Privacy Policy

1. Operator and contact

VibeResearch (“we,” “our,” or “us”) is developed and operated by Lamedtech.

Contact: support@viberesearchers.com

Legal note: Where a formally registered legal entity name is required by applicable law, that name is [LEGAL OPERATOR NAME] — to be confirmed before final public release.

2. What data we collect

Account data

When you register, we collect your email address and a securely processed password. These are stored and managed by Supabase (our authentication provider). We also maintain a profile record containing your plan tier, subscription status, AI credit usage counters, and add-on entitlement flags.

Uploaded research datasets

Files you upload for analysis (CSV, Excel, SPSS, Stata, SAS, JSON — depending on your plan) are transmitted to and stored on VibeResearch backend systems. Files are stored in a private Google Cloud Storage bucket and associated exclusively with your account through our database.

Dataset metadata

When a file is uploaded or a prepared dataset is saved, we store a registry record in our database containing: filename, file format, row count, column count, file size, column names and data types, upload timestamp, dataset origin (uploaded or derived), and a soft-deletion status flag.

AI usage logs

Every AI feature call is logged to an internal audit log containing: your user ID, endpoint name, action type, AI model name, estimated token counts, credits charged, your plan tier, and a timestamp. This log is used for abuse prevention, quota management, and internal auditing. Message content from the Guide feature is not stored — only usage metadata is recorded.

Payment data

Payment processing is handled entirely by Stripe. We do not receive or store payment card numbers, CVV codes, or bank account details. We store only the outcome of payment events: your subscription status, plan tier, billing interval, and subscription period end date.

Feedback and inquiry data

When you submit a feedback or inquiry form, we collect the information you provide: your message, email address, and optionally your user role, research field, requested features, urgency level, and willingness-to-pay indication. This information is used to respond to your inquiry and to improve our services.

Workflow logs and exported scripts

Workflow logs and exported analysis scripts may include column names and analysis settings from your dataset. They do not include raw dataset rows or individual cell values.

Saved analysis results

When you choose to save analysis results to the Results Library, the relevant output data (model metrics, table values, figure metadata, analysis settings, and display labels) is stored in the database associated with your account. Raw dataset row values are not stored as part of saved results; only aggregated statistics and metadata necessary for display are retained.

Active session information

When you log in, a unique session identifier is generated and stored locally in your browser. This identifier is also synced to a sessions table in the database along with your browser user agent and last-seen timestamp. This enables the session auto-resume feature after login. Session information does not contain conversation content or dataset data.

We do not sell or share your data

We do not sell, rent, or share your datasets, metadata, or account information with any third party for commercial or marketing purposes. We do not use your uploaded datasets or research outputs to train AI models.

3. How your uploaded data is used

Statistical analysis

When you run a statistical analysis, your uploaded dataset file is read by VibeResearch's backend processing systems (running on Google Cloud Run). The analysis is computed server-side using standard scientific libraries (Python, pandas, scipy, lifelines). Results are returned to your browser. Results are not automatically stored — they are only saved to the Results Library if you explicitly choose to save them (see Section 2 — Saved analysis results).

AI Research Assistant (chat)

When you use the AI Research Assistant, we send the following to our AI inference provider (Groq):

• Your text message
• A limited portion of your recent conversation history (up to 6 prior messages)
• A compact dataset summary: filename, total row count, column count, and up to 15 column names with their data types

Raw dataset rows, individual data values, patient records, measurements, or cell contents are not sent to Groq or any other external AI provider.

Research Assistant conversation history is stored locally in your browser and is not saved to our server database. It is cleared when you change the active dataset, start a new session, or log out. You can also clear it by clearing your browser's local storage.

VibeResearch Guide (AI product support chat)

VibeResearch Guide is a site-wide floating AI chat assistant that answers questions about plans, features, navigation, and billing. When you type a question, we send the following to our AI provider (Groq):

• The page you are currently viewing (e.g., “pricing”, “analyze”)
• Your plan tier label (e.g., “Researcher”) — display name only, no account data
• The filename and row/column count of your active dataset, if you are on the Analyze page — no raw data values or column names
• Your text message (up to 1,000 characters)

Guide message content is not stored in the database. Only usage metadata (token counts, timestamps, and model name) is written to an internal audit log.

Guide AI is disabled for unauthenticated users — they see static chip-based chat suggestions only. Requests containing injection patterns are blocked before the AI call. AI output is scanned for sensitive tokens before being returned to you.

AI report text (Results / Methods paragraphs)

When you request an AI-generated Results or Methods paragraph, we send the following to Groq: the analysis type name (e.g., “regression”), aggregated statistical results (such as p-values, coefficients, confidence intervals, and sample size — not raw data rows), and the requested output mode. Raw dataset values are not included.

ML prediction, SHAP, and time series analysis

When you use the ML Prediction feature, SHAP analysis, time series analysis, or Trend Report Builder, your dataset file is read by the backend systems to compute model outputs, performance metrics, SHAP values, feature importance, and model comparison statistics. All processing is performed server-side. Raw row data is not transmitted to any external AI provider during ML processing. If you choose to save results, only aggregated metrics and metadata are stored (see Section 2 — Saved analysis results).

External data import (FRED, URL)

When you use the External Data Import feature, VibeResearch's backend makes server-side requests to external sources on your behalf:

• FRED series import: The series ID and date range you enter are sent to api.stlouisfed.org. No personal data, dataset contents, or account information is transmitted to FRED. Data is retrieved subject to FRED's terms of use.
• URL import: VibeResearch's backend downloads the file from the URL you provide. No personal data is transmitted to the target URL. The source site may log the IP address of VibeResearch's backend server.

4. Data storage and security

Configured storage locations

• Uploaded files: Google Cloud Storage, private bucket. Configured region: asia-southeast1 (Singapore). Google may maintain internal copies across its global infrastructure per Google's Privacy Policy.
• Account data, dataset metadata, usage logs, saved results: Supabase (PostgreSQL). Configured region: ap-southeast-1 (Singapore). Supabase may process data across its own infrastructure per Supabase's Privacy Policy.
• Payment records: Stripe's infrastructure. We store only plan/subscription status.

Security measures in place

• All data in transit is transmitted over HTTPS/TLS.
• Every API request requires a valid authentication token, verified on each call.
• File access is ownership-verified: only the user who owns a file may access it — enforced at both the database and application layers.
• Database row-level security (RLS) policies restrict read access to each user's own records.
• Feature access (analyses, AI credits, uploads) is enforced server-side.
• Uploaded files are stored in a private Google Cloud Storage bucket not accessible via public URL.
• AI usage is rate-limited per user to prevent abuse.
• Payment card data is handled exclusively by Stripe and never passes through VibeResearch servers.
• HTTP security headers (including a per-request nonce Content Security Policy) are applied to all document responses.

What we do not claim

We do not claim HIPAA compliance, GDPR certification, ISO 27001, SOC 2, or any other formal security certification. No system is completely secure, and we cannot guarantee absolute security. If you are subject to regulatory requirements governing the handling of patient health data or protected personal information, you must review your institutional data governance and data processing policies before uploading data to VibeResearch.

Users are responsible for ensuring that any data they upload has been appropriately de-identified, that they hold the necessary consent and institutional approvals, and that uploading and processing the data on a cloud-hosted platform is permitted under their applicable obligations.

5. International data transfers

VibeResearch uses cloud and AI service providers whose infrastructure spans multiple countries. When you use the service, your data may be processed in the following ways that involve international data transfers:

• Uploaded dataset files are stored in Google Cloud Storage at the configured region asia-southeast1. However, Google may process or retain copies across its global infrastructure per Google's Privacy Policy and Terms of Service.
• Account and dataset metadata are stored in Supabase at the configured region ap-southeast-1. Supabase is a US-based company operating across multiple cloud regions.
• AI requests (compact dataset summaries, aggregated statistical results, user messages) are sent to Groq, a US-based company. Groq's exact inference region may vary. Raw dataset rows are never sent to Groq.
• Payment information is processed by Stripe, a US-based company operating globally.
• Website requests are served through Vercel's global CDN. Vercel may log technical request metadata (IP address, path, response timing) per Vercel's Privacy Policy.

If you have jurisdiction-specific data privacy requirements relating to international data transfers (for example, GDPR or local data protection laws), you should evaluate whether use of the platform is consistent with those obligations.

6. Data retention and deletion

Active accounts

Uploaded datasets and associated metadata are retained in your account as long as your account remains active. You can delete individual datasets at any time within the platform.

How in-app deletion works

When you delete a dataset in the application, this performs a soft deletion: the database record is marked as deleted and no longer appears in your workspace. However, the underlying storage file in Google Cloud Storage is not immediately deleted by this action — it remains in private storage until a periodic cleanup process removes it. Similarly, saved analysis results are soft-deleted (marked as deleted in the database) rather than immediately erased.

⚠ The periodic cleanup schedule for soft-deleted storage files has not yet been defined. This is an unresolved owner decision — see the Unresolved Decisions list below.

Account and full data deletion

To request deletion of your account and all associated data (uploaded datasets, analysis logs, account information), email support@viberesearchers.com with the subject line “Data Deletion Request” from your registered email address. We aim to process deletion requests within 14 business days. Residual storage files and backups may remain for up to 90 days before permanent removal.

AI usage logs

AI usage logs (token counts, credits charged, model names, timestamps) may be retained for internal auditing purposes for up to 12 months after account deletion.

7. Cookies, browser storage, and local state

Authentication and session continuity

VibeResearch uses Supabase for authentication. Depending on the authentication flow and configuration, Supabase may store your authentication session (access token and refresh token) in localStorage or in browser cookies. In addition, a unique session identifier (stored in localStorage under the key vr_session_id) is created at login and synced to the database to support the session auto-resume feature. Your browser may also receive technical cookies from Supabase (prefixed sb-) as part of the normal authentication flow.

Workspace and application state

The application stores certain data in your browser's localStorage for convenience and continuity across sessions. This data is grouped by function:

• Active dataset and workspace summary — filename, column list, and format of the active dataset; last-viewed analysis tab.
• Research Assistant session continuity — AI conversation history for the active session. Stored in the browser only; not sent to the server; cleared when the dataset changes, a new session starts, or you log out. The session identifier allows the session to resume after re-login on the same browser.
• Interface preferences — avatar color, panel open/collapsed state, Guide bubble interaction status.
• Onboarding status — whether you have viewed the Getting Started guide.
• Learning progress — which Learn page lessons you have read.
• Locale and display preferences — selected interface language.
• Login tracking — per-email temporary data to support login rate-limiting; does not contain passwords.

This data is stored locally in your browser only and is not independently sent to our servers. You can clear it by clearing your browser's local storage or by logging out. Technical key names may change over time while the processing purposes remain as described above.

Analytics and advertising tracking

VibeResearch does not currently use any third-party analytics tools, advertising tracking, or performance-measurement services that collect user data. No advertising networks or marketing platforms currently receive data from VibeResearch. If this changes in the future, this section will be updated and users will be notified before the change takes effect.

Infrastructure provider cookies

Our infrastructure providers (Vercel for frontend hosting, Supabase for authentication) may set their own technical cookies or browser storage as part of normal platform operation. These are functional and not used for advertising purposes.

Locale preference cookie

The locale routing middleware sets a NEXT_LOCALE cookie to remember your selected interface language (English or Vietnamese) between pages and visits. This cookie is purely functional and contains no personal data.

8. Third-party service providers

We use the following third-party providers to operate the platform. Each provider processes data under their own terms and privacy policies:

• Supabase — authentication, user profiles, dataset metadata, saved results, usage logs, and session data. Configured region: ap-southeast-1 (Singapore).
• Google Cloud Storage — storage for uploaded dataset files and metadata files. Configured region: asia-southeast1 (Singapore).
• Google Cloud Run — backend API execution environment; processes data in memory during request execution.
• Vercel — frontend hosting and CDN; may log technical request metadata.
• Stripe — payment processing, subscription management, and payment webhooks. Payment card data is handled exclusively by Stripe and never passes through VibeResearch servers.
• Groq — AI inference provider for the Research Assistant, report text generation, and VibeResearch Guide. Receives compact dataset summaries, aggregated statistical results, and safe session metadata only. Raw dataset rows are never transmitted to Groq. Groq is a US-based company; see Groq's privacy policy for information about their data handling and retention.
• Federal Reserve Bank of St. Louis (FRED API) — when you use the FRED import feature, your series ID and date range are sent to api.stlouisfed.org. No personal data is transmitted. Data is retrieved subject to FRED's terms of use.
• External newsfeed sources (BMJ, The Lancet, Cochrane, EQUATOR, and others) — the Research & Statistics newsfeed includes links to externally hosted content. When you click an external link, your browser connects directly to that website under its own privacy policy. VibeResearch does not transmit any user data to these external sources.

9. Your rights

You may contact us at any time to:

• Request a copy of the personal data we hold about you.
• Request correction of inaccurate account information.
• Request deletion of your account and associated data.
• Ask questions about how your data is used.

To exercise any of these rights, email support@viberesearchers.com with the relevant subject line. We will respond within 14 business days.

Depending on your jurisdiction, you may have additional rights under applicable data protection laws. We make no specific representation as to which regulatory frameworks apply to VibeResearch at this time.

10. Children and age requirement

VibeResearch is not intended for use by individuals under the age of 18, or below the age of majority in their jurisdiction if that age is higher. We do not knowingly collect personal data from minors. If you believe a minor has registered an account, please contact us at support@viberesearchers.com and we will remove the account.

11. Changes to this policy

We may update this Privacy Policy as the service evolves. Material changes will be communicated by email to registered users or via an in-app notice prior to the change taking effect. Continued use of the service after notice of a material change constitutes acceptance of the updated policy. The last updated date at the top of this page reflects the date of the most recent revision.

12. Contact

For privacy questions, data requests, or concerns: support@viberesearchers.com