Privacy Policy

1. Introduction

This Privacy Policy explains how Crowers Limited, trading as Vibgrate ("we", "us", "our"), collects, uses, discloses, and protects your personal data when you use our website and the Service. The Service includes Vibgrate CLI, Vibgrate Graph, VG Code, Vibgrate Cloud, Vibgrate Relay, and related services.

We are committed to protecting your privacy and handling your data in an open and transparent manner. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Information You Provide

We may collect personal data that you voluntarily provide when using our Service, including:

• Account Information: Email address, name, company name when you create an account or contact us
• Communications: Information you provide when you contact us for support or queries
• Feedback: Any feedback, comments, or suggestions you submit

2.2 Information Collected Automatically

When you access the Service, we may automatically collect certain information:

• Usage Data: Pages visited, features used, time spent on pages, click patterns
• Device Information: Browser type, operating system, device type
• Log Data: IP address, access times, referring URLs
• Analytics Data: Aggregated and anonymised usage statistics

2.3 Repository and product data

What we process depends on which part of the Service you use:

• Drift analysis (Vibgrate CLI): Package names, versions, and dependency trees from manifests and lockfiles, plus build and CI configuration metadata. Core drift scoring reads those files on your machine. A scan you choose to upload sends scores, findings, and structural facts, not a raw source file.
• Vibgrate Graph: The code graph is built on your machine from your source. It keeps structural facts (symbol names, relationships, and file paths). It does not keep a full copy of each source file. Those facts stay on your machine unless you choose to share or push a derived result.
• VG Code: VG Code reads the parts of the repository a task needs and compiles focused context, including relevant source ranges. With a local model, that context stays on your machine. With a hosted model, the context for that turn is sent to the provider you selected. Known secret files are kept out of that context, and detected tokens are masked.
• Vibgrate Relay: When you route a hosted turn through Vibgrate Relay, we process the prompt and repository context sent for that turn, together with your account, the model you chose, and token-usage records used to meter and govern the request. Relay routes the request to that model provider. We do not train our own models on that content.
• Vibgrate Cloud: If you sign in, we process your account and workspace data. If you upload a scan, or connect a Git host and scan through that access, we receive the scan artifact — scores, findings, and structural facts — not a raw source file. If you ask the remediation agent to write a fix, we clone that repository into an isolated virtual machine, make the change, and return a pull request. That clone runs only when you ask for it.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: To deliver drift analysis, Vibgrate Graph, VG Code, Vibgrate Cloud, and Vibgrate Relay — including repository context you send to a hosted model, scan artifacts you upload, repository access you grant, and source you ask us to process for a fix
• Improve the Service: To understand usage patterns and enhance functionality
• Communications: To respond to your inquiries and provide customer support
• Security: To detect, prevent, and address technical issues and security threats
• Legal Compliance: To comply with applicable laws and legal obligations
• Analytics: To generate aggregated, anonymised insights about service usage

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

• Contract: Processing necessary to perform our contract with you (providing the Service)
• Legitimate Interests: Processing necessary for our legitimate interests (improving the Service, security) where not overridden by your rights
• Consent: Where you have given consent for specific processing activities
• Legal Obligation: Processing necessary to comply with legal obligations

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your information in the following circumstances:

• Service Providers: With trusted third-party service providers who assist us in operating the Service (e.g., hosting providers, analytics services), subject to appropriate data protection agreements
• Legal Requirements: When required by law, regulation, or legal process
• Protection of Rights: To protect our rights, privacy, safety, or property, or that of our users or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate safeguards

Any third parties we engage are contractually obligated to protect your data and use it only for the purposes we specify.

6. International Data Transfers

Your information may be transferred to and processed in countries outside the United Kingdom. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Transfers to countries with adequacy decisions from the UK
• Standard Contractual Clauses approved by the UK Information Commissioner's Office
• Other legally recognised transfer mechanisms

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Account Data: For the duration of your account and a reasonable period thereafter
• Analysis Data: Temporarily processed and typically not retained beyond the analysis session unless you save reports
• Log Data: Typically retained for up to 12 months for security and troubleshooting purposes
• Legal Records: As required by applicable law

When data is no longer needed, we securely delete or anonymise it.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request restriction of processing in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us. We will respond to your request within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated: ico.org.uk

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure data storage with access controls
• Regular security assessments and updates
• Employee training on data protection
• Incident response procedures

However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

10. Cookies and Tracking Technologies

We use a small amount of browser storage so the site works and so we can understand, in aggregate, how people use vibgrate.com. We do not use advertising cookies or sell your data.

10.1 Strictly Necessary Storage

Stored in your browser's local storage, never sent to us or to third parties:

• theme — remembers your light/dark mode preference. Kept until you clear browser data.

10.2 Analytics

We use two analytics tools on vibgrate.com:

• Google Analytics 4 (Google LLC, measurement ID G-0183QGXGD0) — to measure page views, traffic sources, and basic device/browser signals so we can improve the site. GA4 may set first-party cookies such as _ga and _ga_* on vibgrate.com. Those cookies typically last up to two years (or until you clear them). Data is processed by Google under its Privacy Policy and Google Ads Data Processing Terms.
• Cloudflare Web Analytics (Cloudflare, Inc.) — privacy-oriented edge metrics (page views, referrers, load performance) from ordinary request data. It does not set cookies on your device. See Cloudflare Web Analytics and Cloudflare's Privacy Policy.

The legal basis for this processing is our legitimate interest (UK GDPR Article 6(1)(f)) in understanding and improving the website.

10.3 Managing Your Choice

You can block or delete cookies and site data (including the theme preference and Google Analytics cookies) at any time through your browser settings. You can also opt out of Google Analytics across the web with the Google Analytics Opt-out Browser Add-on.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the Service after any modifications constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your data protection rights, please contact us:

15. Supervisory Authority

You have the right to lodge a complaint with the UK supervisory authority: