1. Controller

VIBEX Zone is a digital business operating under a Freelancing Practitioner Certificate issued by the Ministry of Human Resources and Social Development in Websites Programming and Developing, Document ID FL-491601887. As operator of vibexzone.com and provider of the direct services described on it, VIBEX Zone controls personal data collected for its own purposes. Contact [email protected]. Where VIBEX Zone processes data solely for a client in a client-specific system, the client may be controller and VIBEX Zone processor based on the actual roles and agreement.

2. Data categories

• Account and profile details such as name, username, email, mobile, country, verification status, and communication preferences.
• Project, order, and support information, including descriptions, budgets, messages, follow-ups, quotations, contracts, and invoices.
• Plan, billing, amount, discount, payment status, provider reference, and legal-acceptance records; current VIBEX systems do not store full card numbers.
• Uploaded and public content such as text, links, images, logos, image/video backgrounds, profile details, menus, and orders where those features are used.
• Technical and security data such as IP address or hash, user agent, sign-in and reset events, session identifiers, errors, and abuse-prevention records.
• Limited usage data such as language and browser drafts, plus public VIBEX Link visit counts and a hashed random visitor identifier when analytics consent is given.

3. Sources

Data comes from you, service and security activity, a client administering a system for you where lawfully authorized, and payment, email, messaging, or integration providers as needed to confirm a requested transaction.

4. Purposes

• Provide the site, accounts, public content, services, and contracted projects.
• Authenticate users; manage sessions, billing, subscriptions, payments, and requested communications.
• Handle support, complaints, rights requests, contracts, accounting, and legal acceptance.
• Secure the service, prevent fraud or abuse, and diagnose failures.
• Improve performance and measure visits where required consent exists.
• Meet legal obligations and valid requests from competent authorities.

5. Lawful basis

Depending on context, processing relies on performing an agreement or requested pre-contract steps, legal obligation, consent where required, legitimate interests where legally available and not prejudicial to your rights or involving sensitive data, or another basis allowed by the PDPL and regulations. Consent is not claimed for every activity and may be withdrawn for consent-based processing without affecting earlier lawful processing.

6. Minimization and accuracy

We seek to collect only data relevant and proportionate to the purpose and restrict access by need. Keep account and contact data accurate. Do not send sensitive data, identity documents, or card numbers unless requested through an approved channel for a clear purpose.

7. Sharing and processors

Minimum necessary data may be shared with hosting, cloud/CDN, database, email, verification, messaging/WhatsApp, payment, accounting, support, limited analytics, and customer-requested integration providers. Public content is disclosed to visitors by your choice. Source review identifies technical use or support for Cloudflare, SQLite depending on environment, Resend, Moyasar, WhatsApp integrations, and Supabase configuration. VIBEX does not sell personal data.

8. Payment data

Card forms and processing are provided by the external payment provider. VIBEX may receive transaction ID, status, amount, currency, and invoice data needed for reconciliation. Current systems are not designed to receive or store the full card number or security code. Provider privacy terms also apply to card entry.

9. International processing

The source does not prove that all processing or storage remains in Saudi Arabia. Cloud, email, payment, CDN, or integration providers may process data elsewhere depending on account configuration. Cross-border transfers are handled subject to Saudi PDPL transfer requirements, including lawful purpose, minimization, and required safeguards or assessment.

10. Retention

Account and content data is kept while providing the service; project, contract, invoice, payment, acceptance, and security records are retained as needed for performance, accounting, disputes, and law. Current detailed visit records use a limited rolling window while daily aggregates remain. The source does not establish final business retention periods for every category, so necessity is reviewed rather than inventing exact periods.

11. Deletion and destruction

When purpose and lawful retention end, data is deleted, destroyed, or appropriately anonymized. Backup deletion may follow the operational cycle. Records required by law, valid claims, or controlled by a client may be retained or referred to that client with an explanation where appropriate.

12. Data-subject rights

• The right to be informed of the lawful basis and purpose.
• The right to access and request a clear, readable copy, subject to applicable controls.
• The right to correct, complete, or update data.
• The right to request destruction where applicable and to withdraw consent for consent-based processing.
• The right to complain to the competent authority under applicable procedures.

13. Exercising rights

Email [email protected] or use /complaints, identify the right and service, and provide enough information for verification. We may verify identity and authority before disclosure or changes. For client-controlled data we may direct the request to the client or assist it.

14. Security

Measures include access controls, hashing of passwords and sensitive tokens, HttpOnly session cookies where appropriate, encryption in transit, rate limits, security records, and service-specific operational backups. Security cannot be guaranteed 100%; incidents are handled and notified as applicable.

15. Cookies and local storage

Essential cookies support authentication, security, and sessions. localStorage keeps language and creation drafts; sessionStorage may hold temporary browser-side media or drafts. VIBEX Link uses a first-party random analytics identifier for up to 30 days only after analytics consent. Refusal does not block core functions. Source review found no external advertising or marketing trackers.

16. Children

Commercial services and paid accounts are not directed to children or persons without contracting capacity. We do not knowingly collect a child's data without an appropriate basis or required authorization. A guardian should contact us about improperly submitted child data.

17. Updates

The policy may change as services, law, or processors change. The date above is updated, with additional notice where legally required or the change is material.