Privacy Policy

VibeZero is an AI consultancy based in Victoria Park, Western Australia, working with small and medium businesses across Australia. In this policy, "we", "us" and "our" mean VibeZero. "You" means anyone who visits this website or contacts us through it.

You can reach us at howdy@vibe0.com.au for general matters, or for privacy and compliance matters at compliance@vibe0.com.au.

We collect the information needed to answer an enquiry, run the tool you request and understand how the site is used. This can include the following.

• Enquiry and lead details such as your name, work email, phone number, business name, submitted URL and the information you type into a form.
• Facebook and Instagram lead form answers, including your name, email, phone number, business name and your replies to our questions, when you complete a lead form in one of our ads. Meta collects these answers and passes them to us, keeps its own copy and handles it under its own privacy policy. We record your request in ClickUp and email and use it to reply to you.
• Vibe Check data including the submitted URL, public page, selected scripts and stylesheets from the same origin, one linked public source map when available, and the result. The result can include an overall public AI build assessment, provider attribution, supporting evidence and collection limits. We retain your contact details, URL and a short result summary in our email and ClickUp lead systems. Detailed evidence is returned to the page and is not deliberately copied into a separate report database.
• Vibe Scan data including the submitted URL, submitted public page, selected scripts from the same origin, headers and TLS information. The public tool makes automated, read only requests and does not log in, submit forms, change data or exploit a finding. Additional non mutating endpoint and email DNS checks may run only for separately authorised targets placed on a server side allowlist. You must own the target or be authorised by its owner. We retain your contact details and URL in our email and ClickUp lead systems, but do not deliberately copy the detailed report into a separate report database. If you ask for help after reaching a scan limit, we also retain the business and project details you submit.
• Free public app review data including your first and last name, company, public URL, delivery email, authority confirmation and any concern you choose to provide. We use these details to manage, complete and deliver the manual assessment. We may also record a Google advertising click identifier supplied with the visit so we can measure which campaign produced a valid request. We do not send the submitted name, company, app URL, email address or concern text to analytics or advertising platforms.
• AI Risk & Readiness Check data including your answers, business details, calculated scores, bands, suggested pathways and derived findings. The answers are processed to generate your result and PDF. An internal notification email contains the scores, pathways and findings derived from your answers. ClickUp receives your contact details, scores, bands and suggested pathway, not the raw answers.
• Template download data including your name, email, business and the template requested. We record the request in email and ClickUp. The generated file is returned to your browser and a copy is sent through SMTP2GO.
• Chat data including messages sent to the VibeZero Guide and the replies it produces. The chat service holds the session transcript and is designed to write a copy to ClickUp when the session ends so we can follow up and review the conversation.
• Information collected automatically when you browse, including your approximate location (derived from your IP address), the pages you view, the links you click, your device and browser type, and how you move through the site. This comes from the analytics tools described below.
• Security and abuse prevention data including short lived counters derived from your IP address, email address or the host submitted to a free tool. These identifiers are normalised and converted to a keyed SHA-256 digest before they are stored in our Redis or KV rate-limit service; the raw value is not used as the rate-limit key. For Turnstile verification, we send Cloudflare the challenge token and request IP address. Cloudflare may also process browser and device signals.
• Cookies and similar technologies, as set out in the cookies section.

Some tools ask you to select broad categories of information your business handles. Do not paste passwords, API keys, client records, health information or other sensitive content into a website form, URL field or chat message.

Cookies are small files stored by your browser. We also use browser storage and analytics requests that may not use a cookie. These tools help us understand site use, keep forms working, apply free tool limits and measure which paid campaigns produce valid requests. We do not sell this data. Advertising providers process the measurement data they receive under their own terms.

We use Google Analytics 4, Google Ads measurement, Microsoft Clarity and Ahrefs Web Analytics. The Google Ads tag helps us attribute visits and valid enquiries to campaigns, with advertising personalisation signals disabled. If you call us from a Google ad, Google reports that the call happened, how long it lasted and the caller's area code. When you send a service enquiry, our server also sends a lead event to Google Analytics with your analytics identifiers, the form type, the page and the campaign tags, without your name, email address or phone number. Clarity provides session recordings and heatmaps and is configured to mask text input. These scripts load when you view the site. The cookie notice is informational, and dismissing it does not switch them off. You can use the Google Analytics Opt-out Browser Add-on, browser privacy controls or a content blocker. Blocking storage or scripts may affect forms, Turnstile or free tool limits.

We use the information we collect to do the following.

• respond to your enquiry, prepare a quote, and deliver the services you ask for;
• run a requested check, scan, assessment or download and return the result;
• record the request and follow up about that specific enquiry or tool result;
• understand how the site is used and improve its content, structure and performance;
• measure which advertising campaign produced a valid request without sending the submitted name, company, URL, email address or concern text to the advertising platform;
• keep the site and our forms secure and free from spam and abuse;
• meet our legal and record keeping obligations.

We do not add you to a marketing list from a website enquiry without your consent, and we do not sell your personal information to anyone. If you choose to receive emails from us, for example by ticking the box on a lead form, we send occasional emails about AI and automation. Every email has an unsubscribe link, and we act on a request within five working days.

We use service providers to run the website and process requests. The relevant provider depends on the page or tool you use.

• Vercel hosts the website and processes web requests and platform logs.
• Upstash Redis or Vercel KV holds short-lived, pseudonymous counters used to limit automated or excessive submissions.
• Cloudflare Turnstile checks forms, scans, downloads and chat requests for automated abuse.
• SMTP2GO sends enquiry notifications, tool notifications and requested download emails.
• ClickUp holds lead and follow up records, selected tool summaries and VibeZero Guide chat transcripts.
• Microsoft 365 holds our email, including replies to enquiries and lead forms.
• Microsoft Bookings, part of Microsoft 365, holds the details you enter when you book a call through vibe0.com.au/book.
• Google Analytics 4, Google Ads, Microsoft Clarity and Ahrefs Web Analytics process website usage and technical data for analytics and advertising measurement.
• OpenAI receives, from our server, a random request reference, the page address without any query string, the click reference, your IP address, your browser user agent and the time when an enquiry follows a ChatGPT ad click, so we can measure which campaign produced it. We mark the event so OpenAI does not use it for personalisation, and we do not send your name, email address or phone number.
• Meta receives the optional advertising measurement data described above only after you allow Meta measurement in this browser. If you complete a lead form in one of our Facebook or Instagram ads, Meta collects your answers and passes them to us.
• VibeZero Guide at chat.vibe0.com.au processes the messages and session information needed to provide chat replies. Its configured AI model provider may also process message content to generate a reply.

These providers operate under their own terms and may pass parts of the work to other providers. We may also disclose information where we are required or authorised to by law.

Some providers above may store or process information outside Australia. Their hosting locations and subprocessors can change. Overseas processing may engage Australian Privacy Principle 8 where it applies. Contact us if you want the current provider details for a particular form or tool before you use it.

We use HTTPS, access controls, bot checks, input limits and provider security controls to reduce the risk of misuse, loss and unauthorised access. We also try to keep form and tool records to what is needed for the request. No website, email system or cloud service is completely secure, so do not send secrets or sensitive records through these tools.

Enquiries, email notifications, ClickUp lead records and chat transcripts are kept while they remain useful for follow up, service delivery, security or record keeping, plus any period required by law. We do not promise one fixed period because the reason for keeping each record differs.

Detailed Vibe Check and Vibe Scan reports are returned in the tool response and are not deliberately copied into a separate report database. The checked URL and the limited lead details described above are retained. Hosting, security and provider logs may also contain request metadata for their configured retention periods.

Rate-limit counters expire automatically after 10 minutes, one hour or 24 hours, depending on the control, form or tool. Their keys contain a keyed SHA-256 digest rather than the raw IP address, email address or submitted host.

Risk and readiness answers are processed to generate the assessment. Derived findings are sent through SMTP2GO, while ClickUp receives the scores, bands and pathway rather than raw answers. Generated PDFs and templates are returned to the browser, and requested download copies pass through SMTP2GO. Analytics and advertising measurement data is retained according to the settings and policies of Google Analytics, Google Ads, Microsoft Clarity, Ahrefs and, where you allow it, Meta.

You can ask us to delete or de-identify a record. We will assess the request against any security, contractual or legal reason that requires us to keep it.

You can ask for a copy of the personal information we hold about you, or ask us to correct it if it is wrong or out of date. Email compliance@vibe0.com.au. We may need to verify your identity and check whether a legal exception applies before releasing, changing or deleting a record.

We may update this policy from time to time as our tools or obligations change. The current version always lives at this page, with the date it was last updated shown at the top. Material changes will be reflected here.

Here is how to contact us about this policy or your privacy.

• For privacy and complaints, email compliance@vibe0.com.au
• For general enquiries, email howdy@vibe0.com.au
• By post, VibeZero, Victoria Park, WA 6100, Australia