Privacy Notice

Draft for counsel review. This notice describes what The Exchange software does today. It is not legal advice and has not been reviewed by a lawyer. Items marked "to be confirmed" need an answer from VibeSociety before this notice is final.

Who runs The Exchange

The Exchange is run by VibeSociety. The legal entity and the privacy contact are to be confirmed. Until then, use the Contact page.

What we collect, and why

When you apply to an opportunity. Your name and role, email, phone, business name, website, city, state, business type, years in business, what you do, portfolio links, files you upload, your availability, your proposal, your answers to the listing's questions, and your consent choices. We use them to review your application, to write to you about it, and, if you are selected, to agree and carry out the partnership.

When you tell us you are interested in a demonstration listing. Your name, email, business name, what you do, and optionally your website, city and state. We use them to contact you about real opportunities like it.

When you propose a partnership, ask for your status link, or ask for your data. The details you type in the form, so we can answer you.

When you sign in as a partner or as staff. Your email and the sign-in records needed to keep your account secure. Staff also use an authenticator or passkey.

When you sign an agreement. Your name, the time, your IP address, your browser's description and a fingerprint of the document, so the signature can be checked later.

With every form you send. Your IP address and your browser's description are stored with the submission, to protect against spam and abuse.

Optional analytics, only if you allow it. Which pages you open, what you search for (searches that look like an email, a phone number or a web address are dropped), and which filters you use. Visitors are counted with a code calculated from the IP address, the browser's description and a secret that is replaced every day. The same visitor normally gets a different code each day, which limits linking visits across days but does not make it impossible. The IP address itself is not stored for analytics. You can allow, refuse or withdraw this at any time on Privacy choices. Global Privacy Control is honored as a refusal.

Who receives your information

The VibeSociety team members who review applications and run partnerships. If VibeSociety turns them on, these services also receive information. Whether each is in use is to be confirmed:

• The email service that sends our messages receives your email address and the message.
• The HighLevel customer system receives submission and partnership updates, including names and email addresses.
• Staff can ask an AI model from Anthropic for writing suggestions about a listing or an application. Which fields were sent is recorded each time.

The web host that serves the site keeps its own server logs, with IP addresses, times, pages and browser descriptions. The host and how long it keeps those logs are to be confirmed.

The Exchange software sends personal information only to the recipients listed above, and has no advertising or data-sale features. VibeSociety's company policy on selling or sharing personal information is to be confirmed.

How long we keep it

• Your privacy choice: up to 182 days in a cookie on your browser.
• Abuse protection counters: deleted after two days without use, and stored only in a scrambled form.
• Signed agreements: kept as legal records, even after a deletion request.
• Everything else: retention periods are to be confirmed.

Your choices and rights

• See, change or withdraw your analytics choice on Privacy choices.
• Ask for a copy of your data, or for its deletion, on Your data. We confirm by email that the request is yours.
• Marketing emails are sent only if you tick that box when you apply.