also keep which workspace the connection is for, when you approved it, when it was last used and when it was revoked. We never store the keys the app gets from us in readable form. An access key works for one hour. After that, the app gets a new one with a refresh key, which stays valid for sixty days and is replaced every time it is used. We clear out expired keys and sign-in requests every night.

In a brand or agency workspace, for each tool the assistant used, we record who asked, for which brand or agency, when, how long it took, whether it worked and whether it was only a preview, with an irreversible fingerprint of what the assistant asked for. We do not keep the content of those requests and answers, and we do not see your conversations in ChatGPT or Claude. These records can be read by the person who asked, by the owner of the brand and by members of an agency who have read access to that brand. A request about the agency itself, with no client, is read by the owners and admins of that agency. For a creator profile, we keep no such record per tool.

Disconnecting. You revoke a connection under Connected apps: for a brand under Settings, for an agency under Settings & team, for a creator profile under Connections. From the next request on, the app has no access anymore. If you only remove the app in ChatGPT or Claude, revoke it with us as well, so keys that app may still hold stop working. If you lose access to the workspace, for example because an agency removes you as a member or because a brand changes owner, the connection also stops working from the next request.

2.11 Requests through a link, and files

A brand, or an agency working for a brand, can ask someone for one thing through a link: the figures of a post, a file, agreements about a collaboration, or consent to be represented by an agency. An invitation to a campaign works the same way. The link goes by email to the address the brand gives, works without an account, takes one answer and expires after seven days.

We keep the request with the email address, the brand's message, who asked and the status, and then your answer. A file can be up to 25 MB: an image, a PDF or a video. We keep it in shielded storage, together with the file name, the type, the size and the time. Only the brand that asked, and an agency working for that brand, can open it. Your answer changes nothing by itself: the brand then decides whether it accepts your answer.

3 Creators added by a brand or agency

An import can create these fields without your involvement:

• your name, which is the only required field;
• your email address;
• your handles and follower counts for Instagram, TikTok and YouTube;
• a short description of what you make, taken from the source list;
• your rate, your languages and your time zone.

A brand or agency can also keep your phone or WhatsApp number and its own notes on you. Only that organisation sees them.

Such a record is held in the name of the organisation that entered it. That organisation can read it back, including the email address, and update it in a later import. We do not contact you on our own initiative. Sending an invitation is a separate, explicit action the brand has to take itself.

If the brand invites you, opens a campaign to its own list of creators or sends you a message, Pikobello sends you an email in that brand's name. It says which brand it is, and has an unsubscribe link at the bottom. We never use contacts a brand entered for another brand's campaign.

As soon as you claim the record and link your own login to it, that organisation's access to the full record stops immediately. From then on you fall back to the shielded profile version from section 2.2 and you manage your data yourself.

The legal basis. For these records, the importing organisation acts as controller and relies on its legitimate interest (Article 6(1)(f) GDPR) in being able to approach professional creators for paid collaborations. This concerns professional data that the person concerned makes public themselves. Pikobello acts as processor on behalf of that organisation. Our terms of use state that an organisation may only import what it obtained lawfully and that it remains responsible itself for informing the people concerned.

What you can do. You have the right to object to this processing, without giving a reason. Send an email to hendrik@vibelab.be with the name or handle you suspect you were added under. We check whether a record exists, tell you which organisation entered it and which fields it holds, and delete it at your request. We ask for no proof of identity beyond what is needed to be sure we have the right record. See also the page on having your data deleted (in Dutch). If you only want the emails to stop, use the unsubscribe link at the bottom of the email, see chapter 7.

4 Creators a brand finds through Discover

Brands and agencies can search for Belgian creators in Pikobello through Discover. The search runs on SocialScout (socialscout.be), another service of Boostique BV, the same operator as Pikobello. SocialScout keeps public profile data of Belgian creators. Discover only searches SocialScout and cannot search the accounts on Pikobello.

What a brand gets to see. Your name, your profile picture, your handles on Instagram and TikTok, your follower counts, your niches, the language you make content in, a short bio with any email addresses or phone numbers taken out, the median of your views and the formats you use most. Your profile card also shows your best-viewed recent videos, with figures and a link, and the brands you publicly mentioned working with. Your email address is not part of it: the brand only sees whether an address is known.

What we keep at Pikobello. As long as a brand only searches or looks at your profile card, Pikobello keeps nothing about you. If a brand or agency adds you to its list, or invites you, we keep a copy of that public profile in our database, with a link to SocialScout. We update that copy from SocialScout every night. If SocialScout no longer shows you, for example because you opted out there, those updates stop.

The one email. If a brand invites you to a campaign, Pikobello asks SocialScout for your public business email address, unless the brand already has an address for you. We send you one email in that brand's name. It says which brand invites you, where we got your address, and has a link to unsubscribe in one click. We keep the address with the copy of your profile, only to send such invitations. Brands and agencies never get to see it. A second email from the same brand only comes after you replied first. We record which brand invited you and when, so the database enforces that rule itself.

The legal basis. For Discover, Boostique BV is the controller. We rely on our legitimate interest and that of the brands (Article 6(1)(f) GDPR): brands look for creators for paid collaborations, and creators with a public business profile get assignments offered that way. We weigh that against your privacy and therefore keep it small: we only use data you made public yourself, you get at most one email per brand, the brand never sees your address, and one click takes you out.

What you can do. You can always object, without giving a reason. Click the unsubscribe link in the email: from then on Pikobello sends that address no email at all, from any brand, except emails about an account of your own. If you also want to disappear from the lists of brands and agencies, email your name or handle to hendrik@vibelab.be. We delete the copy of your profile at Pikobello, including at every brand and agency that added you. If you ask, we also take you out of SocialScout, so brands no longer find you there.

5 Agencies and conflicts of interest

An agency is a third party that can act for a brand and represent creators at the same time. Both sides work with explicit permissions per area, such as campaigns, applications, roster, figures and messages. For you as a creator, the representation also only takes effect after you confirmed it yourself. The moment of that confirmation and who gave it are recorded. If you withdraw it, access ends at the next request.

On this platform, an agency may act for both parties at once. If an agency works for brand Y and represents you, it may approve or turn down your application to brand Y itself. Nothing blocks this. The safeguard is transparency, and it works in two ways:

• An overlap between a brand and a creator who belong to the same agency is computed at that moment and is visible to all three parties, including you. If either tie is withdrawn, the notice disappears at once. It cannot linger as an outdated mention.
• You can also ask for your agency's active client list in advance, so before you apply anywhere. You see the brands, the permissions and the status. You see nothing about that agency's fees and nothing about other creators.

We also log which agency member took which action on behalf of a brand, with the time. That log lets a brand check its own agency, and creators cannot see it. It is mentioned here because it concerns personal data of agency staff, and because you have a right to know this log exists.

6 WhatsApp

As a creator, you can also use Pikobello in WhatsApp, on the number +32 456 40 04 90, without installing anything. You send screenshots of your statistics there and handle your campaign work.

Linking your number. Send a message to that number. You get a link back to a short page on app.pikobello.ai. That link works for ten minutes.

• If you are new, you enter your name and tick that you are 18 or older and agree to the terms of use and this privacy policy.
• If you already have an account, you confirm it is yours with a code we send to your email address, or because you are already signed in in that browser. If you use an authenticator app, we ask for that code too.

The page then shows an eight-digit activation code. You send it back in the same WhatsApp conversation. Only then does the connection exist, and only then do we create a new account. Someone who only has the link therefore cannot attach an account to your number. A new account created this way has a phone number, but no email address, no password and no web login.

If you send STOP, we disconnect WhatsApp and pending connection attempts lapse. Your account and your campaign work stay. With START you ask for a new link later.

What we keep for the connection. The number, the account it belongs to, when the connection started and, if it did, when it ended, the message you activated it with and which version of the terms you accepted then. Of the link and the activation code, we keep only an irreversible fingerprint. Messages with such a code or link are stored without that code or link, and they never go to the AI model. A message only belongs to your account through such an activated connection. We never link on the basis of a number you typed somewhere in your profile, and never to a profile a brand or agency created for you.

What we store for each incoming message:

• the phone number the message comes from, in international format, and the message number Meta gives it;
• the time Meta says the message was sent and when we received it;
• the message type and the text of the message, including the caption of an image;
• the reference to the attached image or file at Meta, without the image itself;
• the full content of the message as Meta delivers it. Among other things, it contains the sender's WhatsApp profile name.

This data is shielded from every browser session on the platform. Brands and agencies cannot reach it, even with a valid login.

The assistant. From a linked number you talk to an assistant. Your messages from the last 24 hours, at most thirty from you and thirty from us, and an attached image go to Anthropic, the provider of the AI model that answers and reads the figures from a screenshot. That happens under our own agreement with Anthropic. The assistant only acts on your own data, with the same access as your AI assistant has through the connection. We keep our replies, with the steps the assistant took to reach them. We do not keep the bytes of the image; what remains are the numbers that were read. We record those as reported figures on a published post of yours in an ongoing collaboration, preferably on the same platform and without earlier figures, with a note that they came in through WhatsApp and were read by a model. The brand behind that campaign sees them as it sees any reported figure. With a web login you can correct or delete them in your dashboard; otherwise ask through hendrik@vibelab.be.

If you wrote to us through WhatsApp in the last 24 hours, a message from a brand or agency can also reach you there.

The WhatsApp traffic itself is also covered by the terms and privacy policy of WhatsApp Ireland Limited and Meta Platforms.

7 The emails we send, and how to stop them

All Pikobello emails go out through Resend, an American email service. Today they come from an address on vibelab.be, the operator's domain. There are two kinds.

Emails about your account. Confirming your email address, resetting your password, a sign-in or verification code, or confirming a change of your email address. You only get these when you ask for them yourself. They keep coming, also after you unsubscribe, because your account does not work safely without them.

All other emails. We send these because someone on the platform wants something with you:

• an invitation to create an account, or to take over the page an agency created for your brand;
• an invitation to a campaign, also when a brand found you through Discover;
• a request through a link, such as a request for figures, a file or agreements, see section 2.11;
• a message from a brand or agency, when it does not reach you through WhatsApp;
• a notice from an agency that represents you, or that acts for a brand whose list you are on.

Every one of those emails has an unsubscribe link at the bottom. One click is enough: from then on Pikobello sends that address no email at all, from any brand or agency, except emails about an account of your own. You can also ask through hendrik@vibelab.be. We then keep your address on an unsubscribe list, only to respect that choice. You then also get no invitations or messages from brands by email. If you have an account, your conversations stay in the app.

For each email we keep which address it went to, what kind of email it was, for which brand, when, whether sending worked, and the number Resend gave it. The brand sees that an email went out and whether that worked, but not to which address.

8 Why we use it, and on what legal basis

We take no automated decisions with legal effects for you. The flags from section 2.6 are computed automatically, and the brand then decides itself, as a person, whether it approves or rejects your work.

9 Who gets to see your data

• The brand behind a campaign sees your shielded profile, your application with your proposal and the amount you asked for, your deliverables and your reported figures with their flags. Your email address, phone number and rate are not in that profile.
• An agency sees what the brand sees, for the brands it acts for and within the permissions that brand gave. If it represents you and you confirmed that, it also sees what that representation allows.
• A brand or agency that found you through Discover sees the public profile data from chapter 4, never your email address.
• Other creators see nothing of you. Creators cannot look each other up on Pikobello.
• Brands with no tie to you see nothing of your account and cannot check whether you are on the platform. Discover searches SocialScout and cannot search the accounts on Pikobello.
• Public authorities only receive data when we are legally required to provide it, for example when we have to report an offence that threatens someone's life or safety.

These limits live in the database itself, as access rules on every row. The screens you see only show what the database allows, so a mistake in a screen cannot release data the database already refuses.

10 Processors and where the data is stored

The connector server your AI assistant talks to keeps no content of what the assistant asks or gets back. For each request, it turns your key into temporary database access that lasts sixty seconds. What it does record is described in section 2.10: the connection itself and, in a brand or agency workspace, which tool ran. That server runs at Vercel in Paris, like the server behind WhatsApp.

Data outside the EU. Resend, Anthropic and Google are American companies, and Meta also processes WhatsApp data in the US. What passes through them therefore goes to the United States. Vercel is an American company too: our servers run in its Paris region, but Vercel can reach them from the US. For that transfer we rely, where applicable, on the EU-U.S. Data Privacy Framework for suppliers certified under it, and otherwise on the European Commission's standard contractual clauses.

SocialScout is a service of Boostique BV itself and is therefore not in this table, see chapter 4 and section 2.6. Every supplier works with its own subcontractors. For that list, or more explanation of the safeguards above, email hendrik@vibelab.be and you will get them.

11 Cookies and storage in your browser

This site and the platform set no cookies, use no analytics and do not track you, also not across other sites. The site at pikobello.ai stores nothing in your browser. The web app at app.pikobello.ai only stores what it needs to work, or a choice you made yourself:

• In localStorage, which stays until you clear it: your sign-in session, which disappears when you sign out, whether you want the assistant full screen, and per campaign which parts you want in a report export.
• In sessionStorage, which disappears when you close the tab: what you already filled in while setting up your account, which conversation with the assistant was open, and a recovery copy of a campaign you are saving, so it is not lost if the connection drops.

That data stays in your browser, and we use it for nothing else. Because it is strictly necessary storage and your own settings, we do not ask for consent. You can always clear it in your browser; you then sign in again.

Your browser loads profile pictures and logos directly from the address where they are online. Whoever serves that image can then see your IP address, as with any image on the web.

12 How long we keep it

No automatic deletion is set up today, with one exception: we clear out the expired keys and sign-in requests of connected AI assistants from section 2.10 every night. Data is kept for as long as your account exists or, for an imported record, for as long as the organisation that entered it keeps it. We say this explicitly instead of naming a retention period the system does not enforce.

A copy of a profile from SocialScout stays as long as a brand or agency keeps you on its list, or until you ask for deletion. We keep an unsubscribe for as long as we send emails, because otherwise we cannot respect it.

When your account is deleted:

• your profile, your applications, your deliverables, your reported figures, your messages, your connector keys, the AI assistants you connected, your WhatsApp connection and your ties with brands and agencies go with it;
• the records of tools you used in a brand or agency workspace, from section 2.10, stay with that brand or agency, without any reference to you;
• every WhatsApp message received earlier loses its link to your account, but stays stored with the phone number in it. Ask for it explicitly and we delete those messages too. See the page on having your data deleted (in Dutch);
• your email address stays on the unsubscribe list if you ever unsubscribed, so we do not email you again.

We do keep what we are legally required to keep, such as billing data for our bookkeeping.

13 Security

• Every table in the database has access rules per row. The database decides who may see what; the application does not.
• Connector keys and the keys of AI assistants you connect are never stored in readable form. The fingerprints we do keep are technically out of reach for a browser session.
• Your email address, phone number and rate are outside the profile version brands read.
• Every incoming WhatsApp message is checked for its signature. A message that cannot be shown to come from Meta is refused and not stored.
• Files from a request are kept in shielded storage. They can only be opened through a link we create each time, which works for five minutes.
• Links in our emails, such as a request, a reply link or an unsubscribe link, are only stored as an irreversible fingerprint.
• Traffic runs over encrypted connections and passwords are never stored readably.

If you suspect a leak or an error, let us know through hendrik@vibelab.be. Reports are taken seriously and answered.

14 Your rights

Under the GDPR you have the following rights. They also apply if you never created an account and are only in the system as an imported record.

• Access. Ask whether we hold data about you, which data, and what for.
• Rectification. Have incorrect data corrected.
• Erasure. Have your data deleted.
• Restriction. Have its use paused while a dispute is ongoing.
• Portability. Get your data in a machine-readable file, or have it sent directly to another provider.
• Objection. Object to processing based on legitimate interest, including an imported record or a profile from Discover. For emails, the unsubscribe link is enough.
• Withdrawing consent. Where we rely on consent, such as representation by an agency, you can withdraw it at any time. What happened before remains lawful.

Send your request to hendrik@vibelab.be. You get an answer within one month. If it takes longer, we tell you within that month, with the reason. We charge nothing for a first request.

15 Filing a complaint

If you are unhappy with how we handle your data, tell us first. You can also file a complaint directly with the supervisory authority. In Belgium, that is the Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be. If you live in another EU member state, you can turn to the supervisory authority of your own country.

16 Changes to this policy

When the platform changes, this page changes with it. The date and the version at the top say when it was last updated. For a change that really matters, such as a new kind of data or a new recipient, we inform users with an account directly.