Privacy notice

Vibe Assured · Version 1, 19 October 2026

Vibe Assured is a service of Dreamsmiths Digital (Pty) Ltd. This notice explains what we do with your personal information when you use the Vibe Assured portal at apps.vibeassured.com, and what you can ask us to do about it.

Who we are

We decide how your personal information is used in the portal, so we are responsible for it (the responsible party under South Africa's POPIA and the controller under UK and EU GDPR). Our Information Officer is Chris Geale. You can reach them at privacy@dreamsmiths.com.

What we collect

• When you sign in: your name and email address, and an identifier for your account. You sign in with a one-time code sent to your email, or with Google. If you use Google, Google shares your name, email address and basic profile with our sign-in service; we never receive your Google password or anything else in your Google account.
• When someone invites you: the name and email address they gave us, and your role in the engagement.
• When you work in the portal: what you enter and decide there, such as the app you want assessed, your acceptances and signatures, and a record of who did what and when.
• If you connect GitHub or upload code: the GitHub account or organisation you connect, and the code you send us for assessment.
• To keep the service running: technical logs of requests and errors. Some include your internet (IP) address and the type of browser you use, or the approximate location worked out from your IP address, but not your name or email address.

Why we use it

To let you sign in, to run the assessment and engagement you asked for, to keep a reliable record of what was agreed and by whom, and to keep the service secure and working. We use it because we need to in order to provide the service: under our contract with you or your organisation (or the steps you asked us to take before one), and, where the contract isn't with you, because we and your organisation have a legitimate interest in running the engagement you were invited to. For the records and logs, it is our legitimate interest in keeping the service secure and accountable.

We don't sell your information, use it for advertising, or send you marketing. The portal sets no tracking or analytics cookies. Our hosting sets a cookie that sends your requests to the same server, and your sign-in is kept in your browser tab until you close it.

Who else handles it

• Other people on your engagement (the app's Builder, the client organisation's people and our staff) see your name, email address, role and what you do in it.
• Microsoft hosts the portal and its database in South Africa (Azure South Africa North), and runs sign-in (Microsoft Entra External ID).
• Google, only if you choose to sign in with Google.
• Cloudflare stores code you upload for assessment, and recordings of the tests we run.
• Anthropic provides the AI models (Claude) that help us read and assess the code you send us.
• GitHub, only if you connect a repository.

Otherwise we share your information with no one unless the law requires it.

Where it goes

The portal and its database are in South Africa. Microsoft keeps the sign-in directory in Europe, Cloudflare stores uploaded code and test recordings in Europe, and Anthropic processes what we send it in the United States.

How long we keep it

• Code you send us (uploaded or from GitHub): our stored copy is deleted automatically after 90 days, and our staff keep working copies only while they assess it. The assessment report we write, and a record of what we received, are kept with your engagement records.
• Technical logs: deleted automatically within 90 days. Microsoft also keeps a record of sign-ins for its own security.
• Your account, test recordings, and what was agreed and by whom: for as long as you work with us, and afterwards only as long as we need to keep records of our agreements or the law requires.
• Backups of our database hold deleted information for up to 7 days.

Your rights

You can ask us what personal information we hold about you and for a copy of it, ask us to correct it or delete it, or object to how we use it. Write to privacy@dreamsmiths.com. We'll check it's you before acting, and reply within one month (or tell you within that month if a complex request needs up to two more, as the law allows). Some records, such as what was signed and by whom, we may need to keep; if so, we'll tell you why.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Regulator in South Africa, or, if you're in the UK, the Information Commissioner's Office, or, in the EU, the data protection authority where you live.

Changes

When the portal starts using your information in a new way, we update this notice first and give it a new version and date.