Privacy notice | VibeAlt

1. Who is responsible?

Wevent Hungary Szolgáltató Korlátolt Felelősségű Társaság (Wevent Hungary Kft.) operates VibeAlt at vibealt.com and is the data controller for the uses described here. Registered office: 9094 Tápszentmiklós, Fő utca 38., Hungary. Company registration: 08-09-036729. Tax number: 32537747-2-08.

Privacy contact: hello@vibealt.com. You can also write to our registered office. Use this same contact for questions about the notice or to exercise your rights.

This notice covers visitors, maker accounts, submitted content, people referenced in directory research and people who contact us. Optional GitHub and email features process the described data only when they are available and you choose to use them.

2. Purposes, data and legal bases.

We do not treat reading this notice, creating an account or accepting the terms as consent to optional tracking. Where we rely on legitimate interests, those interests are running an accurate directory, protecting participation, preventing impersonation and keeping the service secure. You can object as explained below.

Maker accounts and sign-in

Data: Username, password hash, recovery-code hash, account dates and hashed session tokens. A GitHub-only account has a linked public GitHub ID instead of a user-chosen password.
Purpose & legal basis: Providing your requested account service: GDPR Article 6(1)(b).
Retention: While your account is maintained; until a justified deletion request is completed. Sessions expire within 14 days.

Submissions and community participation

Data: Project URLs, descriptions, evidence, limitations, your declared maker/discovery relationship, comments, discussions, votes, maker username and moderation decisions.
Purpose & legal basis: Providing requested participation: Article 6(1)(b). Independent editorial publishing, moderation and protection against abuse: Article 6(1)(f).
Retention: Approved and pending content while needed for the directory/community, subject to deletion, correction and objection requests. Rejected content and moderation logs: 180 days, with the linked-thread exception below.

Optional GitHub connection and repository control

Data: Public numeric GitHub ID and login, public repository metadata, verification method/date, hashed repository challenge and temporary OAuth state.
Purpose & legal basis: Providing the connection and control check you request: Article 6(1)(b); preventing false claims: Article 6(1)(f).
Retention: Identity while linked; OAuth state up to 10 minutes; pending proof 24 hours; successful proof validity 90 days. Expiry does not mean immediate removal of every historical record.

Optional account email and service messages

Data: Private address, verification date, notification preference, hashed action tokens and encrypted queued messages.
Purpose & legal basis: Requested verification/recovery: Article 6(1)(b). Account security and updates about your own submissions: Article 6(1)(f), with an opt-out for submission notices.
Retention: Address while attached to the account. Verification links: 24 hours; reset links: 30 minutes. Queue records: seven days; sent/permanently failed payloads are cleared.

Support, privacy requests and commercial enquiries

Data: Contact details, correspondence, request details and any project/account reference you supply.
Purpose & legal basis: Responding to a requested service or pre-contract enquiry: Article 6(1)(b); managing other correspondence and legal claims: Article 6(1)(f); complying with legal duties: Article 6(1)(c) where applicable.
Retention: Until the matter is resolved and any specifically applicable legal retention or claim period has ended. We review whether continued retention is necessary; there is no blanket promise to delete every support email at a fixed date.

Security and reliable delivery

Data: Network address, request time, method/path, status and size in access logs; hashed identifiers and counters in application rate limits.
Purpose & legal basis: Protecting the service, users and availability: Article 6(1)(f).
Retention: Access logs use daily rotation with 14 archived files plus the current file; rotation can be delayed when a file is empty. Rate-limit windows vary by endpoint, generally minutes to one day; expired entries are removed during maintenance. Incident evidence may be retained longer only where necessary.

Optional public-page measurement

Data: Cookie identifiers, public page path and browser/device/network information received by Google Analytics.
Purpose & legal basis: Your consent: Article 6(1)(a). Refusing does not prevent directory browsing or maker sign-in.
Retention: Consent choice and measurement cookies: 180 days, subject to browser limits. Verified property settings: event-level data two months, user-level data 14 months, with reset on new user activity enabled. Standard aggregated reports can be retained separately. Deleting a browser cookie does not delete previously received data.

Browsing does not require an account. A username and authentication information are necessary for a maker account; without them we cannot provide that account. An email address and GitHub connection are optional. Refusing optional email removes email-based recovery and notifications; a password account can retain its private recovery code. A GitHub-only account continues to depend on GitHub for sign-in and recovery.

3. Where data comes from and what is public.

We receive account and community information from you, technical information from your device and server requests, and public identity/repository information from GitHub when you connect it. Editorial research may also use official project websites, public repositories and public creator statements. A listing links to the sources used; we do not assume that open-source software was AI-built.

Maker usernames, public GitHub connections, verified repository-control details and approved submissions/comments/discussions may be visible to everyone and copied or indexed by search engines and third-party agents. The read-only catalogue API and MCP interface expose public directory facts, not private account emails, password hashes or session credentials. Unapproved contributions remain for operator review. We may retain public source attribution where necessary for legitimate editorial purposes, subject to your applicable rights.

Private email addresses and recovery credentials are not placed on maker profiles. Avoid uploading secrets, sensitive personal data or information about other people that you have no right to share. A repository-control badge establishes a technical control check, not legal ownership, AI authorship or a software security audit.

4. Who receives information?

Only authorised operators and service providers who need information for the relevant task should have access. Providers may also process their own account, security and service data under their policies. Our current provider categories are:

Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The application and account database run on our tarhely.top VPS in Germany. Hetzner privacy information.
Domain, DNS and inbound email routing: Cloudflare. In the current DNS-only website configuration, visitors connect to the VPS directly; Cloudflare is not the website reverse proxy. Mail to hello@vibealt.com is forwarded through its Email Routing service to the company inbox. Cloudflare privacy information.
Company correspondence: Zoho Mail hosts the destination company inbox, hello@weventhungary.com. Messages you send to our public contact can therefore be processed by Cloudflare and Zoho. Zoho privacy information.
Transactional sending, when enabled: Purelymail, operated by Add Rabbit LLC, receives the recipient address and message content needed to deliver account and submission emails. Purelymail privacy information.
Optional identity provider: GitHub receives the sign-in request and confirms public identity. We request no private email, private repository or write scope. The access token is used to confirm identity and is not stored. GitHub privacy information.
Optional measurement: Google Analytics receives public-page measurement only after acceptance. Advertising signals and advertising personalisation are disabled in this integration. Google privacy information and processing terms.

We may disclose relevant information where legally required, to respond to a valid authority request, or where necessary to establish, exercise or defend legal claims. We do not sell account information or send account submissions to generative-AI APIs.

International processing

The account database is hosted in Germany. Some providers and their subprocessors can process information outside the EEA, including in the United States. Purelymail describes its service infrastructure as US-based. Google and GitHub describe international-transfer arrangements in their linked terms, including adequacy arrangements and/or standard contractual clauses where applicable. The mechanism depends on the recipient and the relevant service agreement; this notice does not assert that every provider is certified under the same framework. Contact us for the arrangements applicable to a specific transfer and how to obtain available safeguards.

5. Retention, backups and deletion.

The purpose-specific periods above describe live application data. Scheduled cleanup is periodic rather than instantaneous. Rejected discussion threads can be kept while retained replies still refer to them. Pending content and sponsorship enquiries do not currently have an automatic fixed-age deletion rule; we assess them when resolving requests or closing accounts.

Database backups retain the seven most recent successful daily snapshots on the same server. Deleted records can remain in those restricted backups until they rotate out; backups are for recovery, not ordinary use. If a backup is restored, relevant deletion requests need to be reapplied. A specific legal preservation requirement may justify retaining limited records longer; it does not justify keeping every record indefinitely.

For optional email, delivered and permanently failed queue payloads are cleared. Purelymail and the company inbox have separate provider-side retention; clearing the application queue does not erase a delivered message from every mail system.

6. Your rights and choices.

Access and correction: ask what personal data we hold and request correction of inaccurate information.
Erasure and restriction: request deletion or restricted use where the applicable conditions are met. Public-interest, legal-obligation or legal-claim grounds can affect what must be retained.
Portability: where processing is automated and based on consent or contract, request the personal data you provided in a structured, commonly used format.
Objection: object to processing based on legitimate interests, explaining your particular situation. We will assess whether compelling grounds or legal claims justify continuing it.
Withdraw consent: use cookie controls at any time. Withdrawal affects future consent-based processing and does not invalidate earlier lawful processing. Submission-email preferences are in the dashboard.

Send requests to hello@vibealt.com. We may ask for proportionate information to verify your identity; do not send a password, recovery code or identity-document copy unless a justified, secure verification process specifically requires it. We normally respond within one month. If a legally permitted extension is necessary because of complexity or volume, we will explain it within that first month; the extension can be up to two further months. Requests are normally free; GDPR exceptions for manifestly unfounded or excessive requests may apply.

There is no automated decision-making or profiling intended to produce legal or similarly significant effects. Rate limits automatically protect availability; editorial publication and moderation decisions are made by operators. The maker account service is intended for adults aged 18 or over. Contact us if a child has supplied personal data through an account.

7. Complaints and updates.

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or to a competent supervisory authority where you live, work or believe an infringement occurred. NAIH: 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9. See NAIH contact and official submission channels. Its published customer-service email is ugyfelszolgalat@naih.hu; that email is not itself a channel for initiating a formal procedure. You also retain applicable court remedies.

We date and version changes to this notice. A policy update alone does not grant new tracking consent. Material changes will be highlighted on the site or through an appropriate account communication where necessary.

For browser storage details, see the cookie policy. Participation is covered by the terms of use.