Privacy Policy — VibeDM

Effective date: 14 October 2026 Last updated: 14 October 2026

This Privacy Policy explains how VibeDM B.V. ("VibeDM," "we," "us," or "our"), the operator of the VibeDM service (the "Service"), collects, uses, discloses, and protects personal data when a business ("Client" or "Merchant") uses VibeDM to present and sell its products in Instagram Direct Messages with its followers and customers ("you," "End User"), and when a Client's authorized staff use our client portal.

VibeDM is a business-to-business conversational commerce platform. We provide the Service to Clients, who use it to show their products to, try them on with, and sell them to, their own Instagram audience inside a Direct Message conversation. In most cases, the Client is the data controller for End User conversation and order data, and VibeDM acts as a data processor on the Client's behalf under a data processing agreement (see our Data Processing Addendum). For account and portal-user data relating directly to the Client's own staff, for the data we process to onboard a Client for payment processing (§2.7), and for the security and operational logs we generate to run the Service, VibeDM acts as a data controller in its own right. Where this policy refers to "controller," it means VibeDM acting as controller for that specific processing activity, as described below.

VibeDM does not sell products. When you buy something in a conversation, the Client is the seller. The Client's own terms and conditions, delivery terms and refund and cancellation policy apply to your purchase, and they are shown to you and linked in the checkout before you pay. VibeDM provides the platform, the checkout and, through its payment provider, the facility to pay.

1. Who we are

VibeDM B.V. Bloemstraat 19A, 1016 KV Amsterdam, The Netherlands KVK (Dutch Chamber of Commerce): 42167874 VAT number: NL870012071B01

Contact for privacy matters: info@vibedm.ai Data Protection Officer / privacy contact: No DPO appointed; see privacy contact above.

We are established in the Netherlands and subject to the EU General Data Protection Regulation (GDPR) and applicable Dutch implementing legislation (UAVG).

The Service runs on a software platform built and operated by Vibeday B.V., an affiliated company at the same address, which acts as our sub-processor (see §5). Vibeday B.V. does not decide what your data is used for; we do, on the Client's instructions.

1.1 How payments are processed

VibeDM uses Adyen N.V. ("Adyen"), a licensed payment institution and acquirer regulated by De Nederlandsche Bank, to process payments made in a conversation. VibeDM operates as a platform on Adyen's "Adyen for Platforms" service. Each Client that sells through VibeDM is onboarded with Adyen as a sub-merchant (an "account holder") of that platform.

This means:

• Adyen, not VibeDM, collects and processes your payment details and executes the payment.
• Funds you pay are received and held by Adyen on behalf of the Client, and paid out by Adyen to the Client's bank account. VibeDM never holds your funds; VibeDM receives only its platform commission from the Client.
• For the processing of payments, fraud prevention, anti-money-laundering checks and other obligations under financial regulation, Adyen acts as an independent data controller. Adyen's processing is described in Adyen's Privacy Statement.
• Where a Client already holds its own Adyen merchant account, the payment may instead be processed on that account, on the Client's instruction.

2. What data we collect

We collect the following categories of personal data through the Service.

2.1 Instagram profile basics

When an End User messages or interacts with a Client's connected Instagram professional account, we receive basic profile data from the Instagram Platform via the Instagram API, such as the End User's Instagram-scoped user ID, username, and profile picture URL. We do not receive or request access to an End User's Instagram login credentials.

2.2 Message content

The content of Direct Messages exchanged between End Users and a Client's connected Instagram account, including text, quick-reply selections, button and postback payloads, comment text (for comment-triggered automations), references to story replies, and images an End User chooses to send in the conversation. We do not download or persist story media itself (see §6.2), and we do not persist images an End User sends in ordinary conversation — they are displayed from the Instagram-provided CDN URL. Photographs sent specifically for virtual try-on are the one exception and are covered by §2.4 and §6.4.

2.3 Order and checkout data

Where a Client has enabled ordering in its DM flows and you choose to place an order in the conversation, we collect the details needed to fulfil it: first name, last name, email address, postal code and house number (from which we look up street and city, see §5), any address you enter manually, an optional phone number where the flow asks for one, the contents of your cart, the resulting order number, and the status of your payment.

Before you can pay, the checkout shows you the name, registration number and location of the Client you are buying from, and asks you to confirm that you agree to the Client's terms and conditions and refund and cancellation policy. We record that you gave this confirmation, and when, as part of the order.

The Client you are buying from receives this order data, because the Client is the seller: it sees the order, your name, delivery address, email address and phone number in our client portal in order to fulfil and support your order, and where the Client runs its shop on another system (for example its own Shopify store) and has chosen to, we record the order there on the Client's behalf (see §5).

2.3a Payment data

We do not collect, receive, or store your card number, bank details, or any other payment credentials. Where payment is taken, you are sent to a hosted payment page operated by Adyen (§1.1), and you enter those details there, with Adyen, directly.

To create the payment, we send Adyen the order reference, the amount and currency, your email address and your country, and the identifier of the Client (sub-merchant) you are buying from, so that Adyen can allocate the funds to the right seller.

From Adyen we receive back the information we need to complete the order and to support you afterwards: whether the payment succeeded, failed or was cancelled, Adyen's unique payment reference, the payment method used (for example "iDEAL" or "card") and, for card payments, the card brand and the last four digits only. We never receive the full card number, expiry date, security code or bank login details.

2.3b Refunds, disputes and chargebacks

If you ask the Client for a refund, or if you dispute a payment with your bank or card issuer, we process the data needed to handle it: the order and payment reference, the amount, the reason given, and the outcome. A refund is instructed by the Client (or by us on the Client's behalf) and executed by Adyen. In a dispute, Adyen and the Client may need the order details, delivery information and the conversation in which you placed the order as evidence; we provide these to the Client and to Adyen for that purpose only.

2.4 Photographs you send, and personalised media we generate for you

Where a Client's DM flow offers a virtual try-on and you choose to take part, you may send us a photograph of yourself. We use that photograph for one purpose only: to generate an image showing how a specific item from that Client's catalogue would look on you, and to send that generated image back to you in the same conversation.

Sending a photograph is entirely optional. The conversation continues, and you can browse and buy, whether or not you send one. You are asked before any photograph is used, and the request tells you what happens to it.

We do not use your photograph to identify or recognise you, to build a profile, to train any model, or for advertising. We do not share it with the Client, and we do not share it with anyone other than the image-generation providers named in §5 that perform the generation on our instructions. Which of those providers is used is a per-catalogue setting made by us, not something that varies per person.

Separately, a Client's flow may generate a personalised image or video for you — for example a card or clip with your first name in it. That media is rendered inside our own infrastructure; the only thing that leaves it is the name itself, which is checked by the language-model provider named in §5 before it is put on screen, so that a name which is not a name does not end up rendered into a Client's media. The result is stored under a random, unguessable name and deleted automatically after 30 days (§6.4).

2.5 Client account and portal data

For Client staff who use our client portal: name, work email, login and session data (including a password stored only as a salted hash), role and permissions, and actions taken in the portal (for example connecting an Instagram account or an online store, curating the products offered in a flow, or reviewing conversations and orders).

2.6 Technical and security data

IP addresses, request metadata, and webhook delivery logs, used to secure the Service (for example verifying that inbound webhooks genuinely originate from Meta, the payment provider or a connected store) and to operate rate limiting and abuse prevention.

2.7 Client onboarding data for payment processing (know-your-customer)

Before a Client can receive payments through the Service, Adyen is legally required to verify the Client's identity and that of the people behind it. To onboard a Client as a sub-merchant, we collect from the Client and pass to Adyen:

• the Client's legal entity details: legal name, trading name, registration number, VAT number, registered address, website and a description of the products it sells;
• for the Client's signatory, directors and ultimate beneficial owners (individuals who own or control 25% or more of the Client): name, date of birth, nationality, residential address, email address and phone number, and copies of their identity document and, where Adyen requires it, proof of address;
• the Client's bank account details (account holder name, IBAN or account number) and a bank document showing them, so that Adyen can pay out to the Client.

We collect this data on Adyen's behalf and transmit it to Adyen through Adyen's onboarding interface. Adyen determines what it needs and performs the verification; VibeDM does not perform identity checks itself. Identity documents and bank documents are transmitted to Adyen and are not retained by VibeDM beyond what is needed to complete the submission. Adyen is the controller for this verification (§1.1). We retain the legal entity details, the names of the verified individuals and the verification status for the duration of the Client relationship, so that we can see whether a Client is allowed to receive payments and support the Client with Adyen's periodic re-verification.

We do not knowingly collect special categories of personal data (Art. 9 GDPR) and we ask Clients not to solicit such data through DM flows.

3. How we use data (purposes and legal bases)

We never use End User data received via the Instagram API to serve ads, and we never sell or share such data with third parties for their own advertising or marketing purposes (see §4).

4. Meta Platform data use commitment

Data we receive through the Instagram API (profile basics, message content, comments, story-reply references) is used solely to provide and improve the direct-messaging shopping service the Client has configured — receiving and sending messages, running the Client's automations, showing the Client's products, generating a try-on image when you ask for one, taking an order where the Client has enabled ordering and you ask for one, and enabling a human to take over a conversation and reply by hand.

We do not:

• Sell this data to any third party.
• Use this data, or allow it to be used, for advertising, ad targeting, or ad measurement purposes.
• Use this data, or allow any subprocessor to use it, to train artificial-intelligence or machine-learning models.
• Share this data with third parties except the subprocessors listed in §5, each engaged strictly to help us provide the Service, and each bound by a data processing agreement.
• Use this data to build user profiles for purposes unrelated to the shopping conversation the End User is actively engaged in.

This commitment reflects our obligations under Meta's Platform Terms and Developer Policies as a Tech Provider operating on the Instagram API, and it binds our sub-processors, including our affiliate Vibeday B.V., by contract.

5. Who we share data with

5.1 Subprocessors

We use the following subprocessors to operate VibeDM. Each is bound by a data processing agreement consistent with GDPR Art. 28.

5.2 Adyen — payment service provider (independent controller)

Adyen N.V. (Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, the Netherlands) processes payments made through the Service, as described in §1.1. Adyen is not a subprocessor: for payment processing, fraud screening, anti-money-laundering checks, the verification of Clients as sub-merchants (§2.7), and the payout of funds to Clients, Adyen is an independent controller, acting under its own regulatory obligations.

Adyen's processing of your data is described in Adyen's Privacy Statement.

5.3 The Client you are buying from

The Client is the seller and, for your order, the controller. The Client receives your order and checkout data (§2.3), the payment status and payment reference (§2.3a), and any refund or dispute data relating to your order (§2.3b), so that it can fulfil, support, refund and account for your purchase. How the Client uses your data is governed by the Client's own privacy policy, which is linked in the checkout together with its terms and conditions.

5.4 Other recipients

Two further disclosures are not subprocessing arrangements, because the recipient is either the Client's own system or a public service, and are listed here for completeness:

• The Client's own shop system. Where a Client runs its shop on a platform such as Shopify and connects it to the Service, we read the Client's catalogue and stock from that platform (no personal data is involved in that direction), and, where the Client has switched it on, we record a paid order in the Client's store with your name, email address, phone number and delivery address, so that the Client can fulfil it from the system it already uses. That store belongs to the Client and is operated under the Client's own agreement with the platform; we act on the Client's instruction, as we do when we show the Client the order in our portal. Checkout and payment never take place on that platform.
• Address lookup. To turn a postal code and house number into a street and city, we query a public address service — PDOK, operated by the Dutch Kadaster, for addresses in the Netherlands, and OpenPLZ for addresses in Germany. Only the postal code and house number are sent; no name, no contact details, and nothing identifying the conversation.

We may also disclose personal data where we are legally required to do so, for example to a court, regulator, tax authority or law-enforcement body, or where it is necessary to establish, exercise or defend legal claims.

VibeDM uses no third-party error-monitoring service; diagnostics stay within our AWS infrastructure (see §9).

This list was checked against the current codebase (2026-10-14) and reflects every third party that touches personal data. It does not include tools we use only internally, without End User or Client data (for example project management). We will update this section before introducing any new subprocessor, and Clients may subscribe to notice of new subprocessors under the Data Processing Addendum.

We do not permit any subprocessor to use personal data received via the Instagram API for purposes other than providing services to us in connection with the Service, and no subprocessor is permitted to use it to train models.

6. Data retention

6.1 Conversation content

Message content and related conversation events are retained for 90 days from the date of the event, after which they are automatically redacted — message bodies and other free-text personal content are removed — by an automated retention process that runs without anyone asking for it. Non-content metadata needed for platform-policy compliance (for example that a 24-hour messaging window applied, or that a private reply was sent for a given comment) may be retained in a minimized, redacted form for policy audit purposes as described in §3.

6.2 Story media and images sent in conversation

We never store Instagram story media. Where a flow references a story reply, we render the media directly from the Instagram-provided CDN URL at display time and do not download, cache, or persist a copy of the underlying image or video. The same applies to photos an End User sends in ordinary conversation: they are displayed from Instagram's CDN and are not copied into our storage. Photographs sent for virtual try-on are the single exception, and §6.4 says exactly what happens to them.

6.3 Order, payment and dispute records

Where a Client has enabled ordering, records of completed orders, the associated payment status and payment reference, and any refund or dispute relating to them are retained for 7 years from the end of the financial year in which the order was placed, because Dutch tax law requires it (Art. 52 Algemene wet inzake rijksbelastingen). During that period the data is retained for that purpose and for handling disputes and chargebacks, which card schemes allow to be raised for up to 540 days after a transaction, and is not used to contact you or to build a profile. Order data that never became a completed order — an abandoned cart, an unfinished checkout, a failed payment — is not kept on that schedule and ages out with the conversation under §6.1.

Adyen retains payment data under its own retention obligations as a regulated payment institution; see Adyen's Privacy Statement.

6.4 Try-on photographs, generated images and personalised media

A photograph you send for virtual try-on is deleted automatically by a storage rule that expires it the day after you send it, and in no case later than 48 hours after you send it. It is never stored in our databases — only as a file, under a random, unguessable name, on storage configured to delete it on that schedule.

The generated try-on image is kept for 30 days and then deleted automatically. It is kept that long for one reason: so that the image is still there if you scroll back through the conversation. It is stored under the same kind of random, unguessable name.

After the photograph is deleted we keep one thing derived from it, for up to 30 days: a short identifier calculated from the photograph, which lets us recognise that you have asked to try the same item on before and return the image we already made instead of generating it a second time. That identifier cannot be turned back into your photograph, and it is calculated using a secret key that only we hold, so it is meaningless to anyone else. We treat it as personal data, and we delete it when you ask us to delete your data.

Personalised media generated for you — a card or video with your name in it — is likewise stored under a random, unguessable name and deleted automatically after 30 days. Any object that somehow reaches this storage without a retention classification is deleted after 90 days regardless, so nothing can outlive the schedule silently.

6.5 Account, onboarding and security logs

Client portal account data is retained for the duration of the Client relationship plus a limited period thereafter for legal and security purposes. Records of account email we send — invitations and password resets, and the address they were sent to — are kept as part of that account history. Client onboarding data (§2.7) is retained for the duration of the Client relationship and for 5 years thereafter, in line with the record-keeping periods under Dutch anti-money-laundering law that apply to the payment relationship; identity and bank documents themselves are not retained by VibeDM after submission to Adyen. Technical and security logs are retained for a limited operational window sufficient for debugging and abuse investigation, then deleted or aggregated.

6.6 Erasure requests

Where an End User or Client exercises an erasure right under §7, we delete or irreversibly anonymize the relevant personal data ahead of the standard retention schedule, subject to the exceptions in §7.2, and record the request and its outcome internally, with minimal data — an identifier for the request, a timestamp, and what was done. Erasure is carried out by authorised personnel following a documented process rather than by a self-service tool, which is why §7.1 asks you for the details we need to find your data.

7. Your rights

If you are located in the European Economic Area, the UK, or another jurisdiction with equivalent data protection law, you have the following rights regarding your personal data, subject to legal exceptions:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (see §7.2, and our separate Data Deletion Instructions).
• Restriction — request that we limit processing in certain circumstances.
• Portability — receive certain data you provided to us in a structured, commonly used, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, such as the virtual try-on in §2.4, withdraw it at any time without affecting the lawfulness of processing carried out before you withdrew it.

You also have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. VibeDM automates shopping conversations; it does not make decisions of that kind about you. Adyen's automated fraud screening may decline a payment; that decision is made by Adyen as controller, and you can contact Adyen or the Client about it.

7.1 How to exercise your rights

Send a request to info@vibedm.ai. To help us verify your identity and locate your data (which is indexed by Instagram-scoped user ID and Client account, not by name), please tell us the Instagram username or account you contacted, and which Client or brand's Instagram account you were messaging. If you are an End User, we may need to relay your request to the relevant Client, since the Client is often the controller for the conversation. For requests concerning your payment details, we will direct you to Adyen, which holds them. We aim to respond within one month, as required by GDPR.

You may also stop, or opt out of, automated messaging directly within the conversation at any time by sending a stop-word (for example "stop", "unsubscribe", or the Dutch "afmelden") — see the Data Deletion Instructions for the full list and for how to switch automated messages back on.

7.2 Exceptions

We may retain limited data notwithstanding an erasure request where required to comply with a legal obligation, to establish or defend legal claims, or to maintain the security and integrity of the Service (for example a minimal record that an opt-out occurred, so that we do not contact you again). In particular, for a completed order the fields that form the financial record — the order, its lines, amounts, payment status and payment reference, any refund or dispute, and the name and address it was invoiced and delivered to — are kept for the period in §6.3 and are not erased on request, because the law requires us to keep them; everything else tied to you, including the conversation, is erased as described in §6.6.

7.3 Complaints

You have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), PO Box 93374, 2509 AJ The Hague, the Netherlands. You can submit a tip-off or complaint at autoriteitpersoonsgegevens.nl.

8. International data transfers

Our production infrastructure runs in the European Union: the AWS Europe (Stockholm) region, eu-north-1. Message content, order data, account data and try-on images are stored there. Payment processing (Adyen) and order management (ChannelEngine) take place with companies established in the Netherlands, and message classification with a company established in France, on its EU endpoint.

Two categories of processing may involve a transfer outside the European Economic Area:

• Virtual try-on generation. A photograph sent for try-on, and the Client product image it is generated against, are sent to an image-generation provider — Google's Gemini API or OpenAI's image API, depending on the catalogue (§5). Neither guarantees that the request is processed inside the EEA. Each provider's data processing terms apply to that transfer, including the European Commission's Standard Contractual Clauses and, where the provider is certified under it, the EU-U.S. Data Privacy Framework.
• Support and operations by our subprocessors. Where a subprocessor's support or infrastructure operations reach data from outside the EEA, we rely on the safeguards in that subprocessor's data processing agreement.

In each case we rely on appropriate safeguards recognized under GDPR — the European Commission's Standard Contractual Clauses, an adequacy decision, or an equivalent mechanism offered by the subprocessor — so that your data continues to receive an equivalent level of protection. Clients can obtain further information about these transfers and the contractual safeguards for them by writing to info@vibedm.ai.

Where a payment is made with an international card scheme or wallet, the scheme or wallet provider may process the transaction outside the EEA under Adyen's arrangements with them; see Adyen's Privacy Statement.

9. Security

We apply technical and organizational measures appropriate to the risk, including:

• Envelope encryption (via AWS KMS) of Instagram access tokens at rest; tokens are decrypted only within the message-sending and refresh process, are never written to logs, and are never returned by any API response.
• Signature verification on all inbound webhook traffic — from Meta, from Adyen, and from a connected store — before it is processed.
• Encryption in transit (TLS) for all external communication, and encryption at rest for databases and object storage.
• Least-privilege access controls across our infrastructure, and strict separation between Clients' data within the Service: every order, conversation and catalogue record is scoped to the Client that owns it, and that scope is checked when data is written as well as when it is read.
• Payment details are never entered on, transmitted through or stored in our systems; the hosted payment page is served by Adyen, which is PCI DSS Level 1 certified. Our own integration is maintained in line with the PCI DSS requirements that apply to it.
• Try-on photographs, renders and personalised media stored in storage that is private at origin, cannot be listed, and is reachable only through our content delivery layer, at addresses generated from 128 bits of randomness — so an address cannot be guessed or enumerated, though anyone you forward one to can open it for as long as the object lives. The storage is deliberately non-versioned, so a deleted photograph is not preserved as an earlier version, and every object expires on a schedule (§6.4).
• Passwords for portal accounts stored only as salted hashes, never in a recoverable form.
• API keys and other credentials — ours and those a Client entrusts to us for its own payment, order-management or shop accounts — held in a dedicated secrets manager, never in our database or source code, and never re-displayed after entry.
• Minimized logging: our diagnostic logging is configured to avoid capturing access tokens, credentials, or full message bodies.

No method of transmission or storage is 100% secure, but we work to protect personal data using industry-standard practices. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, and we will notify the relevant Client and, where we are the controller, the supervisory authority, as the GDPR requires.

10. Cookies and similar technologies

On vibedm.ai. Our website uses only cookies and local storage that are strictly necessary to make the site work (for example to keep a session on the client portal or to remember a cookie choice). We do not use advertising, tracking or cross-site analytics cookies on vibedm.ai. If we introduce analytics cookies in future, we will ask for your consent first and update this section.

In the Instagram conversation. No cookies are involved; the conversation takes place inside Instagram, which applies Meta's own cookie and privacy policies.

On the checkout and the hosted payment page. Our checkout page uses only a strictly necessary session cookie to keep your cart and order together while you pay. The hosted payment page is operated by Adyen and may use cookies, device fingerprinting and similar techniques for fraud prevention and to complete the payment; these are governed by Adyen's Cookie Policy.

11. Children's data

The Service is not directed at children, and we do not knowingly process personal data of children in a manner inconsistent with Instagram's own platform age requirements. The virtual try-on feature described in §2.4 is not offered to, and must not be used by, anyone under 16; a Client configuring a flow that asks for a photograph is responsible for not targeting it at children.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy, to the extent permitted by law.

13. Contact us

Privacy questions or requests: info@vibedm.ai Data Protection Officer / privacy contact: No DPO appointed; see privacy contact above. Postal address: VibeDM B.V., Bloemstraat 19A, 1016 KV Amsterdam, The Netherlands

This document is published at https://vibedm.ai/legal/privacy-policy.