Privacy Policy

Valibrio is operated by Valibrio OÜ, registry code 17517776, registered in Estonia.

For privacy questions or requests relating to your personal data, contact privacy@valibrio.com.

Valibrio processes personal data in different roles depending on how the service is used.

For account administration, billing, product analytics, security, abuse prevention, service operations, and our own legal obligations, Valibrio determines the purposes and means of processing and acts as a data controller.

When a customer or validation creator uses Valibrio to collect participant feedback, that customer or creator generally determines why the feedback is collected and how it will be used. For that processing, the customer or creator acts as the controller and Valibrio processes the response data on their behalf as a processor.

If you participate in a validation and have questions about why your feedback was requested or how the validation creator will use it, you should contact the person or organization that shared the validation with you.

When you create or use a Valibrio account, we may process account information such as your name, email address, authentication information, profile information, account settings, subscription status, and identifiers needed to operate your account.

We process content you create in Valibrio, including validation titles, descriptions, questions, options, uploaded assets, workflow settings, validation status, and related product data.

When someone responds to a validation, we process the information submitted through that validation. Depending on the validation, this may include selections, ratings, written feedback, optional name or email address, and attribution information such as source, medium, campaign, or referrer information.

We also process limited technical information needed to protect and operate the service. This may include IP address, browser or user-agent information, timestamps, and derived identifiers used for security, duplicate detection, and abuse prevention.

For rate limiting, Valibrio derives a hashed identifier from relevant request information rather than storing the raw rate-limit inputs in the rate-limit event record.

We process personal data to provide and maintain Valibrio, authenticate users, operate accounts and workspaces, store and deliver validations, collect participant responses, generate creator-facing results and exports, provide AI-assisted features, process subscriptions, send service communications, provide support, maintain security, prevent fraud and abuse, diagnose technical problems, and comply with applicable law.

Depending on the processing activity, we rely on performance of a contract, our legitimate interests in operating and protecting the service, compliance with legal obligations, or consent where applicable.

Where Valibrio processes participant response data on behalf of a validation creator, the creator is responsible for determining an appropriate legal basis for collecting and using that data.

Participants can respond to public validation links without creating a Valibrio account. The validation creator can access the feedback submitted to their validation and use Valibrio features to review and analyze it.

Participant name and email fields provided by Valibrio are optional. A validation may nevertheless ask for other information through its questions or content. Participants should avoid submitting sensitive personal information unless it is appropriate for the validation and they understand why the validation creator is requesting it.

To protect the service against duplicate submissions and abuse, Valibrio may derive pseudonymous hashes from information associated with a submission. These identifiers are used for service integrity and security purposes.

Valibrio records limited first-party service events needed to operate, secure, understand, and improve the service. These records may relate to account activity, validation workflows, billing, email delivery, AI-assisted features, and other product operations.

Separately, Valibrio uses PostHog for optional browser-based product analytics. PostHog analytics are not activated on your device until you accept analytics. If accepted, Valibrio uses a pseudonymous analytics identifier that is distinct from your authentication identifier. Optional analytics may include limited product usage information such as your plan, validation identifiers, and interactions with Valibrio features. Direct account identifiers such as your name and email address are excluded from analytics.

You can reject optional analytics when asked or withdraw your choice later through Cookie settings. Withdrawing consent stops future optional PostHog analytics collection on that device.

Valibrio provides AI-assisted features that can help creators analyze validation results and generate decision briefs. When a creator uses these features, relevant validation content and participant response content may be processed by an AI service provider to generate the requested output.

AI-generated outputs may include summaries, patterns, observations, confidence notes, or suggested next steps. These outputs are intended to support human decision-making and should not be treated as guaranteed conclusions or as a replacement for human judgment.

We use service providers to operate Valibrio. These include Supabase for authentication, database, and storage infrastructure; Stripe for payments and subscription management; Resend for transactional email delivery; OpenAI for AI-assisted features; and PostHog for optional product analytics.

These providers process information only to the extent needed for the services they provide to us, subject to their applicable contractual and data-protection obligations.

We may also disclose information where required by law, necessary to protect our rights or the security of the service, or as part of a corporate transaction where permitted by applicable law.

We do not sell personal data.

Payments, checkout, invoices, and subscription management are handled through Stripe. Stripe receives information needed to provide those services, such as customer and subscription information. Valibrio does not store full payment-card details.

Some service providers used by Valibrio may process personal data outside Estonia or the European Economic Area. Where applicable, we use appropriate safeguards required by data-protection law for international transfers of personal data.

We retain personal data for as long as reasonably necessary for the purposes for which it was collected, including providing the service, maintaining security and reliability, meeting legal and accounting obligations, resolving disputes, and enforcing our agreements.

Validation responses are generally retained with the associated validation. Deleting a validation deletes its associated response records and response step answers. Deleting an account deletes associated account data and validations, which in turn removes their associated responses. Uploaded files associated with account deletion may be removed through an asynchronous storage-cleanup process.

Certain operational records have separate retention periods. Analytics events are retained for up to 24 months. Security audit events are retained for up to 365 days, while rate-limit and short-lived authentication-abuse telemetry is retained for approximately 24 hours. Sent email queue records are retained for up to 90 days, while failed email queue records may be retained for up to 180 days. Completed storage-cleanup records are retained for up to 30 days, and permanently failed cleanup records may be retained for up to 180 days.

Some limited records may remain after account or content deletion where necessary for legal, billing, security, fraud-prevention, dispute-resolution, or operational purposes.

Account holders can request deletion through Valibrio's account controls. Account deletion removes the Valibrio account and associated application data through the deletion relationships used by the service. Uploaded assets are queued for storage cleanup.

Where an active subscription exists, Valibrio first cancels the applicable subscription before completing account deletion. Payment providers may retain transaction or billing records under their own legal and regulatory obligations.

Depending on applicable law and the circumstances of the processing, you may have rights to request access to your personal data, correction of inaccurate data, deletion, restriction of processing, data portability, or objection to certain processing. Where processing is based on consent, you may withdraw that consent at any time without affecting processing that occurred before withdrawal.

To exercise rights relating to processing for which Valibrio is the controller, contact privacy@valibrio.com. We may need to verify your identity before completing a request.

If your request concerns feedback you submitted to a validation, the validation creator may be the controller responsible for that data. In that case, we may direct you to the creator or assist the creator in responding to the request where appropriate.

You have the right to lodge a complaint with a competent data-protection supervisory authority. In Estonia, the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Valibrio is not intended for children to create or manage Valibrio accounts. Validation creators are responsible for ensuring that their use of Valibrio, including any collection of participant information, complies with applicable requirements concerning children and minors.

We may update this Privacy Policy as Valibrio develops or as legal requirements change. When we make changes, we will update the "Last updated" date on this page. Where required, we will provide additional notice of material changes.

For privacy questions or requests relating to your personal data, contact privacy@valibrio.com. For general questions about Valibrio, contact hello@valibrio.com.