Privacy Policy

1. Introduction

This Privacy Policy describes how Innolope LLC ("Innolope", "we", "us", or "our") collects, uses, and handles your personal data ("Personal Data") when you use Vibetown, our platform that connects job candidates with recruiters and employers, including our website, our mobile applications for iOS and Android, and the Vibetown browser extension for Chrome and other Chromium-based browsers, and other related services we offer (collectively, the "Platform" or "Service"). We are committed to protecting your privacy and being transparent about our data practices, particularly given the sensitive nature of career and employment information.

By using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Policy, please do not access or use the Service. Any capitalized terms not defined herein have the meaning ascribed to them in our Terms of Service. This Privacy Policy applies to all users of Vibetown, including job candidates seeking opportunities, recruiters searching for candidates, and employers posting positions, though certain sections may specifically address rights available under particular jurisdictions' laws.

Understanding how we handle your professional information is crucial, as Vibetown processes career-related data including work history, skills, education, and other professional information that you may consider sensitive. This Privacy Policy explains what information we collect, how we use it to connect you with opportunities or candidates, who we share it with (including third-party AI providers that help enhance your profile), and what rights you have regarding your information. We encourage you to read this policy carefully and contact us if you have any questions.

2. Information We Collect

We collect various types of information to provide you with a functional, personalized job-matching platform. The information we collect falls into several categories: information you provide directly, information we import from third-party services like LinkedIn, information we collect automatically through your use of the Platform, and information we generate or derive using artificial intelligence and machine learning technologies.

2.1 Account and Profile Information

When you create an account with Vibetown, we collect Personal Data that you voluntarily provide to establish your profile and enable you to use the Platform's features. The specific information we collect depends on whether you are registering as a job candidate or as a recruiter/employer.

For Job Candidates, we collect the following information during registration and profile creation: your full name, email address, phone number (optional but recommended for recruiter contact), location information including city, state/region, and country, current job title and company, desired job titles and roles you are seeking, work authorization status and location preferences, professional summary or biography, years of experience, and salary expectations or ranges (optional). You may also provide additional profile information such as detailed work history including company names, job titles, employment dates, and descriptions of your roles and responsibilities; educational background including institutions attended, degrees earned, fields of study, and graduation dates; skills and competencies relevant to your career; certifications, licenses, and professional credentials; portfolio links, personal websites, or online profiles; language proficiencies; and availability and notice period for new opportunities.

For Recruiters and Employers, we collect company name and information, your role and title within the organization, business email address, phone number, company size and industry, and locations where you recruit or have offices. You may also provide information about job openings including job titles, descriptions, requirements, locations, salary ranges, and other relevant details about positions you are looking to fill.

All users create account credentials including a username (typically your email address) and password. Your password is immediately cryptographically hashed using industry-standard algorithms before being stored in our systems, and we never store passwords in plain text. We cannot retrieve your original password, and if you forget it, you must reset it through our secure password reset process.

2.2 LinkedIn Profile Data

To streamline the profile creation process and ensure your Vibetown profile is comprehensive and up-to-date, we offer the option to import information from your LinkedIn profile. If you choose to connect your LinkedIn account, you will be redirected to LinkedIn's authentication page where you can grant Vibetown permission to access specific information from your LinkedIn profile.

LinkedIn Data We May Access: When you authorize the connection, we may access and import the following information from your LinkedIn profile, subject to LinkedIn's API permissions and your LinkedIn privacy settings: basic profile information including your name, headline, profile photo, and location; work experience including current and past positions, company names, job titles, employment dates, and job descriptions; education history including schools attended, degrees earned, fields of study, and dates of attendance; skills that you have listed on your LinkedIn profile; recommendations and endorsements you have received; connections count (not the identities of your connections); and any other information you have made accessible through LinkedIn's API and that you authorize us to access.

How We Use LinkedIn Data: The information imported from LinkedIn is used to automatically populate your Vibetown profile, saving you time and ensuring consistency between platforms. You maintain full control over this imported information and can edit, supplement, or remove any data after it has been imported. We do not continuously sync with your LinkedIn profile; the import is a one-time action that occurs when you connect your account, though you may choose to re-import updated information at any time.

Your Control Over LinkedIn Data: Connecting your LinkedIn account is entirely optional. You can create a comprehensive Vibetown profile manually without connecting LinkedIn. If you do connect your LinkedIn account, you can disconnect it at any time through your account settings. Disconnecting LinkedIn will not delete the information that was previously imported to your Vibetown profile; if you wish to remove that information, you must manually delete it from your profile. You can also manage what information LinkedIn shares with third-party applications through your LinkedIn privacy settings.

LinkedIn's Terms and Privacy: When you connect your LinkedIn account, you are also subject to LinkedIn's User Agreement and Privacy Policy. We are not responsible for LinkedIn's data practices, and you should review LinkedIn's policies to understand how they handle your information. LinkedIn may receive information about your use of the connection feature, including that you have connected your LinkedIn account to Vibetown.

2.3 Resume and Document Uploads

You may choose to upload your resume, CV, cover letters, portfolio materials, certifications, or other professional documents to your Vibetown profile. When you upload documents, we collect the files themselves along with any metadata associated with those files, such as file names, file types, creation dates, and modification dates. We may use automated parsing technology to extract structured information from uploaded resumes and documents to populate your profile fields, making it easier for you to create a comprehensive profile and for recruiters to find relevant candidates.

The extracted information may include contact details, work history, education, skills, and other professional information contained in the document. You can review and edit this extracted information to ensure accuracy. Original uploaded documents are stored securely and may be made available to recruiters who express interest in your profile or when you apply to specific positions, depending on your privacy settings and application choices.

2.4 Job Search and Application Information

We collect information about how you interact with job opportunities on the Platform. This includes the types of jobs you search for, including search terms, filters applied (such as location, salary range, experience level, job type), and search frequency; jobs you view, save, or bookmark; jobs you apply to, including application dates and any application materials or messages you submit; jobs you are recommended or matched to based on your profile; and your responses to recruiter outreach or interview requests.

For recruiters and employers, we collect information about the job postings you create, candidates you search for and view, candidates you contact or invite to apply, candidates you bookmark or save for later review, and hiring decisions and outcomes (if you choose to provide this feedback).

2.5 Communication Data

We collect information related to communications that occur through the Platform or between you and Vibetown. This includes messages exchanged between candidates and recruiters through our messaging system, including message content, timestamps, read receipts, and attachments; communications you send to our customer support team, including support tickets, emails, chat conversations, and any attachments or screenshots you provide; survey responses and feedback you provide about the Platform; and notifications and alerts you receive and your interactions with them.

Communications sent through our Platform may be monitored for quality assurance, safety, and compliance purposes. We use automated systems to detect spam, harassment, inappropriate content, or violations of our Terms of Service in communications between users. However, we do not routinely read user messages for other purposes.

2.6 Usage Data and Analytics

We automatically collect information about how you access and use the Platform through various tracking technologies. This usage data helps us understand how users interact with Vibetown, identify areas for improvement, and optimize the job-matching experience. The usage data we collect includes device information such as device type and model, operating system and version, browser type and version, screen resolution, device language settings, and mobile network information; technical identifiers including IP address, device identifiers, and cookie identifiers; location data including general geographic location based on IP address, and precise geolocation if you grant permission on mobile devices; usage patterns such as pages visited, features accessed, time spent on different sections, click patterns and navigation paths, search queries and filters used, and job postings or candidate profiles viewed; session information including login times, session duration, and frequency of use; performance data such as page load times, error messages, and technical issues encountered; and referral sources indicating how you found Vibetown, including referral URLs, marketing campaigns, or partner sources.

2.7 Cookies and Tracking Technologies

We use cookies, web beacons, pixels, local storage, and similar tracking technologies to collect information about your browsing behavior and preferences. These technologies serve various purposes including maintaining your login session, remembering your preferences and settings, analyzing usage patterns and Platform performance, delivering relevant job recommendations, measuring the effectiveness of our communications and marketing campaigns, enhancing security and preventing fraud, and providing personalized user experiences.

Types of Cookies We Use: Essential cookies that are strictly necessary for the Platform to function, including authentication, security, and session management (these cannot be disabled without affecting functionality); functional cookies that enable enhanced features and personalization, such as remembering your preferences, search filters, and language settings; analytics cookies that help us understand how users interact with the Platform by collecting usage statistics, performance metrics, and error reports using services like Google Analytics and Firebase Analytics; and marketing cookies used to deliver relevant job recommendations and measure campaign effectiveness.

Third-Party Cookies: We use third-party analytics and advertising services that may place their own cookies on your device. These third parties include Google Analytics for usage analysis and Firebase for mobile app analytics and crash reporting. These providers may use cookies and similar technologies to collect information about your use of Vibetown and other websites, and they process this information according to their own privacy policies.

Your Cookie Choices: You can control cookies through your browser settings, and most browsers allow you to block or delete cookies. However, please note that disabling essential cookies will prevent you from using certain features of the Platform. You can opt out of certain analytics cookies using industry opt-out mechanisms, such as the Google Analytics opt-out browser add-on. Where required by law, we provide a cookie consent manager when you first visit the Platform, allowing you to customize your cookie preferences.

2.8 Information from Third-Party Sources

In addition to information you provide directly and information we collect from LinkedIn with your authorization, we may receive information about you from other sources to enhance your profile, improve job matching, verify information, or provide better recommendations.

Publicly Available Information: We may collect information about you from publicly available sources, including public professional profiles on other platforms, professional association directories, academic publications and research papers, news articles and press releases, company websites and team pages, and professional social media posts. This information is used to supplement your profile, verify credentials, or provide context for your professional background, particularly for senior-level positions or specialized roles.

Background Check and Verification Services: If you apply for certain positions, employers may request that we conduct or facilitate background checks, employment verification, education verification, or credential verification through third-party verification services. We will only conduct such checks with your explicit consent and in compliance with applicable law, including the Fair Credit Reporting Act (FCRA) in the United States where applicable.

Referrals and Recommendations: If another user refers you to Vibetown or recommends you for a position, we may receive your name, email address, professional information, and details about why you were referred or recommended. We will use this information to invite you to join the Platform or to connect you with relevant opportunities.

Data Enhancement Services: We may use third-party data enrichment services to supplement the information in your profile with additional professional details, current employment information, skills validation, or market insights. This enhancement helps ensure that your profile is comprehensive and that our job recommendations are relevant and accurate.

2.9 Artificial Intelligence and Machine Learning Data

A core feature of Vibetown is our use of artificial intelligence and machine learning technologies to enhance profiles, provide personalized recommendations, match candidates with opportunities, and improve the overall job search and recruitment experience. To provide these AI-powered features, we may share your information with third-party AI service providers and generate additional data through AI analysis.

AI Service Providers We Use: We may share your profile information, resume content, job preferences, and related data with leading artificial intelligence providers, including but not limited to OpenAI (creators of GPT models and ChatGPT), Anthropic (creators of Claude), Google (including Google Cloud AI and Gemini), and other specialized AI and machine learning service providers. These providers process your information to power features such as AI-enhanced profile writing, personalized job recommendations, skills assessment and gap analysis, resume optimization suggestions, interview preparation assistance, and career development insights.

How AI Providers Process Your Data: When we share your information with AI providers, they use it to generate responses, recommendations, and analysis specific to your request or profile. For example, if you use our AI profile enhancement feature, your current profile information may be sent to OpenAI or Anthropic to generate suggested improvements to your professional summary, optimize your skills presentation, or create more compelling descriptions of your work experience. These AI providers process your data according to their own privacy policies and terms of service, and they may use your data to improve their AI models unless they offer specific data handling options that we configure.

Data Shared with AI Providers: The information shared with AI providers may include your professional profile information including work history, education, and skills; resume and document content; job search preferences and criteria; application materials and cover letters; communication content when using AI-assisted messaging features; and aggregated or anonymized usage patterns. We strive to share only the minimum information necessary to provide the requested AI-powered feature, but comprehensive profile data is often required for AI systems to generate relevant and personalized recommendations.

AI-Generated Data: Through our use of AI technologies, we may generate new information about you, such as enhanced profile descriptions, suggested skills or competencies, predicted job fit scores, personalized career path recommendations, optimized resume versions, and behavioral or preference insights derived from your interactions with the Platform. This AI-generated information becomes part of your profile data and is subject to the same privacy protections as other information we collect.

Your Control Over AI Features: While AI-powered features are integral to Vibetown's value proposition, you maintain control over which AI features you use. You can choose not to use AI enhancement tools, you can review and edit any AI-generated content before it is added to your profile, and you can request that we limit how your data is shared with specific AI providers by contacting us at [email protected]. However, please note that limiting AI data sharing may significantly impact the functionality and personalization of the Platform.

2.10 Information We Do Not Intentionally Collect

While we collect comprehensive professional information to facilitate job matching, there are categories of information we do not intentionally collect or request. We do not ask for or require you to provide Social Security numbers, government identification numbers, or tax identification numbers during profile creation (though employers may request such information during the hiring process after you have accepted a position); complete financial information such as bank account numbers or detailed financial records (though we collect salary expectations); comprehensive health or medical information (though you may voluntarily disclose accommodations you need); genetic or biometric data; information about your race, ethnicity, religious beliefs, political affiliations, sexual orientation, or union membership (though we support diversity initiatives and you may choose to self-identify for diversity programs); or detailed information about your family members or personal relationships.

However, you may voluntarily include some of this information in your profile, resume, or communications. If you choose to provide sensitive personal information beyond what we request, you acknowledge that we may process it as part of your profile to provide the Service, though we recommend exercising caution about including unnecessary sensitive information in your professional profile.

2.11 Browser Extension Data

The Vibetown browser extension is an optional tool you can install for Chrome and other Chromium-based browsers to surface enriched information about job vacancies as you browse job boards, company career pages, and other sites where vacancies are posted. This section describes specifically what the extension reads, when it reads it, and how the resulting data is used, in addition to the general practices described elsewhere in this Privacy Policy.

What the Extension Reads: When the extension is installed and enabled, and you are actively viewing a job vacancy or job posting page, the extension reads the vacancy-related content displayed on that page. This includes the job title, hiring company name, posting date, number of applicants (where displayed by the site), job location, and other vacancy details that are visible on the page. The extension is designed to identify and parse vacancy-related content only; it does not read, collect, or transmit the content of pages that are not job vacancy or job listing pages.

When the Extension Reads Data: The extension reads page content only when you are actively viewing a supported vacancy page and the extension is enabled. It does not run continuously in the background across your general browsing activity, and it does not monitor pages unrelated to job vacancies. If you disable or uninstall the extension, it stops reading page content immediately.

How We Use Extension Data: We use the vacancy details read by the extension to display enriched information back to you within the extension (such as company information, posting history, or how a listing compares to similar postings), and to populate and maintain the vacancy data used elsewhere on the Vibetown platform. We may also collect certain user actions taken on a vacancy page while the extension is active, such as which vacancies you view or save, to enrich our aggregate statistics about vacancies, hiring trends, and feature usage. This action data is used for aggregate analytics purposes; the extension does not collect personal data through this action tracking, and we do not use the extension to read or collect information such as messages, form entries, credentials, payment details, or your activity on websites unrelated to job vacancies.

Extension Permissions: To function, the extension requests browser permissions that allow it to read the content of pages on supported job board and career site domains and to identify when you are viewing a vacancy page. These permissions are used solely for the purposes described in this section and correspond to the permissions and their justifications declared in the extension's Chrome Web Store listing.

Your Choices: The extension is entirely optional. You can disable or uninstall it at any time through your browser's extension settings, which immediately stops any further data collection by the extension. Data previously collected through the extension is handled according to the retention and deletion practices described in Section 5 of this Privacy Policy.

3. How We Use Your Information

We use the Personal Data we collect to provide, maintain, improve, and personalize the Vibetown platform, connect candidates with recruiters and job opportunities, facilitate the recruitment process, communicate with you, ensure security and compliance, and conduct analytics and research. Our use of your information is guided by principles of necessity, relevance, and transparency, and we use your data only for purposes that are compatible with the purposes for which it was collected or for which you have provided consent.

3.1 Providing and Operating the Platform

The primary purpose for collecting and processing your Personal Data is to provide you with the Vibetown platform and all of its features. For job candidates, this includes creating and maintaining your professional profile with information from your account, LinkedIn imports, resume uploads, and manual entries; making your profile discoverable to recruiters and employers based on their search criteria and job requirements, subject to your privacy settings; matching you with relevant job opportunities based on your skills, experience, preferences, location, and other profile attributes; enabling you to search for, view, save, and apply to job postings; facilitating communication between you and recruiters or employers through our messaging system; providing AI-powered features to enhance your profile, optimize your resume, and receive personalized career recommendations; tracking your application status and managing your job search activities; and sending you notifications about new job matches, recruiter interest, application updates, and platform activity.

For recruiters and employers, we use your information to create and manage your account and company profile; enable you to post job openings and manage active positions; allow you to search for and discover candidates whose profiles match your requirements; facilitate communication with candidates you are interested in; provide analytics about your job postings, candidate engagement, and recruitment activities; and offer AI-powered tools to help you write better job descriptions, identify qualified candidates, and optimize your recruitment process.

Your account information enables us to authenticate you when you log in and ensure you have authorized access to your profile and activities. Your profile data allows us to understand your professional background and qualifications or your hiring needs, which is essential for our matching algorithms to work effectively. The integration with LinkedIn and AI services enables automated profile creation and enhancement, saving you time and improving profile quality. Communication data allows us to facilitate connections between candidates and recruiters, which is the core purpose of the Platform.

3.2 Job Matching and Recommendations

A central feature of Vibetown is our intelligent matching system that connects candidates with relevant opportunities and helps recruiters find qualified candidates. We use your profile information, preferences, search behavior, and application history, combined with machine learning algorithms and AI analysis, to generate personalized job recommendations for candidates; match candidates to recruiter searches and job requirements; predict job fit and compatibility based on skills, experience, and other factors; surface relevant candidates to recruiters based on job specifications; identify skills gaps and suggest learning opportunities; and provide market insights such as salary benchmarks and hiring trends for your role and location.

Our matching algorithms analyze multiple factors including skills and competencies, years and types of experience, education and certifications, location and relocation preferences, salary expectations and ranges, job preferences such as remote work, industry, or company size, career trajectory and growth potential, and patterns in your job search and application behavior. We continuously refine these algorithms using machine learning techniques that learn from successful matches, hiring outcomes (when shared with us), and user engagement patterns.

To power these features, we may share your information with AI service providers like OpenAI, Anthropic, and Google as described in Section 2.9. These providers help us analyze profiles, generate recommendations, assess candidate-job fit, and provide insights that improve matching accuracy. While we strive to make our recommendations as relevant and helpful as possible, you should independently evaluate all job opportunities and make your own decisions about which positions to pursue.

3.3 Profile Enhancement and AI-Powered Features

We offer various AI-powered features designed to help you present your professional qualifications effectively and optimize your job search or recruitment process. We use your information, in combination with AI technologies, to provide AI-enhanced profile writing that suggests improvements to your professional summary, work descriptions, and skills presentation; resume optimization that analyzes your resume and provides suggestions for improvement to increase visibility to recruiters; skills assessment that identifies skills gaps and recommends skills to add based on your target roles; interview preparation that provides personalized interview tips and practice questions based on positions you've applied for; career path recommendations that suggest potential career trajectories and development opportunities; automated job description generation for recruiters to create compelling and compliant job postings; and candidate screening assistance that helps recruiters quickly identify promising candidates.

These features involve sharing your profile data, resume content, and related information with third-party AI providers as described in Section 2.9. The AI providers process this information to generate personalized recommendations and insights, which we then present to you through the Platform. You always have the option to review, modify, or reject AI-generated content before incorporating it into your profile or using it in your job search. We believe these AI-powered features significantly enhance the value of Vibetown, but we also recognize that you maintain ultimate control over your professional presentation and career decisions.

3.4 Communications

We use your contact information to send you various types of communications related to your use of the Platform. These communications fall into several categories: transactional communications that are necessary for the operation of your account, such as account verification emails when you register, password reset emails when you request password recovery, application confirmations when you apply to jobs, messages from recruiters or candidates, security notifications if we detect unusual account activity, and important updates about changes to our Terms of Service or Privacy Policy; notification communications that keep you informed of Platform activity, including new job matches based on your preferences, recruiter views or interest in your profile, application status updates, saved search alerts, and weekly or daily activity digests; and optional marketing communications about new features, platform improvements, success stories, career advice and resources, webinars or events, and promotional offers from Vibetown or selected partners.

Transactional communications are necessary for the Platform to function and for us to fulfill our contract with you, and you cannot opt out of these essential messages while maintaining an account. Notification communications can be customized through your notification preferences, where you can choose which types of alerts you want to receive and through which channels (email, push notifications, SMS if available). Marketing communications are sent only to users who have opted in to receive them, and you can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by adjusting your communication preferences in your account settings.

We may also use your information to respond to your support inquiries, provide customer service, troubleshoot technical issues, and gather feedback about your experience with the Platform. Customer support communications are retained to maintain a record of our interactions, improve support quality, and protect both your interests and ours in case of disputes.

3.5 Platform Improvement and Development

We use analytics data, usage patterns, and aggregated information to understand how users interact with Vibetown and to continuously improve the Platform. This includes analyzing which features are most valuable to users, identifying pain points or areas of confusion in the user experience, testing new features and measuring their effectiveness, optimizing our matching algorithms and job recommendations, improving search functionality and relevance, enhancing mobile app performance and reliability, identifying and fixing bugs and technical issues, and conducting A/B tests to determine which design or functionality choices work best.

We use analytics services like Google Analytics and Firebase Analytics to collect and analyze this usage data. These services help us understand aggregate trends such as how many users visit particular pages, how long they spend on different sections, which devices and browsers are most commonly used, and where users encounter errors or abandon certain flows. This analysis is typically conducted on aggregated, anonymized data, meaning we look at patterns across all users rather than examining individual user behavior for purposes other than providing the Service to that individual user.

We may also use machine learning and AI technologies to analyze usage patterns, predict user needs, personalize the Platform experience, detect and prevent fraudulent or abusive behavior, and identify trends in the job market and recruitment industry. This analysis helps us develop new features, improve existing functionality, and ensure Vibetown remains competitive and valuable in a rapidly evolving employment marketplace.

3.6 Security, Fraud Prevention, and Compliance

We process your information to maintain the security and integrity of the Platform and to comply with our legal obligations. This includes authenticating users and preventing unauthorized access to accounts; detecting and preventing fraud, spam, scams, and abuse of the Platform; identifying and blocking fake profiles, misleading job postings, or malicious actors; monitoring for violations of our Terms of Service and Community Guidelines; investigating security incidents, data breaches, or suspicious activity; enforcing our policies and protecting our legal rights; complying with applicable laws, regulations, and legal processes; responding to lawful requests from government authorities or law enforcement; preventing illegal activities such as discrimination in hiring, money laundering, or human trafficking; and protecting the rights, property, and safety of Vibetown, our users, and the public.

Security processing may involve analyzing login patterns to detect unauthorized access attempts, scanning communications for spam or phishing attempts, using automated systems to identify fake or fraudulent profiles, monitoring for patterns consistent with prohibited activities, and maintaining logs of system access and activities for security auditing purposes. We implement technical and organizational security measures as described in Section 9 to protect your information from unauthorized access, loss, or misuse.

Compliance processing may require us to retain certain records for specified periods to meet accounting, tax, or employment law requirements; respond to subpoenas, court orders, or other legal processes; cooperate with investigations by regulatory authorities; report suspicious activities as required by law; and maintain records necessary to establish, exercise, or defend legal claims.

3.7 Research and Analytics

We may use aggregated, anonymized, or de-identified information for research, analytics, and business purposes. This includes creating industry benchmarks and labor market insights such as hiring trends, salary ranges by role and location, time-to-hire metrics, and candidate supply and demand patterns; publishing whitepapers, reports, or blog content about the job market and recruitment industry; conducting research to improve AI and machine learning models; sharing insights with partners, clients, or the public to advance understanding of employment trends; and analyzing business metrics to evaluate Platform performance and growth.

Before using information for these purposes, we ensure that it has been properly anonymized or aggregated so that it cannot reasonably be used to identify specific individuals. For example, we might report that "the average salary for software engineers in San Francisco is $X" or that "candidates with Y skill receive Z% more recruiter interest," but we would not report information that could be traced back to individual users. Because this anonymized information cannot identify you, it is not considered Personal Data under most privacy laws, and we may use and share it without restriction.

3.8 Legal Bases for Processing (GDPR and Similar Laws)

For users in jurisdictions with comprehensive data protection laws such as the European Economic Area, United Kingdom, Switzerland, and others, we process your Personal Data based on one or more of the following legal bases: Contractual necessity, where processing is necessary to perform our contract with you to provide the Platform and its features, such as creating your profile, matching you with opportunities, and facilitating communications; Consent, where you have explicitly consented to processing for specific purposes, such as connecting your LinkedIn account, using AI enhancement features, or receiving marketing communications; Legitimate interests, where processing is necessary for our legitimate business interests or the interests of third parties, provided these interests are balanced against your rights and are not overridden by your interests or fundamental rights and freedoms (legitimate interests include improving the Platform, ensuring security, preventing fraud, conducting analytics, and optimizing job matching); and Legal obligations, where processing is required to comply with applicable laws, regulations, court orders, or governmental requests.

Where we rely on legitimate interests as a legal basis, we have conducted balancing assessments to ensure that our interests do not override your rights. If you have concerns about our legal bases for processing or wish to object to processing based on legitimate interests, you may contact us at [email protected]. Where we rely on consent, you have the right to withdraw consent at any time, though this will not affect the lawfulness of processing that occurred before consent was withdrawn.

4. How We Share Your Information

Sharing your professional information is fundamental to Vibetown's purpose of connecting candidates with recruiters and employment opportunities. However, we are committed to sharing your information responsibly, transparently, and in accordance with your privacy preferences and applicable law. We do not sell your Personal Data to third parties for their marketing purposes. The following sections describe the circumstances under which we share your information and with whom.

4.1 With Recruiters and Employers

The core functionality of Vibetown involves making candidate profiles visible to recruiters and employers who are searching for talent. When you create a profile on Vibetown, you understand and agree that recruiters and employers using the Platform may be able to view your profile information, subject to the privacy settings you configure.

Profile Visibility: Based on your privacy settings, recruiters and employers may be able to see your professional information including name and contact information, current and past work experience, education and certifications, skills and competencies, professional summary, location and work authorization, salary expectations (if you choose to include them), resume and portfolio materials you have uploaded, and any other information you have included in your public profile. You can control the visibility of your profile through privacy settings, including making your profile fully public and discoverable by all recruiters; making your profile visible only to recruiters at specific companies; making your profile anonymous (hiding your name and current employer until you choose to reveal it); or keeping your profile completely private and only applying to specific jobs without being discoverable in searches.

Job Applications: When you apply to a specific job posting, the employer or recruiter who posted that position will receive your application along with the information you choose to include, such as your full profile information, your resume and cover letter, answers to any application questions, and your contact information for follow-up. Once you apply to a position, you are sharing your information directly with that employer, and their use of your information is governed by their own privacy policy and employment practices, not by this Privacy Policy.

Recruiter Communication: When recruiters express interest in your profile or contact you through the Platform, they gain access to the contact information necessary to communicate with you, including your email address and phone number if you have provided it. You can choose to respond to recruiter outreach or ignore it based on your interest in the opportunity.

Employer Analytics: We may provide aggregate, anonymized analytics to employers about candidate engagement with their job postings, such as how many candidates viewed the posting, how many applied, and general demographic information about the candidate pool (without identifying specific individuals who did not apply).

4.2 With Artificial Intelligence Service Providers

As described in Sections 2.9 and 3.3, we use third-party AI service providers to power intelligent features on the Platform. We share your information with these providers to enable AI-enhanced profile writing, personalized recommendations, resume optimization, and other AI-powered features that improve your experience on Vibetown.

AI Providers We Work With: We may share your information with leading AI technology providers, including but not limited to OpenAI Inc., which provides GPT models and language generation capabilities; Anthropic PBC, which provides Claude AI for natural language processing and analysis; Google LLC, including Google Cloud AI Platform and Gemini for machine learning and data analysis; and other specialized AI and machine learning service providers for specific features such as skills assessment, semantic search, or predictive analytics.

Information Shared with AI Providers: Depending on which features you use, we may share the following information with AI providers: your profile information including work history, education, skills, and professional summary; the content of your resume and uploaded documents; your job search preferences and criteria; text of cover letters or application materials; messages you compose using AI-assisted writing tools; search queries and browsing patterns; and contextual information necessary for the AI to generate relevant recommendations.

How AI Providers Use Your Data: AI providers process your information to fulfill the specific requests we make on your behalf, such as generating improved profile descriptions, suggesting skills to add, or providing job recommendations. Each AI provider handles data according to their own privacy policy and terms of service. Some providers may use your data to train and improve their AI models unless we have configured specific data handling options or entered into agreements that restrict such use. We encourage you to review the privacy policies of these providers: OpenAI Privacy Policy at https://openai.com/privacy; Anthropic Privacy Policy at https://www.anthropic.com/privacy; and Google Privacy Policy at https://policies.google.com/privacy.

Data Processing Agreements: Where required by applicable law, we enter into data processing agreements with AI providers that specify their obligations regarding data protection, security, confidentiality, and data retention. These agreements ensure that AI providers process your information only for the purposes we specify and implement appropriate security measures. However, you acknowledge that once we share your information with third-party AI providers, those providers become independent data controllers or processors of your information, and we cannot control all aspects of how they handle your data beyond our contractual agreements with them.

Your Control: You can choose not to use AI-powered features if you prefer not to have your information shared with AI providers. However, because AI is deeply integrated into Vibetown's core functionality, limiting AI data sharing may significantly reduce the Platform's effectiveness and your ability to access personalized recommendations. If you have specific concerns about a particular AI provider, you may contact us at [email protected] to discuss options.

4.3 With Service Providers and Vendors

We engage third-party service providers to perform specific functions on our behalf in support of the Platform. These service providers have access to Personal Data only as necessary to perform their designated functions and are contractually obligated to maintain the confidentiality and security of that information and not use it for any other purpose.

Our service providers include: Cloud hosting and infrastructure providers such as Amazon Web Services, Google Cloud Platform, or Microsoft Azure that host our servers, databases, and application infrastructure; Email delivery services like SendGrid, Amazon SES, or similar providers that send transactional and marketing emails on our behalf; SMS and communication providers such as Twilio that enable text message notifications; Analytics platforms including Google Analytics, Firebase Analytics, and Mixpanel that help us understand Platform usage; Customer support and help desk tools like Zendesk or Intercom that manage support tickets and customer communications; Payment processors such as Stripe that handle subscription payments or premium features (if applicable); Background check and verification services if you authorize background checks for specific job applications; Recruiting software and applicant tracking system integrations that allow employers to import candidate data into their systems; Security services including fraud detection, DDoS protection, and vulnerability scanning providers; and Content delivery networks (CDNs) that optimize the delivery of Platform content and improve performance.

All service providers are carefully vetted and must sign contracts that require them to comply with applicable data protection laws, implement appropriate security measures, use data only for specified purposes, and delete or return data when our relationship ends. We conduct regular reviews of service providers to ensure ongoing compliance with our security and privacy standards.

4.4 With Third-Party Integrations and Partners

Vibetown may offer integrations with third-party services that enhance the Platform's functionality or connect with tools you already use. When you choose to connect third-party services to your Vibetown account, information may be shared between Vibetown and those services.

Calendar and Scheduling Integrations: If you connect a calendar service like Google Calendar or Outlook to schedule interviews, we may share interview details and availability information with the calendar provider. Professional Development Platforms: We may partner with online learning platforms to recommend courses or certifications that could enhance your skills. If you choose to enroll through Vibetown, we may share your skills profile and learning goals with the education provider. Applicant Tracking Systems (ATS): Employers may use integrations to import candidate data from Vibetown into their internal recruiting systems. When this occurs, your application information is shared with the employer's chosen ATS provider. Video Interview Platforms: If an employer uses video interviewing tools, we may share relevant candidate information to facilitate scheduling and conducting video interviews. LinkedIn and Other Social Platforms: As described in Section 2.2, you may connect your LinkedIn profile to import data. This creates a connection between Vibetown and LinkedIn, and LinkedIn may receive information about your use of this feature.

These integrations are subject to the privacy policies and terms of service of the third-party providers. We recommend reviewing those policies before connecting third-party services. You can disconnect integrations at any time through your account settings, though this may limit certain functionality.

4.5 With Your Consent or at Your Direction

We may share your information with third parties when you explicitly consent to such sharing or when you direct us to share your information. For example: when you choose to share your Vibetown profile externally using a share link; when you authorize us to post information about you on social media or other platforms; when you consent to participate in research studies or surveys conducted by third parties; when you opt in to receive information from our partners or sponsors; or when you explicitly request that we share information with a specific person or organization.

We will clearly explain what information will be shared, with whom it will be shared, and for what purpose before requesting your consent. You can withdraw consent for future sharing at any time, though withdrawal will not affect information already shared based on your prior consent.

4.6 For Business Transfers

If Innolope is involved in a merger, acquisition, asset sale, financing, bankruptcy, dissolution, reorganization, or similar corporate transaction or proceeding, your Personal Data may be transferred or disclosed as part of that transaction. In such circumstances, we will take reasonable steps to ensure that any successor entity or acquiring party honors this Privacy Policy or provides you with notice of any changes to how your Personal Data will be handled, as required by applicable law.

Before such a transfer occurs, where required by law, we will provide you with advance notice through email or a prominent notice on our website, inform you of any material changes to how your Personal Data will be processed or who will control it, and give you the opportunity to delete your account if you do not wish your information to be transferred. After such a transfer, the acquiring entity would become the data controller of your Personal Data and would be responsible for complying with applicable privacy laws and honoring the commitments made in this Privacy Policy unless you are provided notice and, where required, an opportunity to consent to a different privacy policy.

4.7 For Legal Compliance and Protection

We may disclose your Personal Data if we determine in good faith that disclosure is reasonably necessary to comply with applicable laws, regulations, legal processes, or enforceable governmental requests; respond to valid legal demands such as subpoenas, court orders, search warrants, or other lawful requests from authorities; enforce our Terms of Service, investigate potential violations of our policies, or respond to claims of illegal activity or infringement of third-party rights; protect the rights, property, or safety of Innolope, our users, or the public; detect, prevent, or address fraud, security issues, or technical problems; prevent imminent harm to individuals or property; or establish, exercise, or defend legal claims.

Before disclosing information in response to legal requests, we review each request carefully to ensure it is valid, properly scoped, and issued by an authority with jurisdiction. We may seek legal counsel to verify the request's legitimacy, and where legally permitted, we will notify you of such legal requests so that you can seek to protect your rights, unless we are prohibited from doing so by law, court order, or if providing notice could undermine the purpose of the request, such as in cases involving ongoing criminal investigations. We may also challenge overbroad or legally deficient requests in appropriate circumstances.

4.8 Aggregated and Anonymized Information

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you individually. This might include industry statistics and labor market insights such as "software engineer salaries in New York range from $X to $Y" or "candidates with certification Z receive 40% more recruiter interest"; general platform usage statistics such as "Vibetown has X active job seekers and Y active job postings"; demographic trends that show patterns across large groups without identifying individuals; research findings based on anonymized data sets; and benchmarking reports that help employers understand hiring market conditions.

Before sharing such information, we ensure it has been properly anonymized through techniques such as aggregation (combining data from many individuals), generalization (reducing precision to prevent identification), or data masking (removing or obscuring identifying details). Because this information cannot be used to identify you, it is not considered Personal Data under most privacy laws, and we may use and share it without restriction.

5. Data Retention and Deletion

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements. Our retention practices balance our operational needs, legal requirements, and your privacy rights. We implement data retention policies that specify retention periods for different categories of information and have processes to ensure that data is securely deleted or anonymized when it is no longer needed.

5.1 Active Account Data Retention

Your account information, profile data, job search history, applications, and communications are retained for as long as your account remains active. An account is considered active from the time you create it until you explicitly delete your account or until we close inactive accounts in accordance with our policies. We define an inactive account as one that has not been accessed or used for a substantial period, typically twenty-four (24) months or longer for candidates and eighteen (18) months for recruiters who have not posted jobs or searched for candidates during that time.

If your account remains inactive for an extended period, we may send you email notifications asking whether you wish to keep your account active. If we receive no response and the account continues to remain inactive, we may close the account and delete the associated data after providing reasonable notice, typically an additional thirty (30) days. This helps us maintain data quality, reduce security risks associated with abandoned accounts, and ensure that only current, relevant profiles are visible to recruiters.

For recruiters and employers, job postings are retained in your account for as long as they remain active or until you delete them. Archived job postings may be retained for a limited period (typically twelve months) for your reference and reporting purposes, after which they are permanently deleted unless you have explicitly saved them.

5.2 Account Deletion and Grace Period

When you delete your account through the Platform settings or by contacting our support team, we begin the deletion process immediately. Your account is first deactivated, which prevents you from logging in, removes your profile from search results, makes you invisible to recruiters, and stops all notifications and communications. However, we maintain your account data for a grace period of thirty (30) days after deletion to allow for account recovery in case you deleted your account by mistake or change your mind. During this grace period, you can contact us at [email protected] to reactivate your account and restore your data.

After the thirty-day grace period expires, we permanently delete your account information from our active production systems. This deletion includes your profile information, work history and education details, uploaded resumes and documents, job search preferences and saved searches, application history and communications with recruiters, and account credentials. The deletion process is typically completed within thirty (30) days after the grace period ends, meaning your data is fully removed within approximately sixty (60) days of your initial deletion request.

However, certain information may be retained beyond this period for specific legal, operational, or safety purposes as described below, and some information may remain in backup systems for up to ninety (90) days before being permanently purged.

5.3 Legal and Compliance Retention

Some categories of information must be retained for longer periods to comply with legal obligations, even after you delete your account. Transaction records and billing information related to any payments you made (for premium features, if applicable) are retained for at least seven (7) years to comply with tax and accounting regulations. Communications related to customer support, particularly those involving complaints, disputes, or legal matters, may be retained for up to seven (7) years to support potential legal claims or regulatory inquiries. Records related to background checks, employment verification, or other screening processes may be retained for periods specified by applicable law, such as requirements under the Fair Credit Reporting Act.

Information necessary to enforce our Terms of Service, establish or defend legal claims, or protect against fraud may be retained until the underlying legal matter is resolved, including any applicable statute of limitations period. Information subject to legal holds, litigation, or government investigations is retained until we are authorized to delete it. These retention periods are necessary to meet our legal obligations and protect our legitimate interests, and they apply even if you request deletion of your account.

5.4 Recruiter and Employer Retention

For recruiters and employers, we retain certain information to maintain business relationships and comply with contractual obligations. Company profiles and recruiter account information are retained for the duration of the business relationship. Job posting history and candidate interaction records (such as which candidates were contacted or interviewed) may be retained for up to three (3) years to provide reporting, analytics, and compliance documentation for equal employment opportunity requirements. Aggregated hiring analytics and recruitment metrics may be retained indefinitely in anonymized form for benchmarking and research purposes.

If an employer account is closed or a company stops using Vibetown, we will delete the account data following similar procedures as for candidate accounts, with a grace period and legal retention requirements. However, candidates who applied to jobs from that employer may still see historical references to those applications in their own account history.

5.5 Retention by Third Parties

Information we have shared with third parties, including recruiters who viewed your profile, employers you applied to, AI service providers who processed your data, and other third-party service providers, is subject to those parties' own retention policies and legal obligations. Once your information has been shared with a third party, we cannot control or guarantee deletion of that information from the third party's systems, even after you delete your Vibetown account.

For example, if a recruiter downloaded your resume or saved your profile information to their own systems, that information remains in their possession subject to their data practices. If we shared your information with OpenAI or Anthropic for AI processing, those providers may have retained your data according to their policies. If you applied directly to an employer, that employer maintains your application in their hiring records according to their record retention policies and legal requirements.

We encourage you to consider these ongoing retention practices when deciding what information to share on the Platform and with which parties. You may wish to contact third parties directly to request deletion of your information from their systems, though they may have legitimate reasons to retain it as described in their own privacy policies or legal obligations.

5.6 Backup and Disaster Recovery

We maintain encrypted backups of our systems for disaster recovery and business continuity purposes. These backups may contain copies of your Personal Data as it existed at the time each backup was created. Backups are automatically cycled and deleted according to our backup retention schedule, which typically retains daily backups for thirty (30) days, weekly backups for ninety (90) days, and monthly backups for one (1) year.

When you delete your account, your data is removed from our production systems within the timeframes described above, but copies may remain in backup systems until those backups are cycled out according to the retention schedule. We do not restore individual user data from backups except in the event of a major system failure affecting multiple users. Backups are stored in secure, encrypted form and are accessible only to authorized technical personnel who require access for disaster recovery purposes.

5.7 Anonymization and Aggregation

After applicable retention periods have expired, we may retain certain information in anonymized or aggregated form indefinitely for analytics, research, product development, and business purposes. Anonymized information is data that has been modified so that it can no longer reasonably be linked to an individual user, either by itself or in combination with other available information. Aggregated information combines data from multiple users in a way that makes it impossible to identify individual contributions.

For example, we might retain anonymized data showing that "candidates with 5+ years of experience in role X apply to an average of Y positions per month" without retaining any information that identifies specific candidates. These anonymized datasets are valuable for understanding labor market trends, improving our matching algorithms, and providing insights to employers, researchers, and the public. Because this information cannot be used to identify you, it is not considered Personal Data under most privacy laws, and we are not required to delete it upon request.

6. International Data Transfers

Innolope LLC is headquartered in the United States, and our primary servers and operations are located in the United States. If you access or use Vibetown from outside the United States, your Personal Data will be transferred to, stored in, and processed in the United States and potentially in other countries where our service providers operate, including where AI providers like OpenAI, Anthropic, and Google maintain their infrastructure. These countries may have data protection laws that differ from the laws of your country of residence and may not provide the same level of protection as your jurisdiction.

6.1 Legal Mechanisms for International Transfers

When we transfer Personal Data internationally, particularly from the European Economic Area (EEA), the United Kingdom, Switzerland, or other jurisdictions with comprehensive data protection laws, we implement appropriate safeguards to ensure that your Personal Data remains protected in accordance with this Privacy Policy and applicable law. These safeguards may include Standard Contractual Clauses (SCCs) approved by the European Commission, the UK Information Commissioner's Office, or other competent authorities, which are contractual commitments between data exporters and importers to protect transferred data; adequacy decisions issued by competent authorities recognizing that certain jurisdictions provide adequate data protection; binding corporate rules for transfers within multinational organizations; supplementary measures such as encryption, access controls, and legal assessments to ensure adequate protection in light of local laws; or other legally recognized transfer mechanisms as they become available.

For transfers to the United States from the EEA or UK, we monitor developments in transatlantic data transfer frameworks and implement supplementary measures as necessary to ensure adequate protection of Personal Data in light of legal requirements and guidance from data protection authorities. We conduct transfer impact assessments to evaluate the legal environment in destination countries and implement additional technical and organizational measures where necessary to ensure adequate protection, such as encryption, data minimization, or contractual protections that exceed standard requirements.

6.2 Data Processing Locations

Our primary data processing occurs in data centers located in the European Union. Data may be replicated across multiple geographic locations for redundancy, disaster recovery, load balancing, and performance optimization purposes.

Our service providers and AI partners may process data in various global locations. Google services may process data in the United States, Europe, and Asia-Pacific regions where Google maintains facilities. OpenAI processes data primarily in the United States, with some processing potentially occurring in other regions where their infrastructure providers operate. Anthropic processes data in the United States and other locations where their service providers maintain infrastructure. LinkedIn data is accessed from LinkedIn's servers, which may be located in various countries globally. Other service providers may process data in their respective operating regions as specified in their documentation.

When you use Vibetown, your data may be transmitted to and processed by servers and services in any of these locations. We select service providers that maintain high standards for security and data protection and that provide appropriate safeguards for international data transfers.

6.3 Your Rights Regarding International Transfers

By using Vibetown, you acknowledge and agree to the transfer of your Personal Data to the United States and other countries as described in this section. However, your agreement to international data transfers does not waive any of your rights under applicable data protection laws. You retain all rights granted under such laws, including the right to access your data, request corrections or deletion, object to certain processing, and lodge complaints with supervisory authorities in your jurisdiction.

If you have concerns about international transfers of your Personal Data, if you reside in a jurisdiction with specific requirements regarding data transfers, or if you would like more information about the safeguards we have implemented for transfers from your jurisdiction, you may contact us at [email protected]. We will provide you with information about the transfer mechanisms we use and, where appropriate and legally permissible, provide you with copies of relevant documentation such as Standard Contractual Clauses or binding corporate rules.

For users in the EEA, UK, or Switzerland, you have the right to obtain information about the safeguards we have implemented for your data transfers and to lodge a complaint with your local supervisory authority if you believe your data has been transferred without adequate safeguards.

7. Your Rights and Choices

We respect your rights to understand and control how your Personal Data is used. Depending on your location and the applicable data protection laws that govern our relationship, you may have various rights regarding your Personal Data. These rights are designed to give you control over your information and ensure transparency in how it is processed. The following sections describe your rights in detail and explain how you can exercise them.

7.1 Right to Access

You have the right to request confirmation of whether we are processing your Personal Data and, if so, to receive access to that data along with information about how we use it. This right, sometimes called a "right to know," allows you to understand what information we hold about you, how we obtained it, for what purposes we use it, with whom we share it, and how long we will retain it. You can request a copy of your Personal Data in a structured, commonly used format that allows you to review the information and potentially transfer it to another service.

To exercise your right to access, you can review much of your account information directly through your Vibetown account settings and profile pages, where you can view your profile information, work history and education, uploaded documents and resumes, job applications and their status, saved jobs and searches, communication history with recruiters, and account settings and preferences. For a more comprehensive report of all Personal Data we hold about you, including information not directly visible in your account interface such as analytics data, system logs, or information derived through AI processing, you can submit a request to [email protected].

We will respond to verified access requests within the timeframe required by applicable law, typically within thirty (30) days of receiving a complete request. If we need additional time to compile your information due to the volume or complexity of data, we will notify you of the delay and provide an estimated response time, which will not exceed an additional thirty (30) days unless permitted by law. There is no fee for requesting access to your data for the first request in a twelve-month period, though we may charge a reasonable administrative fee for additional requests or for requests that are manifestly unfounded or excessive.

7.2 Right to Rectification and Correction

You have the right to request correction of inaccurate or incomplete Personal Data we hold about you. Maintaining accurate information is important both for your own job search success and for the integrity of the Platform, as inaccurate profile information could result in missed opportunities or inappropriate job matches. You should update your information promptly whenever it changes to ensure that recruiters see current, accurate information about your qualifications and that our matching algorithms work effectively.

You can directly update most of your account information through your Vibetown profile settings, including your name, email address, and contact information; work experience, job titles, and employment dates; education, degrees, and certifications; skills and competencies; professional summary and career objectives; location and work authorization status; and job preferences and search criteria. Changes you make through your profile settings take effect immediately and are reflected in your profile as seen by recruiters.

If you are unable to correct information through the Platform interface, if you believe we hold inaccurate information about you that you cannot directly access or modify, or if you believe AI-generated information about you is incorrect, you can contact us at [email protected] with a description of the information you believe is inaccurate and the corrections you would like us to make. We will review your request and, if we agree that the information is inaccurate, we will correct it promptly. If there is a disagreement about whether information is accurate, we will explain our position and, where appropriate, allow you to submit a statement of disagreement that will be associated with your data.

Please note that certain information cannot be changed after it has been provided, such as historical application records or communications with recruiters, as these constitute factual records of past events. However, you can add clarifying information or updated details to your current profile.

7.3 Right to Deletion and Erasure

You have the right to request deletion of your Personal Data in certain circumstances, sometimes referred to as the "right to be forgotten" or "right to erasure." You can exercise this right at any time by deleting your account through the Vibetown Platform settings or by contacting us at [email protected]. When you delete your account, we will permanently remove your account information, profile data, and associated records from our active systems as described in Section 5.2, typically within sixty (60) days.

However, we may be unable to delete all of your Personal Data if retention is necessary for us to comply with legal obligations, such as maintaining financial records for tax purposes, retaining records required under employment law or equal employment opportunity regulations, preserving evidence relevant to ongoing legal proceedings or government investigations, or maintaining records necessary to establish, exercise, or defend legal claims. In such cases, we will restrict processing of your data to only those purposes that require retention and will delete the data as soon as the retention requirement no longer applies.

Additionally, as described in Section 5.5, we cannot control deletion of information that has been shared with third parties, including recruiters who viewed your profile, employers you applied to, or AI service providers who processed your data. Once information has been shared with third parties, those parties are responsible for their own data retention and deletion practices. If you have concerns about information held by third parties, you may need to contact them directly.

To request deletion of your account and data, you can use the "Delete Account" option in your account settings, which will guide you through the deletion process and allow you to download a copy of your data before deletion, or send an email to [email protected] with your request, including your registered email address and confirmation that you wish to delete your account. We may ask you to verify your identity before processing deletion requests to prevent unauthorized deletion of accounts. After verifying your identity, we will process your deletion request and send you a confirmation when the deletion is complete.

7.4 Right to Restriction of Processing

In certain circumstances recognized by applicable law, you have the right to request that we restrict or limit how we process your Personal Data. Restriction of processing means that we can continue to store your data but cannot use it for other purposes without your consent, except for specific permitted purposes such as establishing, exercising, or defending legal claims, protecting the rights of others, or if required by law. You might request restriction of processing if you contest the accuracy of your Personal Data while we verify its accuracy, if you object to deletion of unlawfully processed data and instead request restriction, if we no longer need your data but you need it for legal claims, or if you have objected to processing based on legitimate interests while we verify whether our legitimate grounds override yours.

To request restriction of processing, contact us at [email protected] with a description of your request, the specific data you want us to restrict, the reason you believe restriction is appropriate under applicable law, and how long you anticipate the restriction should remain in place. We will respond to your request within the timeframe required by applicable law, typically within thirty (30) days, and will inform you before lifting any restriction on processing. During the restriction period, your profile may not be visible to recruiters, and certain Platform features may be unavailable.

7.5 Right to Data Portability

Where technically feasible and required by applicable law, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and to transmit that data to another service provider without hindrance from us. This right applies to Personal Data you have provided to us where the processing is based on consent or contract and is carried out by automated means. Data portability allows you to move, copy, or transfer your Personal Data easily from one service to another in a safe and secure way, facilitating your ability to switch to alternative job search platforms if you choose.

To exercise your right to data portability, you can use the "Export Data" feature in your account settings if available, which allows you to download your profile information, work history, applications, and other data in a machine-readable format such as JSON or CSV, or contact us at [email protected] to request a data export. We will provide your data in a commonly used format such as JSON, CSV, or PDF that can be easily imported into other systems or services.

The data export will include your account and profile information, work history and education details, skills and certifications, resume and document uploads (in their original formats), job application history, saved searches and preferences, and other Personal Data we hold about you that is subject to data portability rights. The export will not include information that would disclose confidential commercial information, algorithms or trade secrets, information about other users, or data that adversely affects the rights and freedoms of others. Some AI-generated insights or derived data may not be included in portable exports if they constitute our proprietary analysis rather than your Personal Data.

7.6 Right to Object

You have the right to object to our processing of your Personal Data in certain circumstances, particularly when processing is based on legitimate interests or conducted for direct marketing purposes. When you object to processing, we will stop processing your Personal Data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defense of legal claims.

For direct marketing specifically, you have an absolute right to object at any time, and we will stop processing your Personal Data for marketing purposes immediately upon receiving your objection. You can exercise this right by clicking the "unsubscribe" link in any marketing email we send, adjusting your communication preferences in your account settings to opt out of marketing communications, or contacting us at [email protected] with your objection. Once you opt out of marketing communications, we will not send you promotional content, newsletters, or marketing materials, though we will continue to send essential service-related communications necessary for account administration, security, and Platform functionality.

For processing based on legitimate interests, such as using your data for Platform improvement, analytics, or job matching optimization, you can object by contacting us at [email protected] with a description of the processing you object to and your reasons for objection based on your particular situation. We will review your objection and, if we cannot demonstrate compelling legitimate grounds that override your interests, we will stop the processing you objected to. However, please note that objecting to certain core processing activities may significantly limit Platform functionality or prevent us from providing certain services.

7.7 Right to Withdraw Consent

Where our processing of your Personal Data is based on your consent rather than other legal bases such as contractual necessity or legitimate interests, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before you withdrew consent, but it will stop future processing that requires consent. For example, if you consented to connect your LinkedIn account to import profile data, you can disconnect LinkedIn at any time; if you consented to use AI-powered profile enhancement features, you can stop using those features; if you consented to receive optional notifications or marketing communications, you can opt out; or if you consented to make your profile visible to recruiters, you can change your privacy settings to restrict visibility.

To withdraw consent, you can adjust relevant settings in your account, such as disconnecting LinkedIn, changing privacy settings, or modifying notification preferences; click the unsubscribe link in emails you no longer wish to receive; or contact us at [email protected] specifying which consent you wish to withdraw and what processing should stop. We will process your withdrawal promptly, typically within two (2) business days for simple requests like email unsubscribe, and will confirm when your withdrawal has taken effect.

Please note that withdrawing consent may limit your ability to use certain features of the Platform. For example, withdrawing consent for profile visibility to recruiters will prevent recruiters from discovering you, significantly reducing your job search effectiveness. We will inform you of any consequences before you finalize your withdrawal so you can make an informed decision.

7.8 Right to Lodge a Complaint

If you believe that we have not complied with applicable data protection laws, have not adequately addressed your concerns about how we handle your Personal Data, or have violated your privacy rights, you have the right to lodge a complaint with a supervisory authority in your jurisdiction. Supervisory authorities, also called data protection authorities or privacy commissioners, are independent public bodies that oversee compliance with data protection laws and investigate complaints from individuals.

For users in the European Economic Area, you can find your local data protection authority through the European Data Protection Board's website at https://edpb.europa.eu/about-edpb/board/members_en. Each EU member state has its own supervisory authority, and you generally have the right to lodge a complaint with the authority in the country where you reside, where you work, or where the alleged violation occurred. Users in the United Kingdom can lodge complaints with the Information Commissioner's Office (ICO) at https://ico.org.uk, which is the UK's independent regulatory authority for data protection. Users in other jurisdictions should consult their local data protection authority, privacy commissioner, or consumer protection agency for information on how to file complaints.

While you have the right to lodge a complaint with a supervisory authority at any time without restriction, we encourage you to contact us first at [email protected] so that we have an opportunity to address your concerns directly. Many concerns can be resolved more quickly and satisfactorily through direct communication with us rather than through a formal complaint process. However, contacting us first is not a prerequisite to filing a complaint, and you may proceed directly to your supervisory authority if you prefer.

7.9 How to Exercise Your Rights

To exercise any of the rights described in this section, you can use the following methods. For most requests, you should email us at [email protected] with a clear description of your request, the specific right you wish to exercise, your registered email address or account information, and any additional details that will help us process your request. For certain actions like updating profile information, changing privacy settings, or exporting data, you can use the account settings and privacy controls within the Vibetown Platform, which provide immediate self-service options for common requests. For written correspondence, you can send mail to the address listed in Section 13 of this Privacy Policy, though email requests typically receive faster responses.

When you submit a request to exercise your rights, we will need to verify your identity to protect your Personal Data from unauthorized access or disclosure. We may ask you to confirm your email address by responding to a verification email sent to your registered address, answer security questions about your account, provide government-issued identification in cases of particularly sensitive requests, or confirm specific information about your account activity or profile that only you would know. This verification process is necessary to ensure that we only provide Personal Data to the individual it belongs to and do not inadvertently disclose your information to someone impersonating you.

We will respond to your request within the timeframe required by applicable law, which is typically thirty (30) days from receipt of a verified request. If we need additional time to process your request due to its complexity, the volume of your data, or the number of requests we are handling, we will notify you of the delay and provide an expected response time, which will not exceed an additional thirty (30) to sixty (60) days depending on jurisdiction. There is generally no fee for exercising your rights for the first request in a twelve-month period, though we may charge a reasonable administrative fee or refuse to act on a request if it is clearly unfounded, repetitive, or excessive.

If we decline your request in whole or in part, we will explain the reasons for our decision and inform you of your right to lodge a complaint with a supervisory authority and, where applicable, your right to seek judicial remedy.

8. State-Specific Privacy Rights (United States)

In addition to the rights described in Section 7, residents of certain U.S. states have specific additional privacy rights under state laws. These state-specific rights are described in the following sections. If you are a resident of one of these states and wish to exercise your rights, please contact us at [email protected] or use the contact methods described in Section 13.

8.1 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These rights include the right to know what Personal Data we have collected, used, disclosed, or sold about you in the preceding twelve (12) months, including the categories of Personal Data, the sources from which it was collected, the business or commercial purposes for collection, and the categories of third parties with whom we have shared it. You have the right to request deletion of Personal Data we have collected from you, subject to certain exceptions such as when retention is necessary to complete a transaction, detect security incidents, comply with legal obligations, or exercise free speech rights.

You have the right to correct inaccurate Personal Data that we maintain about you, which you can exercise as described in Section 7.2. You have the right to opt out of the sale or sharing of your Personal Data. We want to be clear that we do not sell your Personal Data to third parties for monetary consideration in the traditional sense. However, under the broad CCPA definition of "sale" and "sharing," our disclosure of your profile information to recruiters and employers searching for candidates, and our use of certain analytics and advertising cookies, could potentially be considered a "sale" or "sharing" under California law. If you wish to opt out, you can adjust your privacy settings to restrict profile visibility or request opt-out by contacting us.

California residents also have the right to limit the use and disclosure of sensitive personal information. Under the CPRA, sensitive personal information includes Social Security numbers, driver's license numbers, financial account information, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, biometric data, health information, and information about sex life or sexual orientation. We do not intentionally collect most categories of sensitive personal information. To the extent we collect any data that may be considered sensitive (such as precise geolocation if you enable location services, or information you voluntarily include in your profile), we use it only for purposes permitted under the CPRA that do not require providing a limit right, such as providing the services you requested or ensuring security. If you have concerns about sensitive data, you may contact us.

You have the right to non-discrimination for exercising your CCPA rights. We will not discriminate against you for exercising any of your CCPA rights, including by denying the Platform services, charging different prices or rates, providing a different level or quality of services, or suggesting that you will receive a different price or level of quality. However, we may offer financial incentives permitted by law, and certain features may be unavailable if you opt out of processing necessary for those features.

8.2 Categories of Personal Data Collected (California)

In the preceding twelve (12) months, we have collected the following categories of Personal Data from California residents, as defined by the CCPA: identifiers such as name, email address, phone number, IP address, and account credentials; professional and employment information such as work history, job titles, employers, education, skills, certifications, resume content, and career objectives; commercial information such as records of Platform subscriptions or premium features purchased (if applicable); internet or other electronic network activity information such as Platform usage patterns, search queries, pages viewed, jobs applied to, and analytics data collected through cookies; geolocation data including general location based on IP address and precise location if you enable location services; and inferences drawn from this information to create profiles reflecting preferences, characteristics, behavior, and predicted career interests.

We collect this information directly from you when you provide it during registration or profile creation, automatically through cookies and analytics as you interact with the Platform, from LinkedIn when you authorize us to import your profile data, from AI providers when they generate enhanced profile content or recommendations, from publicly available sources such as professional directories or company websites, and from other users who refer you or provide recommendations.

We use this information for the purposes described in Section 3 of this Privacy Policy, including providing the Platform services, job matching and recommendations, AI-powered profile enhancement, communications, Platform improvement, security and fraud prevention, and legal compliance. We disclose this information to the categories of third parties described in Section 4, including recruiters and employers, AI service providers (OpenAI, Anthropic, Google), other service providers and vendors, and third-party integrations you choose to connect.

Sale and Sharing: Under the CCPA's broad definitions, making candidate profiles visible to recruiters who search for candidates could be considered "sharing" Personal Data for cross-context behavioral advertising or targeted advertising purposes, even though no money is exchanged. If you wish to opt out of this sharing, you can adjust your privacy settings to make your profile private or contact us at [email protected]. We do not sell Personal Data to data brokers or for monetary consideration.

8.3 Exercising California Privacy Rights

To exercise your California privacy rights, you may submit a request by emailing [email protected] with a clear description of your request and the specific right you wish to exercise, calling us at the phone number listed in Section 13 if provided, or using any designated web form we make available for privacy requests. We will need to verify your identity before processing your request to protect your Personal Data from unauthorized disclosure. We may ask you to provide your email address and confirm your identity through your registered email account, confirm specific information about your account or profile that only you would know, or provide additional verification in cases of particularly sensitive requests.

We will respond to verified requests within forty-five (45) days of receipt. If we need additional time to respond, we will notify you of the reason for the delay and the expected response date, which will not exceed an additional forty-five (45) days. There is no fee for submitting up to two requests per year. If you submit excessive, repetitive, or manifestly unfounded requests, we may charge a reasonable administrative fee or decline to respond.

You may designate an authorized agent to make requests on your behalf. If you use an authorized agent, we will require written proof that the agent is authorized to act on your behalf, such as a power of attorney or signed authorization letter, and we may require you to verify your identity directly with us even when using an authorized agent. We may deny requests from agents who cannot provide proof of authorization.

8.4 Virginia, Colorado, Connecticut, Utah, and Other State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have rights similar to those described for California residents, including the right to confirm whether we process your Personal Data and access that data; the right to correct inaccuracies in your Personal Data; the right to delete your Personal Data; the right to obtain a copy of your Personal Data in a portable format; and the right to opt out of processing for purposes of targeted advertising, the sale of Personal Data, or profiling in furtherance of decisions that produce legal or similarly significant effects.

As stated in Section 8.1, we do not engage in traditional "sale" of Personal Data for monetary consideration. Our practice of making candidate profiles visible to recruiters could potentially be considered targeted advertising or sale under some state law definitions. We do not engage in profiling that produces legal or similarly significant effects. If you wish to opt out of any practices that might constitute sale or targeted advertising under your state's law, you can adjust your privacy settings to restrict profile visibility or contact us at [email protected].

To exercise your rights under these state laws, please contact us at [email protected] with your request. We will respond to verified requests within the timeframes required by applicable state law, typically forty-five (45) days. You may appeal our decision regarding your request by contacting us at [email protected] and including "Appeal" in the subject line along with a description of why you are appealing. We will respond to appeals within the timeframe required by applicable law, typically sixty (60) days, and will provide you with information about how to contact your state's Attorney General office to submit a complaint if you are not satisfied with the outcome of the appeal.

9. Data Security

Protecting your Personal Data is a critical priority for us, particularly given the sensitive and professional nature of the information we process. We implement comprehensive technical, physical, and organizational security measures designed to safeguard your information from unauthorized access, accidental loss, destruction, alteration, or disclosure. While no system can guarantee absolute security, we employ industry-standard practices and continuously update our security measures to address evolving threats and vulnerabilities.

9.1 Technical Security Measures

We employ multiple layers of technical security controls to protect your data throughout its lifecycle. All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) protocol version 1.2 or higher with strong cipher suites. This creates a secure, encrypted channel that prevents eavesdropping, man-in-the-middle attacks, or tampering during transmission. This encryption applies to all communications, including when you log in, upload documents, search for jobs, communicate with recruiters, or interact with any features of the Platform.

Your Personal Data stored on our servers is encrypted at rest using industry-standard encryption algorithms such as AES-256, which provides strong protection even if storage media were to be physically compromised. Encryption is implemented at multiple levels, including full-disk encryption for server storage, database-level encryption for structured data, field-level encryption for particularly sensitive data such as authentication credentials, and encryption of backup storage and archives.

We implement strict access controls using role-based access control (RBAC) principles, which means that access to Personal Data is granted only to employees and systems that require it to perform specific job functions. Each employee is assigned the minimum level of access necessary for their role, access rights are reviewed regularly and adjusted when roles change, and access is revoked immediately when an employee leaves the company or changes roles. Administrative access to production systems requires multi-factor authentication using hardware security keys, time-based one-time passwords, or biometric authentication, adding an additional layer of security beyond traditional passwords.

Our network infrastructure is protected by enterprise-grade firewalls that filter incoming and outgoing traffic according to strict security rules, allowing only legitimate traffic while blocking potentially malicious connections. We employ intrusion detection and prevention systems (IDS/IPS) that monitor network traffic for suspicious patterns, known attack signatures, unusual access attempts, and anomalous behavior, and can automatically block or alert on potential security threats. Network segmentation isolates different components of our infrastructure, creating security boundaries between production systems, development environments, and administrative networks, limiting the potential impact of a security breach by preventing lateral movement between systems.

We conduct regular vulnerability scans and penetration testing to identify potential security weaknesses before they can be exploited by malicious actors. Automated security scanning tools run continuously to detect vulnerabilities in our code, third-party dependencies, infrastructure configurations, and network services. We engage independent security researchers and firms to perform periodic penetration testing, which simulates real-world attacks to identify weaknesses that automated tools might miss. When vulnerabilities are identified, we prioritize remediation based on severity using industry-standard frameworks like CVSS (Common Vulnerability Scoring System) and implement fixes promptly, typically within days for critical vulnerabilities and weeks for less severe issues.

9.2 Application Security

The Vibetown application itself is designed with security in mind from the ground up. Your password is never stored in plain text; instead, it is processed through a cryptographic hash function using algorithms such as bcrypt or Argon2, which are specifically designed for password hashing and resistant to brute-force attacks, rainbow table attacks, and other password cracking techniques. These algorithms incorporate salting (adding random data to each password) and key stretching (multiple rounds of hashing) techniques that make it computationally infeasible to reverse the hash and recover the original password, even if an attacker were to gain access to the hashed values.

We implement comprehensive security features for account protection, including password strength requirements that encourage you to create strong, complex passwords with minimum length, character variety, and complexity standards; automatic session timeout after periods of inactivity to prevent unauthorized access from unattended devices; suspicious activity monitoring that can detect and alert on unusual login patterns such as logins from new locations, devices, or IP addresses, multiple failed login attempts, or simultaneous logins from geographically distant locations; account lockout mechanisms that temporarily disable accounts after repeated failed login attempts to prevent brute-force attacks; and security notifications that alert you to important account events such as password changes, email address updates, or logins from new devices.

The application code undergoes security code review as part of our development process, where experienced developers and security specialists examine code for potential security vulnerabilities such as SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), insecure deserialization, XML external entity (XXE) attacks, and other common attack vectors identified in frameworks like the OWASP Top 10. We follow secure coding guidelines and best practices throughout the development lifecycle, use automated static analysis tools (SAST) to identify potential security issues during development before code is deployed to production, conduct dynamic application security testing (DAST) on running applications to identify runtime vulnerabilities, and maintain regular dependency updates to ensure that third-party libraries and frameworks used in the application are kept current with security patches.

9.3 Document and Upload Security

Given that users upload sensitive professional documents such as resumes, cover letters, and portfolios, we implement specific security measures for file uploads. We scan all uploaded files for malware, viruses, and malicious code using multiple anti-malware engines before storing them on our systems. We validate file types and sizes to prevent upload of executable files or excessively large files that could be used in denial-of-service attacks. We store uploaded documents in isolated storage systems with restricted access, separate from application code and databases to prevent direct execution of uploaded content. We implement content security policies that prevent uploaded documents from executing scripts or accessing sensitive system resources.

All uploaded documents are encrypted at rest and associated with your account using secure identifiers that prevent unauthorized access. Access to your documents requires authentication and is logged for security auditing purposes. When documents are shared with recruiters or employers, we use secure, time-limited access tokens rather than exposing permanent download links.

9.4 AI Service Provider Security

When we share your data with AI service providers like OpenAI, Anthropic, and Google, we rely on those providers' security measures to protect your information during processing. We carefully vet AI providers before integration, reviewing their security certifications, compliance with industry standards such as SOC 2 Type II and ISO 27001, data handling and privacy policies, encryption and access control practices, and incident response capabilities.

We enter into data processing agreements with AI providers that specify their security obligations, including requirements for encryption in transit and at rest, access controls and authentication, security monitoring and incident response, data retention and deletion procedures, and compliance with applicable data protection laws. We configure AI services to use the most privacy-protective settings available, such as opting out of data retention for model training where possible, using dedicated instances or private deployments when available, and minimizing the data shared to only what is necessary for the requested processing.

However, you should be aware that once we share your information with third-party AI providers, those providers process your data according to their own security practices and privacy policies. We encourage you to review the security and privacy documentation of OpenAI (https://openai.com/security), Anthropic (https://www.anthropic.com/security), and Google (https://cloud.google.com/security) to understand how they protect your data.

9.5 Organizational Security Measures

Beyond technical controls, we implement organizational measures to ensure that security is embedded in our culture and processes. All employees and contractors who have access to Personal Data receive comprehensive security awareness training covering topics such as password security and credential management, phishing and social engineering recognition, data handling and classification procedures, incident response and reporting, privacy principles and compliance requirements, and secure development practices for technical staff. This training is mandatory for new hires before they receive access to production systems and is repeated annually with updates reflecting current threats, new attack techniques, regulatory changes, and lessons learned from security incidents.

We maintain documented information security policies and procedures that govern how Personal Data must be handled, stored, transmitted, and disposed of throughout its lifecycle. These policies cover access control and authentication requirements, data classification and handling standards, encryption and cryptographic standards, incident response and business continuity, vendor management and third-party security, physical security requirements, and acceptable use of company systems and resources. Employees are required to acknowledge and comply with these policies, and violations can result in disciplinary action including termination of employment.

Access to Personal Data is granted only after employees have undergone background checks appropriate to their level of access and job responsibilities, signed confidentiality and non-disclosure agreements that survive the termination of their employment, and completed security training and demonstrated understanding of security policies. We implement the principle of least privilege, granting employees only the minimum access necessary to perform their job functions, and we regularly review access rights to ensure they remain appropriate.

We maintain a formal incident response plan that defines roles, responsibilities, and procedures for responding to security breaches, data protection incidents, and other security events. This plan includes procedures for detecting and assessing incidents, containing threats to prevent further damage, eradicating the root cause of incidents, recovering affected systems and data, and conducting post-incident analysis to identify lessons learned and improve our security posture. We conduct regular tabletop exercises and simulations to test our incident response capabilities and ensure team readiness.

9.6 Vendor and Third-Party Security

We carefully vet all third-party service providers, including AI providers, hosting providers, and other vendors, who process Personal Data on our behalf. Our vendor management process includes conducting due diligence reviews of security practices, certifications, and track record before engagement; requiring vendors to sign data processing agreements that specify their security obligations; reviewing vendors' security policies, procedures, and controls; assessing vendors' compliance with relevant security frameworks and certifications; and periodically reviewing vendors' ongoing compliance with security requirements and contractual obligations.

We limit the data we share with service providers to only what is necessary for them to perform their specific functions, and we require that vendors implement appropriate technical and organizational measures to protect Personal Data. We maintain an inventory of all vendors who process Personal Data and regularly assess their security posture.

9.7 Physical Security

Our servers and data centers are housed in facilities operated by leading cloud infrastructure providers such as Amazon Web Services, Google Cloud Platform, or Microsoft Azure. These facilities implement stringent physical security controls, including 24/7 security personnel and video surveillance monitoring, biometric access controls and multi-factor authentication for entry to data center facilities, secure cages or locked cabinets for server equipment, environmental monitoring and controls for temperature, humidity, and fire detection, fire detection and suppression systems with redundant protection, redundant power supplies, backup generators, and uninterruptible power systems (UPS), and comprehensive disaster recovery capabilities including geographic redundancy. These facilities are certified under security standards such as ISO 27001, SOC 2 Type II, and others, demonstrating their commitment to maintaining a secure environment for hosting sensitive data.

9.8 Monitoring, Logging, and Incident Detection

We maintain comprehensive logging of system activity to support security monitoring, incident detection, and forensic analysis. Logs include authentication attempts (successful and failed), data access and modifications, configuration changes to systems or security settings, administrative actions, API requests and responses, network connections and traffic patterns, and security events and alerts. These logs are centralized in a security information and event management (SIEM) system that correlates events across multiple systems, applies machine learning to detect anomalous patterns, generates alerts for suspicious activities, and supports investigation of security incidents.

Automated alerting notifies our security team of suspicious activities in real-time, including repeated failed login attempts indicating brute-force attacks, unusual data access patterns or bulk downloads, access from unexpected geographic locations or known malicious IP addresses, system configuration changes outside of approved change windows, network anomalies or traffic spikes, and indicators of compromise from threat intelligence feeds. When alerts are triggered, security personnel investigate according to defined procedures and take appropriate action, which may include blocking suspicious IP addresses or user agents, forcing password resets for potentially compromised accounts, isolating affected systems to contain potential breaches, or escalating to full incident response procedures.

9.9 Data Breach Notification

Despite our comprehensive security measures, no system is completely immune to security incidents. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and any applicable supervisory authorities as required by law. Notification will typically occur within seventy-two (72) hours of our becoming aware of the breach, unless a delay is necessary for law enforcement purposes, to allow us to assess the full scope of the incident and determine which individuals are affected, or to implement measures to secure systems and prevent further unauthorized access.

Our breach notification will describe the nature of the breach, including what types of data were involved; the categories and approximate number of affected individuals; the likely consequences of the breach and potential impact on affected individuals; the measures we have taken or propose to take to address the breach, contain its effects, and mitigate potential harm; contact information for obtaining more information, asking questions, or reporting concerns; and resources available to affected individuals, such as credit monitoring services if financial information was involved. We will provide this notification through the most appropriate means available, which may include email to your registered address, prominent notice on the Platform, postal mail for significant breaches, or direct phone contact for particularly sensitive breaches.

9.10 Your Security Responsibilities

While we implement extensive security measures to protect your Personal Data, security is a shared responsibility, and there are important steps you must take to protect your account and information. You are responsible for maintaining the confidentiality of your login credentials, including your password and any recovery codes or authentication factors, and never sharing your password with anyone, including people claiming to be from Vibetown support staff (we will never ask you for your password). Use a strong, unique password for your Vibetown account that you do not use for any other service or website, and consider using a password manager to generate and store complex passwords securely.

Enable multi-factor authentication if available for your account, as this significantly increases account security by requiring a second form of verification beyond your password. Keep the software on your devices updated with the latest security patches, as outdated software may contain vulnerabilities that could be exploited to compromise your device or steal your credentials. Be cautious of phishing attempts, which are fraudulent communications designed to trick you into revealing your password, clicking on malicious links, or downloading harmful attachments. Vibetown will never send you unsolicited emails asking you to verify your account by clicking on links, provide your password or other sensitive information, or download attachments from unknown sources.

Review your account activity regularly for any suspicious behavior, such as unrecognized logins, changes you didn't make, or applications you didn't submit. Use secure networks when accessing Vibetown, and avoid using public Wi-Fi without a VPN for sensitive activities. Log out of your account when finished using the Platform on shared or public computers to prevent unauthorized access. Be thoughtful about what information you include in your public profile, as more visible information may increase your exposure if a security incident occurs.

If you become aware of any unauthorized access to your account, any loss or theft of your device containing the Vibetown app, any suspicious emails or communications claiming to be from Vibetown, or any other security concern, notify us immediately at [email protected] or [email protected] so that we can take appropriate action to protect your account and investigate the incident.

10. Children's Privacy

Vibetown is a professional networking and job search platform designed for adults seeking employment opportunities. The Platform is not intended for, and we do not knowingly collect Personal Data from, individuals under the age of sixteen (16) without appropriate parental consent as required by applicable law, including the Children's Online Privacy Protection Act (COPPA) in the United States and Article 8 of the General Data Protection Regulation (GDPR) in the European Union.

Our Terms of Service specify that users must be at least sixteen (16) years old to create an account, or at least thirteen (13) years old with parental consent. We rely on users to provide truthful information about their age during registration. If you are a parent or legal guardian and believe that your child under the age of sixteen has provided us with Personal Data without your consent, please contact us immediately at [email protected]. Please include in your message your child's name, email address if you know it, any other information that will help us locate the account, and documentation verifying your parental relationship.

Upon receiving credible notice that we have collected Personal Data from a child without appropriate parental consent, we will take prompt steps to verify the claim, delete that information from our systems as quickly as reasonably possible (typically within thirty days of verification), terminate the account, and implement additional safeguards to prevent similar occurrences. If we become aware through our own detection methods that we have inadvertently collected Personal Data from a child without proper parental consent, we will delete the information promptly without requiring a request from a parent.

Parents who wish to review, modify, or delete Personal Data that we have collected from their child should contact us at [email protected] with appropriate verification of their parental status. We may require documentation proving the relationship between the parent and child before granting access to or deleting a child's Personal Data to prevent unauthorized disclosure to individuals who are not the child's legal guardians.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform features, legal requirements, or for other operational, legal, or regulatory reasons. When we make changes to this Privacy Policy, we will revise the "Last Updated" date at the top of this document and, for material changes, we will take additional steps to notify you as described below.

11.1 Notice of Material Changes

For changes that materially affect your rights or how we process your Personal Data, we will provide prominent notice through one or more of the following methods: displaying a prominent notification within the Platform when you next access it after the changes take effect; sending an email notification to the email address associated with your account at least thirty (30) days before the changes take effect (where practicable); posting a notice on our website homepage; or using other reasonable means of communication as appropriate to the significance of the changes.

Material changes might include significant changes to the types of Personal Data we collect, new purposes for which we use Personal Data, new categories of third parties with whom we share data (particularly new AI providers or data recipients), significant changes to data retention practices or international data transfers, changes to your rights or how you can exercise them, or changes to our legal bases for processing. For particularly significant changes, such as introducing new AI providers or materially expanding data sharing practices, we may require you to affirmatively accept the new Privacy Policy before you can continue using the Platform.

11.2 Your Acceptance of Changes

Your continued access to or use of the Platform after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated Privacy Policy, you must stop using the Platform and may delete your account as described in Section 5.2. We will generally provide a reasonable transition period for material changes, during which you can review the new policy, export your data, and delete your account if you choose not to accept the changes.

We encourage you to review this Privacy Policy periodically, especially before providing new information to the Platform or using new features, to ensure you understand the current terms that apply to your use. It is your responsibility to check this Privacy Policy for changes, as we cannot guarantee that you will receive direct notice of all changes, particularly non-material updates.

11.3 Prior Versions

We may make prior versions of this Privacy Policy available upon request for your reference. If you would like to review a previous version of the Privacy Policy or understand what changes were made in a particular update, please contact us at [email protected].

12. Third-Party Services and Links

The Platform may contain links to third-party websites, services, or resources that are not owned, controlled, or operated by Innolope, including links to employer career sites, LinkedIn profiles, professional development resources, or partner services. This Privacy Policy applies only to information collected by Vibetown and does not apply to any third-party websites, services, or resources. When you click on links to third-party sites or use third-party services, you leave the Vibetown environment and become subject to the privacy policies and terms of service of those third parties.

We are not responsible for the privacy practices, content, security, or data handling of any third-party websites or services. Third-party sites may collect information from you, use cookies or other tracking technologies, have different data retention practices, or share data in ways that differ from our practices. We encourage you to read the privacy policies and terms of service of any third-party websites or services before providing them with any Personal Data or other information.

The inclusion of links to third-party sites does not imply our endorsement of those sites, their practices, or their content. We do not review, monitor, or verify the accuracy, appropriateness, security, or completeness of content on third-party websites, and we are not responsible for any content, advertising, products, services, or other materials on or available from such websites. Your interactions with third-party websites and services, including any applications, purchases, communications, or other dealings, are solely between you and the third party. We will not be a party to or in any way responsible for monitoring any transaction between you and third parties.

13. Contact Us

If you have any questions, concerns, comments, or requests regarding this Privacy Policy or our data practices, or if you need to contact us to exercise your privacy rights, please reach out to us using the contact information below. We are committed to addressing your privacy concerns promptly and transparently, and we welcome your feedback on how we can improve our privacy practices.

For Privacy Inquiries and Rights Requests:
Email: [email protected]

This is our primary contact method for privacy-related inquiries, including questions about this Privacy Policy, requests to exercise your privacy rights (access, correction, deletion, etc.), questions about how we use or share your data, concerns about data security or potential privacy violations, and requests to opt out of certain data processing activities. We typically respond to privacy inquiries within three (3) to five (5) business days, and we process rights requests within the timeframes required by applicable law (typically thirty days).

When contacting us about privacy matters, please include "Privacy Request" or "Privacy Inquiry" in the subject line to help us route your message to the appropriate team. Please provide as much detail as possible about your inquiry or request, including your registered email address or account information, the specific nature of your request or concern, and any additional details that will help us respond effectively.

For Security Concerns:
Email: [email protected]

If you discover a security vulnerability in the Platform, experience a security incident involving your account, receive suspicious communications claiming to be from Vibetown, or have urgent security concerns, please contact our security team at this address. We take security reports seriously and will respond to verified security concerns promptly.

General Inquiries and Support:
Email: [email protected]

For general questions about using the Platform, technical support issues, account problems not related to privacy, or other non-privacy inquiries, please contact our general support team at this address.

Postal Address:
Innolope LLC
8 The Green, Suite A
Dover, DE 19901
United States