PRIVACY POLICIES

Effective Date: September 19, 2026

This Privacy Policy describes how Spirit Vibe ("Spirit Vibe", "we", "us", or "our") collects, uses, processes, and safeguards Personal Data provided by clients, website visitors, and users across our website (spiritvibe.com), platform, software, and communication services.

1. Overview & Data Processing Roles

Spirit Vibe operates under two distinct legal capacities when processing Personal Data in accordance with global Data Protection Laws (including EU GDPR and UK GDPR principles):

  • Data Controller: Spirit Vibe acts as a Controller for Personal Data collected directly to manage client relationships, set up accounts, process payments, administer direct support, and conduct business operations.

  • Data Processor: Spirit Vibe acts as a Processor when handling client-submitted data (such as recipient contact numbers, custom audio/media assets, or team information) specifically to execute contracted production, notification, or messaging services on behalf of the client.

2. Categories of Personal Data Processed

Category

Data Types

Processing Purpose

Account & Identity Data

Name, business name, position, user credentials

Account setup, identity verification, contract execution

Contact Data

Email address, telephone/SMS numbers, physical address

Order updates, client notifications, direct support

Billing & Financial Data

Billing address, payment receipts, invoice records

Payment processing, tax compliance, bookkeeping

Media & Project Data

Team info, choreography files, reference audio, client uploads

Production of custom music and media services

Technical & Activity Data

IP address, login logs, system performance records

System security, fraud prevention, audit logging

3. Legal Basis for Processing

We process Personal Data under the following legal frameworks:


  • Contract Performance: Necessary to perform services, fulfill client orders, process payments, and manage service requests.

  • Legitimate Interests: Necessary to secure our platform, improve service delivery, prevent fraud, and maintain operational integrity.

  • Consent: Obtained for specific processing activities, such as SMS notifications or opt-in marketing updates. Clients sending messages or notifications via our platform guarantee that all required recipient consents have been collected prior to submission.

4. Third-Party Sub-Processors & Data Transfers

To provide seamless music production, billing, hosting, and notification capabilities, Spirit Vibe utilizes trusted third-party providers. All transfers are protected by standard contractual safeguards (such as EU Standard Contractual Clauses or UK Addendums where applicable).

Provider Category

Representative Providers

Purpose

Cloud Hosting & Infrastructure

OVHCloud, Amazon Web Services (AWS)

Secure data storage and server hosting

Communications & Messaging

TextMagic, Postmark, Google Workspace

Automated SMS alerts, order updates, email delivery

Payment & Invoicing

Stripe, PayPal, QuickBooks

Invoicing, payment processing, accounting

AI & Workflow Technology

OpenAI, Anthropic, Cloudflare

Service enhancement, workflow automation, security

Note on AI & Third-Party Integrations: Where AI tools or integrated applications are used to enhance customer communications or content workflows, data processing is strictly limited to executing explicit task instructions. Client content is not utilized to train third-party machine learning models without direct instruction.

5. Data Retention & Deletion Schedule

Personal Data is retained only as long as required to fulfill service contracts, maintain accounting records, or satisfy regulatory requirements:

  • Client Data & Media Content: Retained during active client engagement and deleted within 60 to 120 days following an account closure or formal deletion request.

  • Uploaded Project Attachments: Preserved for a maximum of 60 days following upload unless extended by contract terms.

  • System Activity Logs: Maintained for 30 days for operational monitoring; audit logs are retained for up to 2 years for security compliance.

  • System Backups: Encrypted daily backups are retained for up to 3 years before routine purging.

6. Security Standards & Measures

Spirit Vibe implements industry-standard technical and organizational security controls to protect Personal Data against unauthorized access, loss, or alteration:


  • Encryption: Full data encryption in transit (TLS 1.2+) and at rest (AES-256).

  • Access Management: Strict Role-Based Access Control (RBAC), multi-factor authentication (MFA) for administrative tools, and minimum-privilege authorization.

  • Breach Notification: In the event of a confirmed security incident affecting client data, Spirit Vibe will notify impacted clients without undue delay (within 72 hours where feasible) to support reporting and remediation efforts.

7. Data Subject Rights & Communication Preferences

Data Subjects maintain rights regarding their personal information under applicable privacy laws:

  • Access & Rectification: Request access to or correction of stored personal details.

  • Erasure & Restriction: Request deletion or limited processing of Personal Data, subject to active contractual or legal accounting obligations.

  • SMS Communications Opt-In/Opt-Out: Clients opt in to receive SMS notifications regarding order updates, billing statements, and booking confirmations by providing written consent during inquiry or replying "YES". Recipients may opt out of SMS messaging at any time by replying "STOP" or following designated unsubscribe instructions.

  • Recipients can get support by contacting admin@spiritvibe.com

  • Message and data rates will apply with each SMS message

  • SMS messages will only be sent in the form of status updates as necessary

  • mobile information is not shared or sold to third parties or affiliates for marketing.