Vibey trust center
Privacy policy
Vibey processes only the merchant and customer information needed to provide the features a merchant enables.
Last updated: 9 October 2026
Information processed
Depending on enabled features, this may include Shopify store configuration, products, content, inventory, locations, orders and fulfilment context; connected Gmail account identity, aliases, labels, thread and message metadata, message content, attachment names, and draft identifiers needed for support workflows; merchant-approved Brain sources; and account, billing, audit, and operational metadata.
How information is used
Information is used to authenticate merchants, provide requested workflows, route support conversations, prepare merchant-reviewed Gmail support drafts, reconcile draft state, generate merchant-reviewed content, secure the service, troubleshoot failures, and meet legal obligations. Vibey does not sell personal information or use Google user data for advertising.
Google API Services
Vibey’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Vibey does not sell Google user data, use it for advertising, or use it to train generalized AI models.
Storage, AI, and providers
Gmail-derived support conversations, message content, draft content, draft identifiers, and evidence are stored in tenant-scoped database and workspace records for the requested workflow. Approved context, including the limited Gmail thread content needed for a draft, may be sent to Vibey-managed OpenAI Responses API for included-plan AI, or to merchant-authorized OpenAI or Anthropic API accounts for BYOK. Vibey does not use Gmail-derived data for generalized AI training; supported provider routes must use API terms and settings that preserve that restriction. API-provider abuse monitoring retention may still apply under the selected provider’s terms. OAuth tokens and provider credentials remain encrypted and server-side. Customer-support output stays draft-only; merchants review and send from Gmail.
Retention and deletion
Gmail-derived records follow the configured retention policy for each data class, including raw email and generated draft retention deadlines, legal holds, and scoped deletion workflows. Disconnecting a provider revokes the remote authorization before local removal when Google confirms revocation. Shopify privacy requests, uninstall events, and contact requests trigger scoped export, deletion, suspension, retention, and backup-tombstone workflows as configured.
Your choices
Merchants can disconnect providers, pause workflows, uninstall Vibey, and request access, correction, export, or deletion by emailing contact@getconsultingonline.com.
International processing
Infrastructure and subprocessors may process data outside the merchant’s country subject to applicable contractual and technical safeguards.