Privacy Policy

Last updated: May 2026

1. Who we are

vibra ("we", "us", "our") operates the website vibra.app. We are a group outing planning service based in Madrid, Spain. For data-related enquiries, contact us at vibrawithus@gmail.com.

2. Data we collect

Waitlist sign-up

When you join the waitlist we collect: your email address, referral code (if any), browser type, operating system, device type, screen dimensions, browser language, referring URL, and UTM campaign parameters. This data is used solely to manage the waitlist and send you launch updates.

Partner enquiry form

When you submit a partner enquiry we collect: your name, position, venue name, email address, phone number (optional), and your message. This data is used to respond to your enquiry and assess your venue for the partner programme.

Analytics

With your consent, we use Google Analytics 4 and ContentSquare to understand how visitors navigate the site. These tools collect anonymised usage data including page views, session duration, and interaction events. No personally identifiable information is shared with these services beyond what is described above.

3. Legal basis for processing

Waitlist & contact form: your explicit action of submitting the form constitutes consent (Art. 6(1)(a) GDPR).
Analytics: we only process analytics data after you have given consent via the cookie banner (Art. 6(1)(a) GDPR).

4. Cookies

If you accept analytics cookies, the following cookies may be set:

_ga, _ga_* — Google Analytics. Used to distinguish users. Expire after 2 years.
ContentSquare cookies — Used to record anonymised session replays and interaction heatmaps.

You can withdraw consent at any time by clearing cookies and declining the banner on your next visit. Essential site functionality does not require any cookies.

5. Third parties

Supabase — our database provider. Data is stored in EU data centres.
Beehiiv — our newsletter platform. Your email is shared with Beehiiv only if you join the waitlist.
Google Analytics — analytics (consent-gated).
ContentSquare — session analytics (consent-gated).
Cloudflare — our hosting and CDN provider.

6. Data retention

Waitlist and partner enquiry data is retained until the service launches and you request deletion, or until we determine you have become an inactive contact (maximum 3 years). Analytics data is retained per the default retention settings of Google Analytics (14 months).

7. Your rights

Under the GDPR and Spain's Ley Orgánica de Protección de Datos (LOPD-GDD), you have the right to:

Access the personal data we hold about you
Rectify inaccurate data
Request erasure ("right to be forgotten")
Restrict or object to processing
Data portability
Withdraw consent at any time without affecting prior processing

To exercise any of these rights, email us at vibrawithus@gmail.com. We will respond within 30 days. If you believe your rights have not been addressed, you may lodge a complaint with the Spanish data protection authority, the AEPD (aepd.es).

8. Security

All data is transmitted over HTTPS. Access to our database is restricted to authorised personnel via service-role credentials. We do not sell or rent personal data to third parties.

9. Changes to this policy

We may update this policy as the service evolves. Material changes will be communicated by updating the date at the top of this page. Continued use of the site after changes constitutes acceptance of the updated policy.

10. Contact

Questions about this policy? Email vibrawithus@gmail.com.