Legal

1.1 Data Controller

The data controller responsible for processing your personal data within the meaning of Art. 4(7) GDPR and Art. 1 UAE PDPL is:

Nova Sales Digitalisation – FZCO
Dubai Silicon Oasis, Dubai Digital Park, Building A1
Dubai, United Arab Emirates
Email: privacy@vibe-space.ai

1.2 EU Representative (Art. 27 GDPR)

Because Nova Sales Digitalisation – FZCO is established outside the European Union but offers services to data subjects in the EU/EEA, we have designated an EU Representative pursuant to Art. 27 GDPR. EU/EEA residents may contact our representative in addition to (or instead of) us:

Email: eu-representative@vibe-space.ai

A UK Representative under Art. 27 UK GDPR is reachable at uk-representative@vibe-space.ai.

1.3 Scope of this Policy

This Privacy Policy applies to: (a) the website vibe-space.aiand all sub-domains; (b) the Vibe Space dashboard, billing, support and affiliate portals; and (c) the Vibe Space desktop application (collectively, the “Service”). It explains what personal data we collect, on what legal basis, with whom we share it, how long we keep it, and the rights you have.

1.4 Local-First Architecture — What Stays on Your Device

Vibe Space is built on a local-first principle. The following data never leaves your device unless you explicitly enable a sync feature or transmit it yourself (e.g. by sending it to a third-party LLM provider you configure):

• Your prompts and conversations with language models
• Source code, documents and other files you open or edit
• Project metadata, agent configurations and workspaces
• Any API keys for third-party LLM providers (stored encrypted in the operating-system keychain)
• Local model weights and embeddings

The desktop application communicates with our servers only for the following narrowly scoped purposes: (i) license validation (approximately every 60 minutes); (ii) software-update checks; (iii) optional anonymous crash reports and aggregated usage metrics if you opt-in; (iv) features you actively initiate that require a server round-trip (such as account login, syncing settings between devices, or submitting a support ticket).

When you use Vibe Space to send a request to a third-party LLM provider (e.g. OpenAI, Anthropic, Google, Mistral or a self-hosted model), the request travels directly from your device to that provider using the API key you configured. The content of those requests does not pass through, and is not stored on, our servers.

1.4a Remote Access (Optional Browser-to-Desktop Bridge)

The optional Remote Access feature lets you control your running Vibe Space desktop application from any browser at vibe-space.ai/remote. Frames are end-to-end encrypted between your desktop and your browser; our relay server only routes ciphertext and cannot read the data passing through it.

• Encryption: X25519 key agreement combined with AES-256-GCM, derived per pairing via HKDF-SHA256. The session keys are generated on your devices and never leave them.
• Pairing: a desktop-side approval prompt confirms each new browser before any session is established. Desktop identity is verified Trust-On-First-Use via an Ed25519 signature.
• Server-side data we retain per pairing event: the session identifier, your user identifier, a salted SHA-256 hash of your IP address, the user-agent string of the paired browser and the public keys exchanged. This audit log is retained for 90 days for security and abuse-prevention purposes (Art. 6(1)(f) GDPR).
• What we cannot see: chat content, terminal output, canvas data, file contents or any other plaintext flowing through the relay. Our servers observe only encrypted bytes and routing metadata.
• Revocation: you can manage approved browsers at any time at /remote/devices. Revoking a device immediately closes any open session for it.

1.5 Categories of Personal Data We Collect

(a) Account & profile data

Name, email address, password hash (salted with bcrypt; we never store passwords in clear text), profile image URL, time zone, language preference, two-factor-authentication settings and recovery codes (encrypted at rest), email-notification preferences.

(b) Authentication data

OAuth identifiers and basic profile fields if you sign in with Google or Apple, JWT session tokens (stored as http-only secure cookies), session metadata (IP address, user-agent, last-seen timestamp) for security and the device-management UI.

(c) Subscription & billing data

Subscription plan and status, billing address, VAT/Tax ID, payment-method metadata returned by Stripe or PayPal (we do not store full card numbers), invoice history, payment events, refund and chargeback records, coupon usage. Affiliate payout details (IBAN or PayPal email) are encrypted at rest with AES-256-GCM.

(d) Device & license data

Device identifier, operating system, hostname, app version, license-token hash, last activation timestamp. Used to enforce seat limits and to let you remotely revoke devices.

(e) Support & communication data

Support tickets and replies, file attachments you upload to tickets, email correspondence, newsletter subscription status.

(f) Usage & technical data

IP address, request logs (path, status code, latency, truncated user-agent), referrer header for the marketing pages, error and crash data. Logs are retained for a maximum of 30 days unless they relate to a security incident.

(g) Special categories

We do not knowingly process special categories of personal data within the meaning of Art. 9 GDPR (health, biometric, political opinions, religious beliefs, etc.). Please do not submit such data through prompts, support tickets or profile fields.

1.6 Legal Bases for Processing

We process personal data only when at least one of the following legal bases under Art. 6(1) GDPR (and the equivalent provisions of the UAE PDPL) applies:

• Performance of a contract (Art. 6(1)(b) GDPR) — to deliver the Service you subscribed to, manage your account, process payments and provide support.
• Legal obligation (Art. 6(1)(c) GDPR) — to retain invoices and tax records, to respond to lawful requests from competent authorities, and to comply with anti-money-laundering and consumer-protection rules.
• Legitimate interest (Art. 6(1)(f) GDPR) — to secure the Service against abuse, to prevent fraud, to operate basic server logs, and to improve product quality through aggregated analytics. We have weighed our interests against your fundamental rights and consider these activities proportionate.
• Consent (Art. 6(1)(a) GDPR) — for marketing emails and optional product analytics. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

1.7 Recipients & Sub-Processors

We engage a limited number of trusted sub-processors under written data-processing agreements (Art. 28 GDPR). All sub-processors are bound to confidentiality and to processing personal data only on documented instructions:

We do not engage any sub-processor that holds itself out as providing “analytics” through cross-site tracking pixels. We do not use Google Analytics, Meta Pixel or similar third-party trackers on the marketing website.

1.8 International Data Transfers

Production data is stored on servers located in Germany. Where personal data is transferred to a country outside the EU/EEA (for example, to our affiliated entity in the UAE for company administration, or to a sub-processor in the United States for payment processing), we rely on one of the following safeguards under Chapter V GDPR:

• Adequacy decisions of the European Commission, including the EU-US Data Privacy Framework (DPF) for certified US recipients.
• Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914, combined with supplementary technical and organisational measures.
• Transfer Impact Assessments (TIA) for any transfer to a third country, performed in accordance with the EDPB Recommendations 01/2020.

A copy of the relevant safeguards can be requested from privacy@vibe-space.ai.

1.9 Data Retention

We keep personal data only as long as necessary for the purposes for which it was collected, after which it is deleted or irreversibly anonymised:

• Account data: for the lifetime of your account; deleted within 30 days after you close your account.
• Invoices & tax records: retained for 10 years from the end of the calendar year in which they were issued, in accordance with German § 147 AO and UAE Federal Tax Authority record-keeping rules.
• Server access & security logs: up to 30 days, then deleted — longer only when required to investigate a specific security incident.
• Support tickets: up to 3 years after the last interaction.
• Marketing-consent records: until you withdraw consent and for an additional 3 years to evidence the prior lawful basis.
• Backups: encrypted, rolling 30-day window, after which they are overwritten.

1.10 Security Measures

We implement technical and organisational measures appropriate to the risk pursuant to Art. 32 GDPR, including:

• TLS 1.2+ for all network traffic, HSTS preloaded
• Encryption at rest for sensitive fields (AES-256-GCM) and full-disk encryption on servers
• Salted bcrypt password hashing
• RSA-256 signed license tokens with short expiry
• Optional two-factor authentication (TOTP) for accounts
• Hardened access controls, principle of least privilege, audit logging on the admin panel
• Regular dependency updates, vulnerability scanning and external penetration testing
• Encrypted, geographically separated backups; documented business-continuity procedures

1.11 Your Privacy Rights

EU/EEA, UK and Switzerland (GDPR / UK GDPR / FADP)

You have the right to:

• access the personal data we hold about you (Art. 15);
• rectify inaccurate or incomplete data (Art. 16);
• eraseyour personal data (“right to be forgotten”) (Art. 17);
• restrict processing (Art. 18);
• portability— receive your data in a structured, machine-readable format (Art. 20);
• object to processing based on legitimate interests, including profiling (Art. 21);
• withdraw consent at any time without affecting the lawfulness of past processing (Art. 7(3));
• not be subject to fully automated decisions with legal or similarly significant effects (Art. 22);
• lodge a complaint with a supervisory authority — in particular the supervisory authority of your habitual residence. Because our production systems are hosted in Germany, you may also contact the competent state DPA (e.g. HmbBfDI, LfDI BW) or the Federal Commissioner (BfDI).

United Arab Emirates (PDPL)

Under UAE Federal Decree-Law No. 45 of 2021, you have the right to: request information about the processing; access your personal data; correct or erase data; restrict or stop processing; object to automated decisions; transfer your data; and file a complaint with the UAE Data Office (Data Protection Office).

California (CCPA / CPRA)

California residents have the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate information, the right to opt-out of the “sale” or “sharing” of personal information (we do not sell or share personal information as those terms are defined under the CCPA), the right to limit the use of sensitive personal information, and the right to non-discrimination for exercising your privacy rights.

Other jurisdictions

Residents of Brazil (LGPD), Canada (PIPEDA / Quebec Law 25), Australia (Privacy Act / APPs), South Africa (POPIA), Japan (APPI), South Korea (PIPA) and other jurisdictions with comprehensive privacy laws have substantially equivalent rights. To exercise any right, contact us at privacy@vibe-space.ai. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice) and free of charge for the first reasonable request.

1.12 Children's Privacy

Vibe Space is not directed at children. The Service is intended for users aged 16 or older (or the higher age of digital consent applicable in your country, e.g. 13 in the United States under COPPA, 18 in some Middle Eastern jurisdictions). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@vibe-space.ai and we will delete it.

1.13 Data-Breach Notification

In the event of a personal-data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority within 72 hours of becoming aware (Art. 33 GDPR / Art. 9 UAE PDPL). Where the breach is likely to result in a high risk, we will also notify affected data subjects without undue delay (Art. 34 GDPR).

1.14 Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or via an in-product notice at least 14 daysbefore they take effect. The “Last updated” date at the top of this page reflects the most recent revision; an archive of previous versions is available on request.

1.15 How to Contact Us

For any privacy-related question or to exercise your rights, please contact our privacy team at privacy@vibe-space.ai. We may verify your identity before responding to a rights request, in particular where such request concerns sensitive or large amounts of data.

2.1 Our Approach

Vibe Space uses only strictly necessary cookies and a small number of functional storage entries to operate the authenticated parts of the Service. We do not use third-party advertising cookies, cross-site tracking pixels or analytics-fingerprinting techniques on the marketing website, and therefore no cookie-consent banner is required for first-party essential cookies under § 25(2) TDDDG.

2.2 Cookies We Set

Stripe Checkout and PayPal pages may set their own cookies on their respective domains during the payment flow. Those cookies are governed by the privacy policies of Stripe and PayPal respectively.

2.3 Browser Controls

You can configure your browser to block or delete cookies at any time. Disabling essential cookies will prevent you from logging in or maintaining a session. Most browsers also offer a Do Not Track or Global Privacy Control signal; we honour the GPC signal as a valid opt-out request under the CCPA.

3.1 Acceptance of these Terms

By creating an account, downloading or installing the Vibe Space desktop application, or otherwise using the Service, you acknowledge that you have read, understood and agree to be bound by these Terms of Service (the “Terms”) and by our Privacy Policy. If you do not agree, you must not use the Service.

3.2 Definitions

• “We”, “us”, “our” — Nova Sales Digitalisation – FZCO.
• “You”, “User” — the individual or entity using the Service.
• “Service” — the Vibe Space website, dashboard, APIs and desktop application.
• “Subscription” — the paid plan that grants access to premium Service features for a fixed billing period.
• “Content” — any data, prompts, code, files, output or other material that you create, upload or generate through the Service.

3.3 Eligibility & Account

You must be at least 16 years old (or the higher age of majority in your jurisdiction) to use the Service. By registering, you represent that the information you provide is accurate and that you are not located in, or a national or resident of, any country subject to comprehensive EU/UN/UAE sanctions, nor on any restricted-party list. You are responsible for safeguarding your credentials and for all activity under your account; please enable two-factor authentication.

3.4 Plans, Pricing & Billing

Subscription fees are denominated in US Dollars (USD) and are stated exclusive of any applicable VAT, sales tax or other indirect tax, which will be added at checkout based on your billing location. Payment is processed by Stripe or PayPal. Prices may change with at least 30 days' prior notice; the new price will apply at the start of the next billing period.

3.5 Free Trials & Promotions

We may offer free trials or promotional pricing from time to time. Trials automatically convert into a paid Subscription at the end of the trial period unless you cancel before the trial ends. Promotional pricing applies for the period stated in the offer; thereafter, the standard price applies.

3.6 Auto-Renewal & Cancellation

Subscriptions renew automatically at the end of each billing period at the then-current price until cancelled. You can cancel at any time from your dashboard; the cancellation takes effect at the end of the current billing period and you will retain access to paid features until then. No partial refunds are issued for unused time within a billing period, except where required by applicable consumer-protection law.

3.7 Right of Withdrawal (EU/EEA & UK Consumers)

If you are a consumer resident in the EU/EEA or UK, you have the right to withdraw from a distance contract within 14 dayswithout giving any reason (Art. 9 Directive 2011/83/EU; § 355 BGB).

Express request for immediate performance. Because the Service is a digital service that begins immediately upon subscription, you expressly request that performance begin during the withdrawal period and you acknowledge that you will lose your right of withdrawal once the Service has been fully provided (§ 356 (5) BGB / Art. 16(m) Directive 2011/83/EU). For downloadable content (the desktop app), the withdrawal right also expires once the download begins, again subject to your express prior consent and acknowledgement.

A model withdrawal form is available at legal@vibe-space.ai.

3.8 Refunds

Outside the statutory withdrawal right described above, fees are non-refundable. We may, at our discretion, grant a goodwill refund in cases of duplicate billing, demonstrable non-performance, or as required by applicable consumer-protection laws (including UAE Federal Law No. 15 of 2020 on Consumer Protection).

3.9 License Grant for the Desktop Application

Subject to your compliance with these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable licence to install and use the Vibe Space desktop application on the number of devices included in your Subscription, solely for your personal or internal business use. You may not (a) reverse-engineer, decompile or disassemble the application except to the extent permitted by mandatory law; (b) remove or alter any proprietary notices; (c) sublicense, lease, sell, resell or otherwise commercially exploit the application; or (d) use the application to build a competing product.

3.10 Acceptable Use

You agree not to use the Service to:

• violate any applicable law or regulation;
• infringe the intellectual-property, privacy or other rights of any third party;
• generate or distribute child sexual-abuse material, content inciting violence, terrorism or hatred, or content that facilitates fraud;
• attempt to gain unauthorised access to the Service, other accounts, computer systems or networks;
• send unsolicited bulk communications, malware, viruses or other harmful code;
• interfere with the integrity, performance or availability of the Service (including denial-of-service attacks);
• scrape, crawl or otherwise extract data from the Service beyond what is permitted by our published APIs;
• circumvent rate limits, license enforcement or technical restrictions.

3.11 Third-Party LLM Providers & APIs

Vibe Space lets you connect to third-party language-model providers (e.g. OpenAI, Anthropic, Google, Mistral, local models). Your use of those providers is governed by their own terms and privacy policies. You are solely responsible for: (a) obtaining the necessary subscriptions and API keys; (b) ensuring that any data you submit to a provider is permitted under applicable law; and (c) the cost and consequences of any requests sent through your account.

3.12 Service Availability & Updates

We strive for high availability but do not guarantee that the Service will be uninterrupted, error-free or free of security vulnerabilities. We may release updates, modify features or discontinue parts of the Service. Material adverse changes to paid features will be notified at least 30 days in advance and will entitle affected paying users to a pro-rata refund for the remainder of the prepaid period.

3.13 Intellectual Property & Your Content

The Service, the Vibe Space brand, the desktop application and all related software, designs and documentation are owned by us or our licensors and are protected by copyright, trademark and other intellectual-property laws.

You retain all rights in your Content. Because the desktop application is local-first, your Content generally never reaches our servers. Where you do submit Content to us (e.g. as a support-ticket attachment or a bug-report log), you grant us a limited, worldwide, royalty-free licence to host, display and process that Content solely for the purpose of providing the Service to you.

3.14 Beta & Experimental Features

Features clearly labelled “beta”, “preview”, “experimental” or similar are provided “as is” and may be modified or discontinued at any time. They are not covered by any service-level commitment.

3.15 Disclaimers

Except as expressly set out in these Terms and to the maximum extent permitted by applicable law, the Service is provided “as is” and “as available” without warranties of any kind, whether express, implied or statutory, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy of AI-generated output, or freedom from defects.

3.16 Limitation of Liability

To the maximum extent permitted by law, our total aggregate liability for any claim arising out of or relating to the Service is limited to the amount you paid us for the Service during the twelve (12) months preceding the event giving rise to the claim. We will not be liable for indirect, incidental, special, consequential, exemplary or punitive damages, lost profits, lost data or business interruption.

The foregoing limitations do notapply to: (i) our liability for death or personal injury caused by negligence; (ii) fraud or fraudulent misrepresentation; (iii) wilful misconduct or gross negligence; (iv) liability under §§ 1, 4 ProdHaftG or equivalent product-liability statutes; or (v) any other liability that cannot be limited or excluded under mandatory law (in particular under EU consumer law and German § 309 No. 7 BGB).

3.17 Indemnification

If you use the Service in a commercial capacity, you agree to indemnify and hold us harmless against any third-party claim, loss or expense (including reasonable legal fees) arising out of (a) your breach of these Terms; (b) your violation of any law or third-party right; or (c) your Content. This clause does not apply where you are acting as a consumer.

3.18 Suspension & Termination

We may suspend or terminate your account with immediate effect if (a) you materially breach these Terms; (b) we are required to do so by law or by a competent authority; or (c) we reasonably believe your continued use creates a security or fraud risk. Where reasonable and permitted, we will give you prior notice and an opportunity to cure. On termination, your right to use the Service ceases; sections that by their nature should survive (IP, disclaimers, limitation of liability, governing law) will survive.

3.19 Force Majeure

Neither party is liable for failure to perform due to events beyond its reasonable control, including natural disasters, war, terrorism, civil unrest, government action, labour disputes, internet or power outages, or large-scale cyber-attacks.

3.20 Export Controls & Sanctions

The Service may be subject to UAE, EU, UK, US and other export controls. You represent that you will not use, export or re-export the Service in violation of any applicable embargo, trade-sanctions programme or restricted-party list.

3.21 Governing Law & Jurisdiction

These Terms are governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, excluding its conflict-of-law rules and excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG).

Subject to mandatory consumer-protection rules (see below), the courts of Dubai, UAE have exclusive jurisdiction over any dispute arising out of or in connection with these Terms.

3.22 Mandatory Consumer Rights

Nothing in these Terms removes or limits any right you have as a consumer that cannot be waived under the mandatory law of your country of residence. In particular, EU/EEA consumers may always bring proceedings before the courts of their place of residence (Art. 18 Brussels I-bis Regulation) and benefit from the protective provisions of the law of that country (Art. 6 Rome I Regulation).

3.23 Changes to these Terms

We may amend these Terms from time to time. We will notify you of material changes by email or in-product notice at least 30 days before they take effect. If you do not agree to the changes, you may cancel your Subscription before the effective date. Your continued use after that date constitutes acceptance.

3.24 Miscellaneous

These Terms, together with the Privacy Policy, constitute the entire agreement between you and us regarding the Service. If any provision is held unenforceable, the remaining provisions remain in full force and effect. Failure to enforce any right is not a waiver. You may not assign or transfer these Terms without our prior written consent; we may assign these Terms in connection with a merger, reorganisation or sale of assets.

3.25 Contact

Questions about these Terms? Contact us at legal@vibe-space.ai.

4.1 Service Provider

Nova Sales Digitalisation – FZCO
Dubai Silicon Oasis, Dubai Digital Park
Building A1, Dubai
United Arab Emirates

Legal form: Free Zone Company (FZCO), licensed by Dubai Integrated Economic Zones Authority (DIEZ) / Dubai Silicon Oasis Authority.

4.2 Authorised Representative

Authorised representative pursuant to Art. 9 of the FZCO memorandum: the appointed director of Nova Sales Digitalisation – FZCO. Contact via legal@vibe-space.ai.

4.3 Trade Register & License

Trade licence and registration details are filed with Dubai Silicon Oasis Authority and can be verified on request via the email above. UAE corporate-tax registration is held with the Federal Tax Authority of the UAE.

4.4 Contact

General & legal: legal@vibe-space.ai
Privacy / Data Protection: privacy@vibe-space.ai
Customer support: contact@vibe-space.ai

4.5 Responsible for Content (V.i.S.d.P.)

Responsible for editorial content within the meaning of § 18 (2) MStV: the appointed director of Nova Sales Digitalisation – FZCO, contactable at the address above.

4.6 Hosting

Production servers, databases, file storage and the SMTP relay are operated in Germany. Hosting takes place in ISO 27001-certified data centres operated by an EU-based hosting provider, with whom we have entered into a data-processing agreement pursuant to Art. 28 GDPR.

4.7 Online & Consumer Dispute Resolution

EU Online Dispute Resolution (ODR) platform: The European Commission's ODR platform was repealed and ceased operation on 20 July 2025 pursuant to Regulation (EU) 2024/3228. We are therefore no longer required to link to it.

Consumer Dispute Resolution (Germany, § 36 VSBG): We are neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board (Verbraucherschlichtungsstelle).

Consumers may always pursue their rights before the competent courts; nothing in this notice limits such right.

4.8 Liability for Content

As a service provider we are responsible for our own content on this website pursuant to § 7 (1) DDG and the general laws. According to §§ 8 to 10 DDG, however, we are not obliged to monitor transmitted or stored third-party information or to investigate circumstances pointing to illegal activity. Obligations to remove or block the use of information under the general laws remain unaffected; liability in this regard is, however, only possible from the point in time at which a concrete legal infringement becomes known. Upon notification of corresponding legal infringements we will remove this content immediately.

4.9 Liability for External Links

Our website contains links to external third-party websites over whose content we have no control. We therefore cannot assume any liability for these external contents. The respective provider or operator of the linked sites is always responsible for their content. The linked sites were checked for possible legal infringements at the time of linking; illegal contents were not recognisable at the time of linking. A permanent control of the contents of the linked sites is not reasonable without concrete evidence of an infringement of the law. Upon notification of legal infringements, we will remove such links immediately.

4.10 Copyright

The content and works on this website created by the operators are subject to UAE, German and international copyright law. Duplication, processing, distribution, or any form of commercialisation of such material beyond the scope of the copyright law shall require the prior written consent of the respective author or creator. Downloads and copies of this site are only permitted for private, non-commercial use. Insofar as the content on this site was not created by the operator, the copyrights of third parties are respected; in particular, third-party content is identified as such. Should you nevertheless become aware of a copyright infringement, please inform us accordingly. Upon notification of such infringements, we will remove such content immediately.