Privacy policy.

1. Who we are

Vibe Shift Studio Ltd ("we", "us", "the studio") is a social-first creative studio based in London, United Kingdom. For the purposes of the UK GDPR and the EU GDPR, we are the data controller for personal data we collect through this site.

Contact for data requests: hello@vibeshiftstudio.com

2. What personal data we collect

We collect only what we need to reply to enquiries, deliver work and run the business:

• Contact form data: name, email address, brand/company name, role, the message you send, and the budget/services chips you select.
• Email correspondence: anything you choose to share when you email us directly.
• Client account data: for active engagements, the brief, deliverables, approvals and any account history stored in the client dashboard.
• Technical data: IP address, browser type, device, pages visited and approximate location, collected through standard server logs and Vercel Web Analytics (aggregated, cookieless).
• Advertising and attribution data (only if you accept cookies): the Meta Pixel and Beehiiv attribution script collect page URL, referrer, user agent, timestamps, a hashed version of any email you submit through our forms, and Facebook browser/click identifiers (_fbp, _fbc). See section 6 for the full detail.

We do not knowingly collect sensitive personal data (health, religion, political views, etc.) and we do not collect data from children under 16.

3. Why we collect it (legal basis)

Under GDPR, every use of personal data must have a legal basis. Ours are:

• Contract (Art. 6(1)(b)): processing data so we can respond to your enquiry, propose a scope of work and deliver an engagement.
• Legitimate interest (Art. 6(1)(f)): keeping basic records of who has contacted the studio, replying to email correspondence, and protecting the site against abuse.
• Consent (Art. 6(1)(a)): for any optional cookies or for marketing emails you opt into.
• Soft opt-in (PECR Regulation 22(3)): if you submit the trial-week application form we may add your email to our Vibe Check newsletter list unless you tick the opt-out box on the form. This is a narrow exception to the consent rule for people who have entered negotiations for a similar service. Every newsletter includes a one-click unsubscribe.
• Legal obligation (Art. 6(1)(c)): keeping invoicing/accounting records for the period required by UK law.

4. How long we keep it

• Contact form submissions: kept for up to 24 months from your last contact, then deleted unless you become a client.
• Client account data: kept for the duration of the engagement plus 7 years for accounting and contractual records.
• Newsletter list (if opted in): until you unsubscribe.
• Server logs: 30 days.
• Cookie consent choice: stored in your browser for 12 months, then we ask again.
• Meta Pixel data: retained by Meta according to their own schedule (typically up to 2 years for measurement, 90 days for the _fbp/_fbc cookies in your browser).
• Beehiiv attribution data: retained by Beehiiv according to their own schedule. The attribution cookie in your browser expires after 90 days.

5. Who we share it with

We don't sell your data. We share it only with carefully chosen processors that help us run the studio:

• Vercel (website hosting and cookieless page-view analytics, US/EU regions)
• Supabase (database for the trial-week application form and client dashboard, EU region)
• Resend (transactional email for the contact form)
• Google Workspace (email, scheduling)
• Meta Platforms Ireland Ltd (Meta Pixel, only if you accept advertising cookies, see section 6). Meta is a joint controller with us for pixel data.
• Beehiiv (newsletter platform and attribution tracking). Beehiiv receives your email address in two situations: (i) if you submit our trial-week form and don't tick the newsletter opt-out box we may add you to the Vibe Check subscriber list manually; (ii) if you accept newsletter attribution cookies (see section 6) Beehiiv tracks which page a signup came from. Beehiiv is a data processor acting on our instructions.
• Payment processors (Stripe or bank, for invoiced work only)
• Our accountant, under standard professional confidentiality

Where data leaves the UK/EEA, we rely on Standard Contractual Clauses or equivalent transfer mechanisms approved under GDPR.

6. Cookies, tracking and analytics

Nothing non-essential loads on this site until you explicitly accept it. The first time you visit, a cookie banner asks what you're happy with. You can change your mind at any time from the Manage cookies link in the footer.

Essential (always on, no consent needed)

• vss-consent: stores your cookie preferences so we don't nag you every page. Expires after 12 months.
• In-page session state: e.g. whether the mobile menu is open. Not shared with anyone.

Analytics and advertising (opt-in)

If you accept, we load the Meta Pixel from connect.facebook.net. It sets two cookies in your browser:

• _fbp: Meta's browser identifier. Expires after 90 days.
• _fbc: the click identifier from a Meta ad. Only set if you arrived via a Facebook or Instagram ad. Expires after 90 days.

The pixel sends event data (page URL, referrer, timestamps, user agent, and a hashed version of your email if you submit our trial-week form) to Meta. We use this to measure whether our ads bring the right people and to build lookalike audiences of similar visitors.

Meta is a joint controller for this data under Meta's Controller Addendum and their own privacy policy. You can opt out at Meta directly via your Meta ad preferences.

Newsletter attribution (opt-in)

If you accept, we load Beehiiv's attribution.js script. It sets a first-party cookie so that if you subscribe to our newsletter later, Beehiiv can tell us which page you were reading when you signed up. Helps us learn which content converts.

• Beehiiv is a data processor acting on our instructions. Their privacy policy: beehiiv.com/privacy.

Vercel Web Analytics (always on, no cookies)

Vercel provides aggregated, anonymous page-view analytics that don't use cookies and can't identify individual visitors. GDPR doesn't require consent for genuinely anonymous analytics, so this runs by default.

Changing or withdrawing consent

Click Manage cookies in the footer of any page to reopen the preferences banner. You can accept some categories and reject others. If you reject a category we previously loaded, that script stops firing on future visits, though data already sent may be retained by the third party according to their own retention schedule (contact them directly to have it erased).

7. Your rights

Under UK and EU GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten") where there's no legal reason to keep it
• Restrict processing in specific circumstances
• Object to processing based on legitimate interest
• Portability: receive your data in a structured, machine-readable format
• Withdraw consent at any time, where consent is the legal basis
• Lodge a complaint with the UK Information Commissioner's Office or your local EU supervisory authority

To exercise any of these rights, email hello@vibeshiftstudio.com. We respond within 30 days as required by GDPR.

8. How we protect your data

The site runs over HTTPS. Form submissions are sent over TLS. Access to the client dashboard is gated by individual logins. We use strong passwords, two-factor authentication and reputable processors. No system is perfect: in the unlikely event of a personal data breach affecting your rights, we will notify the ICO within 72 hours and contact affected individuals where required.

9. Changes to this policy

We may update this policy as the studio grows or as the law changes. The "last updated" date at the top reflects the current version. Substantive changes will be flagged on the homepage for at least 14 days.

10. Contact

Questions, complaints or data requests:

Vibe Shift Studio Ltd
London, United Kingdom
hello@vibeshiftstudio.com