Privacy Policy

This document is written to describe VibeCheck as it is currently designed and operated. It does not conceal mandatory consumer, privacy, payment, or other legal rights. Where applicable law gives a person a right that cannot lawfully be excluded, that right prevails.

Website https: //tryvibecheck.in

1. Purpose and Scope

This Privacy Policy explains what Mehta Industries, the operator of VibeCheck, collects, receives, stores, generates, transmits, uses, protects, retains and deletes when a person visits or uses VibeCheck. It covers the public website, account creation and login, Contract Workspace, Contract Vault, Contract Scanner, Review, Spine, Risk, reform/counter-proposal workflows, Tools, Files, Money, professional document branding, billing, support, privacy requests and related service operations. VibeCheck is a software platform for freelancers and professional users. It is not a law firm, bank, payment institution, tax authority or professional adviser. The service separates deterministic system results, AI interpretation, evidence/source context, uncertainty and the user decision.

2. Who Controls Your Data

Data Fiduciary / operator: Mehta Industries, a sole proprietorship. Registered/public address: RIICO Industrial Area, Baran, Rajasthan 325205, India. Privacy, support, billing, grievance and legal contact: team@tryvibecheck.in. Where VibeCheck uses a third-party provider to process data on VibeCheck's behalf, that provider acts under its applicable service relationship and contractual or legal requirements. Third-party providers may independently act as controllers/fiduciaries for data they process under their own services and terms.

3. Data We Collect or Receive

3.1 Account and authentication data

Email address used for passwordless Magic Link authentication.
Authentication, session, account and security identifiers required to create, maintain and protect the account.
When Google Sign-In is used: Google subject identifier (sub), email address, email_verified status and, where used, name, given name, family name and profile picture.
Authentication-provider event data needed to complete login, prevent abuse and maintain account integrity. VibeCheck does not receive your Google password. VibeCheck does not use your Google account data for unrelated advertising or profiling.

3.2 Professional profile and document-branding data

If you use the Professional Suite or profile features, you may provide: display name, business name, professional title, phone number, website, business address, GSTIN, payment/billing instructions used on documents, logo, signature image, document style, document colors and font/document preferences. Some of these fields are optional and are stored only when you choose to provide them. The payment details you enter into the Professional Suite are document/business information. They are not the same thing as payment-card credentials collected by a card network or payment processor.

3.3 Contract and document data

When you upload a contract or supported business document, VibeCheck may receive and store the file bytes, original filename, MIME type, size, storage path, document ID, timestamps, deletion state and the contents of the document itself. A document may contain personal information about you or another person, including names, addresses, email addresses, telephone numbers, PAN, Aadhaar, GSTIN, bank-account information, signatures, financial information, client information, trade secrets, confidential business information, tax information or other sensitive information. VibeCheck does not automatically know the legal ownership or confidentiality status of information contained in a document. You are responsible for having the right and authority to submit third-party information to VibeCheck.

3.4 Extraction, redaction and analysis data

The processing pipeline may generate extracted text, detected identifiers, redaction results, sanitized/redacted text, findings, explanations, confidence or uncertainty information, severity/attention levels, suggested actions, governing-law observations, cross-border classifications, legal-source/evidence snapshots, reform wording, alternative wording, approval/selection state and generation metadata. Raw extracted contract text is not intended to be persisted in the application database, and application logging is designed not to record raw contract contents. Redaction is a risk-reduction measure, not a guarantee that every sensitive value will be detected.

3.5 Generated documents and files

VibeCheck may store generated contracts, invoices, estimates and other user-requested business documents, together with metadata required to retrieve, display, download, track status and preserve historical document state. Generated contracts remain in the Files/generated-document workflow. After a generated contract is successfully saved, the current implementation may also persist a copy into Contract Vault through a Vault bridge (ensureGeneratedContractInVault). That bridge is best-effort: if bridging fails, the Files/generated-document objects can remain and bridging may be retried later. Vault persistence of a generated contract does not by itself mean the document has been scanned, analyzed, or run through Contract Scanner, Spine, Risk, or other contract-analysis pipelines, and it does not by itself consume contract-analysis/scan credits. Analysis and credit consumption occur only through the applicable explicit analysis workflows.

3.6 Money and financial data

If you use Money or document-to-Money workflows, VibeCheck may store financial records that you create or confirm, including record type, source/document reference, customer/client information entered by you, invoice or expense identifiers, amounts, currency, effective dates, payment status, payment dates, remaining balances, payment records, expense information, immutable ledger entries, idempotency identifiers and related audit events. Money records are maintained as financial workflow data. Creating, viewing or downloading a document does not automatically create a Money transaction. A financial event is created only through the applicable explicit workflow or confirmation.

3.7 Tax and calculator inputs

VibeCheck may receive the amounts, currencies, periods, rates, deductions and other values that you enter into calculators and reporting tools. Outputs are calculations or workflow assistance and are not a universal determination of your tax liability.

3.8 Subscription, credit and payment data

VibeCheck may store plan and commercial state, subscription status, billing cycle, paid-through date, cancellation state, provider customer/subscription identifiers, provider event identifiers, credit lots, reserved/consumed credit state, add-on lot state, purchase references, payment-event metadata, reconciliation status and billing audit records. Current India commercial model: Free includes 2 lifetime credits; Pro is INR 499/month with 50 credits per billing cycle; Pro Plus is INR 999/month with 120 credits per billing cycle. Eligible paid-active users may purchase add-on packs of 20 credits for INR 299, 40 credits for INR 499, and 80 credits for INR 999, each with a 30-day validity window under the applicable commercial rules.

3.9 Support and communications

When you contact VibeCheck, we may receive your email address, message content, attachments, technical information, billing references and other information you choose to provide. Do not send passwords, one-time authentication codes, payment-card credentials, API keys, private keys, recovery codes or other secrets through ordinary support email.

3.10 Technical, security and preference data

We may collect IP address, browser/device information, operating system information, timestamps, authentication and security events, error/diagnostic logs, abuse/rate-limit telemetry, consent records and other technical information necessary for secure service operation. The current site uses necessary service cookies and similar storage (including essential/session authentication cookies and the vc_theme presentation preference cookie) as described in more detail in the Cookie Policy at /legal/cookies.

VibeCheck keeps several mechanisms separate and does not merge them into one generic consent system: (A) necessary service cookies and similar storage required for core service functions; (B) an anonymous browser Analytics preference stored in localStorage under vc_analytics_preference (versioned; purpose product_analytics; states undecided, analytics_granted, and analytics_denied); (C) authenticated consent_records used for signed-in privacy purposes, which are separate from the anonymous Analytics preference; (D) Vercel Web Analytics; and (E) Google Analytics 4. Accepting or rejecting Analytics in the public Cookie Consent banner does not by itself create or replace authenticated consent_records.

Optional public Analytics remains off while the Analytics preference is undecided or analytics_denied. Accept Analytics persists analytics_granted and enables optional public analytics loaders and emission where otherwise configured. Reject Analytics persists analytics_denied and keeps optional Analytics off. If the Analytics preference is undecided and a visitor initiates authentication (for example Login / Send Link), the current implementation resolves the preference to analytics_denied so optional Analytics remains off while authentication can proceed; that fallback is not Analytics acceptance and is not Login-as-Analytics-consent.

When public web analytics is enabled and Analytics has been accepted, VibeCheck may measure public-site interaction events limited to approved public marketing and legal paths. Application-designed events include public page views, CTA interactions, pricing interactions, and signup-started / signup-completed funnel events. Those analytics events are designed not to include authenticated account identity fields such as email address or Supabase user identifiers, and are designed not to include contract bodies, findings, Money or ledger rows, billing or payment credentials, PAN, Aadhaar, passwords, OTPs, magic links, API keys, or raw Discovery queries. Authenticated workspace and tool routes, and /login, are not part of the public analytics allowlist used for this measurement.

When Vercel Web Analytics is enabled in the deployment configuration and Analytics has been accepted, VibeCheck may use Vercel Web Analytics for public marketing measurement on approved public paths. The current product describes this integration as cookieless in the sense that VibeCheck does not create a dedicated first-party Vercel analytics cookie for it. Cookieless does not mean that no data is collected. The provider may process technical or request-derived signals such as URL/path, referrer, device type, browser, operating system, and geolocation-related information according to the provider's service behavior. This notice does not treat those signals as a legal determination of anonymity, and it does not introduce advertising cookies, advertising profiles, or cross-site behavioral tracking.

When a Google Analytics 4 Measurement ID is configured and Analytics has been explicitly accepted (analytics_granted), VibeCheck may load Google Analytics 4 (gtag.js) only on approved public marketing and legal paths. GA4 is opt-in only. GA4 is not initialized while preference is undecided or analytics_denied, when no Measurement ID is configured, or when the current route is not an approved public path. In particular, GA4 is not initialized for /login, /vault, /tools routes, or other authenticated workspace routes under the current public-path allowlist. Application mapping of events to GA is limited to an allowlisted set of public marketing events and parameters (currently page_view, cta_clicked, and pricing_interacted with allowlisted path/identifier parameters). The application does not intentionally map contract, invoice, estimate, or other document contents; document IDs or names; financial amounts; email addresses; phone numbers; postal addresses; or arbitrary URL query strings into GA4 parameters. After GA loads, Google may set provider cookies such as _ga and _ga_* according to Google's documentation and configuration; lifetimes of those cookies are provider-controlled. The current GA4 configuration does not enable Google advertising features or Google Signals. VibeCheck does not claim that GA4 is absolutely anonymous or that Google retains no data.

The application may use browser sessionStorage for a short-lived marketing signup funnel marker and for necessary authentication or Vault-return UX keys described in the Cookie Policy. For cookie names, similar storage, Analytics preference states, GA4 and Vercel behavior, and how to change or clear an Analytics choice, read the Cookie Policy at /legal/cookies.

4. Credentials and Payment Security - What We Do and Do Not Store

Category VibeCheck position Account passwords VibeCheck does not use a normal password-based login in the current authentication flow, so VibeCheck does not store a user password for Magic Link authentication. Google password Never provided to VibeCheck. Google authenticates the user; VibeCheck receives the permitted identity/authentication data. Magic Link token Authentication/session infrastructure processes short-lived authentication data needed to complete login. These are security credentials, not user passwords. OTP/authentication codes Users should not submit them through support. Authentication systems may transiently process codes/tokens needed for sign-in or verification. API keys / private keys VibeCheck does not request or intentionally store them as a normal product input. Users must not upload or send them. Card number / CVV / card PIN VibeCheck does not intentionally store full card credentials or card PIN/CVV. Payment processing is handled by the payment provider and applicable payment-network controls. Bank account / payment instructions If you choose to enter business/bank/payment details for invoices or document branding, the information you provide can be stored as part of your Professional Suite/document data. UPI credentials/PIN VibeCheck does not ask for or intentionally store a UPI PIN. A UPI ID or payment instruction that you voluntarily place in a document is user-provided business information. Uploaded document secrets If a user uploads a document that contains a password, private key, card data or other secret, the secret may be present in the uploaded file. Users should not upload unnecessary secrets. Payment processors and payment networks may generate their own records and identifiers. Their handling of payment information is governed by their own applicable notices and legal obligations. RBI rules restrict storage of actual card-on-file data by relevant entities in the payment chain; VibeCheck does not seek to circumvent those restrictions.

5. How Uploaded Documents Are Processed

Upload to private, owner-scoped storage.
Server-side extraction of supported file formats.
Detection and redaction of supported identifiers where the workflow requires it.
Eligibility checks before AI processing.
Transmission only of the eligible server-side redacted/processed content to the configured AI provider for the requested AI feature.
Deterministic evaluation, source/evidence processing and/or AI interpretation according to the feature.
Persistence of the resulting evaluation, derived metadata and requested artifacts without overwriting the original document.

Important limitation: redaction can miss context-dependent or previously unknown sensitive information. A user must minimize unnecessary sensitive data before upload and must not rely on automated redaction as a guarantee of secrecy.

6. AI Processing and Providers

VibeCheck currently uses a server-side AI gateway. The current commercial routing is Free to DeepSeek V4.1- Flash (configured model identifier: deepseek-flash) and Pro/Pro Plus to Anthropic Claude Sonnet 5 (configured model identifier: claude-sonnet-5), for eligible AI features. Exact model/provider configuration may change as the service evolves; material changes to categories of data disclosed to an AI provider will be reflected in the applicable privacy notice. Only eligible server-side processed/redacted content is sent to the AI provider for features designed around contract-derived text. Raw uploaded document bytes are not intentionally sent to the AI provider by the contract-analysis pipeline. AI credentials and provider secrets are kept server-side and are not exposed to the browser. AI output can contain errors. AI does not have authority to approve a contract, certify legality or compliance, declare a contract safe to sign, approve user reform wording, choose a negotiation proposal, modify original contract bytes, or invent legal citations.

7. Legal, Regulatory, Tax and Financial Boundaries

VibeCheck provides supported India-first legal/regulatory and cross-border context, deterministic rules, document workflow assistance, contract generation, invoice/estimate generation, payment estimation and tax/reporting calculations within the product scope. These functions do not constitute legal advice, tax advice, accounting advice, financial advice, a professional opinion, or a guarantee of enforceability or compliance. Where facts or source coverage are insufficient, the system may return an unknown, unsupported, conflicting or uncertain result.

8. Why We Use Data

Create and secure accounts and provide authentication.
Deliver document upload, storage, extraction, redaction, analysis, generation and download.
Provide Contract Workspace functions including Vault, Scanner, Review, Spine, Risk, Reform and Counter- Proposal workflows.
Provide Tools including Contract Generator, Invoice Generator, Estimate Generator, International Payment Calculator and Tax Calculator.
Provide Files and Money workflows, including confirmed financial records, payments, expenses and immutable ledger events.
Apply subscription, entitlement and credit rules; process billing and reconcile provider events.
Provide Professional Suite branding and historical document snapshots.
Provide support and respond to privacy, billing and security requests.
Prevent fraud, abuse, unauthorized access, manipulation of credits or billing, and other security incidents.
Comply with legal, regulatory, accounting, tax, payment, security and dispute-resolution obligations.
Maintain service reliability, backups, auditability and business continuity. We do not sell uploaded contract contents or personal data as a commercial data-broker product. We do not use uploaded contract contents for unrelated advertising profiles.
Measure optional public-website usage and CTA, pricing, and signup-funnel interactions on approved public paths after Analytics acceptance, to improve public-site usability and product presentation. This optional public web analytics implementation is not used for advertising and is not an authenticated product-analytics system. VibeCheck does not treat Vercel Web Analytics or Google Analytics 4 as absolutely anonymous.

9. Service Providers and Data Sharing

Provider / category What it may receive or process Reason Supabase Account/authentication data, application data, database records, private storage objects, security/session data Authentication, database, storage and application infrastructure. Google (when selected) Authentication identity data and permitted profile scopes Google Sign-In. Google Analytics 4 (when configured and Analytics accepted) Public marketing/legal page measurement events and provider-controlled cookies such as _ga / _ga_*, plus related technical processing under Google's terms Optional public web analytics after explicit Analytics acceptance; limited to approved public paths in the current implementation. Anthropic Eligible redacted AI inputs and necessary request/response metadata Paid-tier eligible AI processing and document generation/analysis. DeepSeek Eligible AI inputs and necessary request/response metadata Free-tier eligible AI processing. Razorpay Payment/checkout information, transaction identifiers, payment status and provider metadata Subscription and add-on payment processing. Email provider / Amazon SES when configured Recipient address and message content needed for VibeCheck email delivery Authentication, account, billing, support and service communications. Vercel Web Analytics / Vercel Public-site interaction events (page views, CTA, pricing, and signup-funnel events) and technical/request-derived signals such as URL/path, referrer, device, browser, operating-system and geolocation-related information Public web analytics after Analytics acceptance where enabled. Authenticated account identity is not deliberately transmitted through the analytics event layer. Hosting/infrastructure providers System/network/application data necessary to run the service Web hosting, runtime and reliability. Providers may process information outside India. VibeCheck does not promise that all data is stored only in India. International processing is disclosed here because provider locations and infrastructure can involve cross-border processing. Cookie and similar-storage details are also described in the Cookie Policy at /legal/cookies.

10. Security Controls

Private storage for sensitive documents and owner-scoped access controls.
Row-level security and server-side authorization for application data.
Short-lived signed URLs for private document access. • Server-side validation of user, plan, lifecycle and billing claims; client-supplied user IDs, amounts and entitlement choices are not treated as authoritative. • PII detection/redaction before eligible AI transmission. • Server-only AI/provider credentials and model allowlists. • Audit and lifecycle records for privacy, billing and security operations. • Backups and operational recovery controls. Security controls reduce risk but cannot guarantee absolute security. No online service can guarantee that unauthorized access, accidental loss, provider compromise, malware, human error or other security events will never occur.

11. Data Retention and Deletion

Data class Current operational retention Account/profile and Professional Suite While active; deletion initiated on account closure/request subject to required legal/accounting/security retention. Contracts and user documents Until user deletion or account closure, subject to legal/security/accounting holds and backup lifecycle. Derived contract/evaluation data Generally linked to the underlying document and deleted through the applicable document deletion lifecycle, subject to lawful holds. Financial/accounting records Retained as required for accounting, tax, payment, fraud and dispute obligations; retention may extend beyond account deletion. Security/audit logs Retained for security, fraud, accountability and legal purposes for the period necessary or required by law. Consent/privacy-request records Retained long enough to demonstrate privacy compliance and handle disputes/rights requests. Public web analytics / provider analytics records Where public web analytics is enabled, VibeCheck does not define a fixed analytics retention period in this policy for provider-controlled analytics records; those records may be retained according to the provider's applicable terms and practices. Short-lived marketing funnel sessionStorage markers are browser/session state and are not intended as durable server records. Backups Subject to the operational backup lifecycle; deleted data can persist in backups until their normal expiry. Provider records May persist according to provider retention, legal and payment- processing rules. A deletion request does not mean immediate erasure from every system. Where data must be retained by law, for accounting/tax records, fraud prevention, security investigations, dispute handling, payment reconciliation or a lawful hold, VibeCheck may retain the affected information for that purpose.

12. Privacy Rights and Requests

Subject to applicable law and the current commencement of the relevant statutory provisions, users may have rights to access information about processing, correct or update personal data, request erasure where permitted, withdraw consent where consent is the basis, make a grievance, and exercise other rights provided by law. Requests can be made to team@tryvibecheck.in. We may request reasonable proof of account ownership or identity before acting on a request. VibeCheck will not use a privacy notice to contract away a right that applicable law says cannot be waived. The DPDP Act requires notices describing the personal data and purposes and provides mechanisms for consent withdrawal and rights requests; different provisions of the Act and Rules have different commencement dates.

13. Children

VibeCheck is intended for users aged 18 or older and is not designed to knowingly solicit children's personal data. We may refuse or delete accounts where we reasonably determine the user is below the permitted age, subject to applicable law.

14. Breach and Security Incident Response

If VibeCheck becomes aware of a personal-data breach, we will assess and respond under the incident-response process applicable to the event and the law in force at that time, including any required notice to affected users, regulators or authorities. A security incident may require investigation, containment, provider coordination, evidence preservation and temporary suspension of some functionality.

15. Changes to This Policy

We may update this Privacy Policy when the service, data categories, AI providers, payment providers, legal requirements or security practices change. The new version will state its effective date. Where applicable law requires advance or direct communication of a material change, we will use an appropriate notice method.

16. Contact and Grievance

Privacy / Support / Billing / Grievance / Legal: team@tryvibecheck.in Grievance contact: Proprietor, Mehta Industries Address: RIICO Industrial Area, Baran, Rajasthan 325205, India Legal form: Sole Proprietorship Appendix A - Plain-English Data Inventory Data category Examples Stored/processed because Account/auth Email, auth/session identifiers, Google subject/profile data where enabled Account access and security Professional identity Name, business name, title, phone, website, address, GSTIN Profile and document generation Branding/assets Logo, signature, colors, font/document style Professional document generation Contracts/documents File bytes, filename, metadata, contents Requested storage and processing Extracted/redacted Text extraction, detected identifiers, redaction results Analysis pipeline AI-derived Findings, explanations, uncertainty, suggestions, reform wording Requested AI/document features Legal/evidence Rule outputs, evidence/source snapshots, classifications Review and explanation Financial/Money Financial records, payments, expenses, ledger entries, status User-confirmed money workflows Billing Plan, credits, subscription state, provider events, purchase references Entitlement and payment administration Support Messages, attachments, support metadata Support and incident handling Security/privacy Consent records, privacy requests, audit/security events Security and accountability Preference Theme and interface preferences User experience Public web analytics Public page/CTA/pricing/signup-funnel interaction events; technical/request-derived analytics signals processed by the analytics provider; short-lived marketing funnel sessionStorage marker Public-site measurement and usability improvement (not advertising; not authenticated product analytics) Legal framework note: This policy is intended to operate consistently with applicable Indian privacy, consumer- protection, payment and information-technology law, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as and when their respective provisions apply to the service. Mandatory legal rights prevail over conflicting wording in this policy.