Introducing Vaybel MCP — connect your clothing brand to Claude, ChatGPT & any AI agent

Privacy Policy

Last Updated: July 21, 2026

Welcome to Vaybel (the "Platform"), owned and operated by Algorithmic Labs, LLC ("we," "us," "our," or the "Company"). This Privacy Policy explains in detail how we collect, use, disclose, and safeguard your information when you use our website, applications, and services (collectively, the "Services").

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by all the terms outlined in this Privacy Policy and our Terms of Service. If you do not agree with our policies and practices, please do not use our Services.

1. Information We Collect

We collect several types of information from and about users of our Platform. As a platform serving businesses, we process data from our direct users (Merchants) and, in some cases, data from their end consumers (Customers) on the Merchant's behalf.

1.1 Information from Merchants

This is personal information you provide to us as a user of Vaybel:

  • Contact Information: Name, email address, mailing address, phone number.
  • Billing Information: Tokenized credit card details, billing address, and payment history for your subscription.
  • Account Credentials: Username and password.
  • AI Tool Inputs & Content: Text prompts, images, or other content you upload or provide to our AI Tools to generate Merchant Content.
  • Communications Data: Your messages, emails, and chat logs with our customer support.

1.2 Information Processed on Behalf of Merchants (Customer Information)

Where we handle information about your Customers on your behalf — for example, order data synchronized from a Marketplace and transmitted to a Production Partner for fulfillment — we act as a Data Processor. You, the Merchant, are the Data Controller for this information. This may include:

  • Order Information: Customer name, email address, shipping address.
  • Transaction Details: Products purchased, order value, and payment confirmation details (we do not store full credit card numbers).

1.3 Automatically Collected Information

This includes non-personal and technical information collected as you use the Platform:

  • Usage Data: Pages visited, features used, time spent on the Platform, interaction with our tools, user flows, and session behavior. We use analytics tools (Google Analytics, PostHog) that may capture session recordings and interaction heatmaps to improve user experience. Where you are signed in, these recordings are linked to your account and are personal data — see Section 3.4.
  • Device Information: IP address, browser type, operating system, and device type.
  • AI-Generated Content: We collect and store all content generated using our AI Tools, including the final output and associated metadata, to provide the service and improve our AI models.

2. How We Collect Information

  • Directly from You (the Merchant): When you create an account, subscribe to a plan, contact customer support, or use our AI Tools.
  • Automatically: Through cookies, log files, and analytics tools as you navigate and use the Platform.
  • From Third Parties: We may receive information from payment processors (like Polar and Stripe) to manage your subscription and from Marketplaces or Production Partners you choose to integrate with your Vaybel account.
  • Through You (the Merchant): We collect Customer Information only when you submit it to us for processing, or when it reaches us through a Marketplace or integration you have connected.

3. How We Use Your Information

We use the information we collect for various purposes:

3.1 To Provide and Improve Our Services

  • To operate the Platform, process your Subscription, and deliver the Services you request.
  • To process Customer orders on your behalf and facilitate order fulfillment with integrated Production Partners.
  • To enhance and personalize your user experience.
  • To conduct research and analysis to improve our AI Tools and develop new features. We may use your inputs — including uploaded images, logos, and other assets — and AI-Generated Content to train and improve our models. Where this processing is subject to the GDPR or UK GDPR, we rely on our legitimate interests (Article 6 §1(f)) in developing and improving our AI Tools, and we have carried out a balancing assessment. You may object to this use at any time under Article 21 by emailing legal@vaybel.com, and we will exclude your content from future model training. Models already trained cannot practically be un-trained. We do not train our models on Customer Information that we process on behalf of a Merchant.

3.2 To Communicate with You

  • To send you transactional notifications, security alerts, and support messages related to your account.
  • To respond to your questions and provide customer support.
  • To send you marketing communications about our products and offers, which you can opt out of at any time.

3.3 For Security and Legal Compliance

  • To protect against fraudulent, unauthorized, or illegal activity.
  • To enforce our Terms of Service.
  • To comply with applicable laws, regulations, and legal requests.

3.4 For Advertising and Retargeting

We use your identity and business information to create targeted advertising campaigns:

Custom Audiences and Hashed Matching:

  • We upload hashed (cryptographically scrambled) email addresses to advertising platforms like Meta (Facebook/Instagram), TikTok, Google, and Pinterest
  • These platforms match hashed data to their users to show you relevant ads or create "Lookalike Audiences" of similar potential customers
  • Hashing is one-way and prevents platforms from accessing your plain-text email unless they already have it

Data Shared with Advertising Platforms:

  • Hashed email addresses and account identifiers
  • Device identifiers (advertising IDs, IP addresses)
  • Purchase activity (subscription tier, order values, product categories)
  • Platform usage patterns (features used, time spent, pages visited)
  • Conversion events (sign-ups, subscriptions, purchases)

Your Advertising Choices:

  • Use GPC browser signals or browser settings to opt out of targeted advertising
  • California residents can opt out via our Do Not Sell or Share page
  • Control ad personalization through platform settings (Meta Ad Preferences, Google Ad Settings, TikTok Privacy)

Analytics and Product Insights:

  • We use PostHog for product analytics to understand how Merchants use our platform features
  • PostHog records and replays sessions on the Platform — pages viewed, clicks, scrolling, navigation paths — together with interaction heatmaps and feature usage patterns
  • Where you are signed in, these recordings are linked to your account identifier and are therefore personal data. They are not anonymous. Form field contents, including passwords and payment fields, are suppressed from recordings
  • Recordings are retained for up to 90 days and then deleted. In the EU/EEA, UK and Switzerland, session replay runs only where you have consented via our cookie banner; elsewhere you may opt out via GPC or Cookie Preferences
  • You can opt out of analytics tracking using GPC browser signals or browser settings

3.5 To Monitor Content Quality and Compliance

We may review AI-Generated Content, your AI Tool inputs, and Merchant Content to:

  • Ensure compliance with our Terms of Service and acceptable use policies
  • Prevent misuse for creating illegal, infringing, or harmful content
  • Maintain AI model quality and integrity
  • Respond to IP infringement claims or legal process

Review may be automated (content filtering) or manual (trust and safety team). We access only the minimum content necessary.

We do not sell personal data for monetary compensation. However, we share data with advertising partners as described in Section 3.4, which may constitute "sharing" under state privacy laws such as the California Consumer Privacy Act (CCPA). We only use Customer Information as a Data Processor to provide the Services to you, the Merchant.

4. Disclosure of Your Information

We may disclose information under the following circumstances:

  • To Service Providers and Sub-processors: We share information with third-party contractors who support our business. A list of our key sub-processors is provided below.
  • To Fulfill Your Requests: We share information with Production Partners and Marketplaces that you integrate with, as necessary to list products or fulfill orders. For example, we send Customer order details to your chosen Production Partner for printing and shipping.
  • For Legal Reasons: If required by law, such as in response to a subpoena or court order, or to protect the rights, property, or safety of our company, our users, or others.
  • In Connection with a Business Transaction: In the event of a merger, acquisition, or sale of our assets, your information may be transferred to the new entity.
  • With Your Consent: For any other purpose disclosed by us when you provide the information.

4.1 Our Sub-processors

We engage third-party services to provide the Platform. By using our Services, you consent to these sub-processors. For a comprehensive list, see our Data Processing Addendum (DPA). Key categories include:

  • Infrastructure & Hosting: Amazon Web Services, Inc. (USA) – Cloud hosting and data storage
  • Payment Processing: Polar Software Inc. (USA) – Merchant of record for subscription billing (payments processed via Stripe); Stripe, Inc. (USA) – Payment processing
  • Order Fulfillment: Production Partners you connect (Printful, Printify) – Order fulfillment and shipping
  • Marketplace Integrations: Etsy, Inc. (USA), TikTok/ByteDance (USA/Singapore), Shopify, Inc. (Canada) – Product listing integrations and, for subscriptions purchased through the Shopify App Store, subscription billing
  • AI & ML Providers: Google LLC (USA), OpenAI, Inc. (USA), Anthropic PBC (USA), ElevenLabs Inc. (USA), Fal.ai (USA), Replicate, Inc. (USA), Black Forest Labs GmbH (Germany) – AI content generation from prompts and uploaded assets. Note: Use of YouTube integration is subject to the Google Privacy Policy.
  • Image Processing: PhotoRoom SAS (France) – Background removal and image cleanup on designs and uploaded assets
  • Customer Support: Intercom, Inc. (USA) – In-app support chat and help center
  • Marketing & Advertising: Meta Platforms, Inc. (USA), TikTok Ads (USA/Singapore), Google Ads (USA), Pinterest (USA) – Targeted advertising and retargeting
  • Product Catalog & Shopping Feeds: Google Merchant Center (USA), Meta (USA), Microsoft (USA), Pinterest (USA), Reddit (USA), TikTok (USA/Singapore), X Corp. (USA), Snap (USA), OpenAI (USA) – Syndication of product listings (SKU, title, price, availability, image URLs). Product data only; these feeds contain no personal data.
  • Analytics & Product Insights: Google Analytics (USA), PostHog, Inc. (USA) – Website analytics, product analytics, session replay, and feature usage tracking
  • Affiliate Management: PromoteKit (USA) – Affiliate program tracking and payouts
  • Supporting Services: SerpApi LLC (USA), DataForSEO LLC (USA) – Search-result retrieval and keyword, trend, and market research (queries only); Cloudflare, Inc. (USA) – DNS and network delivery

We maintain the right to update this list of sub-processors as our business needs evolve. Material changes to sub-processors that handle Customer Information will be communicated to active Merchants via email with at least 30 days' notice, or as required by our Data Processing Addendum.

5. Data Retention

We will retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy.

  • Merchant Account Information: We retain your data as long as your account is active or as needed to provide you with Services and comply with our legal obligations.
  • Customer Information: We retain Customer Information processed on your behalf for as long as your account is active and as required to provide our Services. You, as the Data Controller, may have the ability to delete this data, subject to legal and operational requirements.
  • AI-Generated Content: We retain AI-Generated Content and associated data for as long as your account is active, and for up to 24 months afterwards, to provide the Services, resolve disputes over content ownership or infringement, and improve our AI Tools. After that period we delete it or irreversibly sever it from your identity. Content used in a training set may persist in that set for the life of the model generation it supports. This is described in our Terms of Service.
  • Inactive Accounts: Accounts without an active Subscription and with no sign-in or activity for 120 consecutive days may be deleted after advance notice to your registered email. Deletion removes personal information and uploaded content; AI-Generated Content, which may incorporate elements of your uploads, may be retained in de-identified form as described under "AI-Generated Content" above. Transaction records may be retained as required for legal, tax, and accounting purposes.
  • Marketing Data: We retain data shared with advertising platforms for up to 180 days for campaign optimization, after which it is anonymized or deleted unless legally required to retain.
  • Cookie Data: Advertising cookies persist for up to 13 months; analytics cookies for up to 2 years. You can delete cookies via browser settings at any time. PostHog session recordings are retained for up to 90 days.

6. Data Security

We implement appropriate technical and organizational measures, such as encryption and access controls, to protect your personal information. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies (web beacons, pixels, local storage) to operate our Platform, analyze usage, and deliver personalized advertising.

Consent by region.If you are visiting from the European Union/EEA, the United Kingdom, or Switzerland, non-essential cookies (analytics and advertising) are disabled by default and are set only after you give consent through our cookie banner. You can accept all, reject all, or choose categories, and you can change or withdraw your choice at any time via "Cookie Preferences". Dismissing the banner without making a choice leaves non-essential cookies off. In other regions (including the United States), non-essential cookies are active by default and you can opt out at any time using the tools described below, including the Global Privacy Control (GPC) signal, which we honor automatically.

7.1 Types of Cookies We Use

Essential Cookies (Always Active)

  • Purpose: Necessary for the website to function
  • Examples: Session management, authentication, security
  • Duration: Session or up to 30 days
  • Legal Basis: These cookies do not require consent as they are strictly necessary

Analytics Cookies (Consent-based in EU/UK/Switzerland; Opt-Out elsewhere)

  • Purpose: Understand how visitors use our site
  • Third Parties: Google Analytics, PostHog
  • Information Collected: Pages visited, time on site, referral source, device info, feature usage, user flows, session recordings (PostHog)
  • Duration: Up to 2 years
  • Legal Basis: Consent where required (EU/EEA, UK, Switzerland); otherwise legitimate interests with opt-out
  • Opt-out: Use GPC browser signal, browser settings, or platform-specific opt-out links

Advertising Cookies (Consent-based in EU/UK/Switzerland; Opt-Out elsewhere)

  • Purpose: Deliver personalized advertisements based on your interests
  • Third Parties: Google Ads, Facebook Pixel, TikTok Pixel, Pinterest Tag
  • Information Collected: Browsing behavior, ad interactions, inferred interests, hashed email addresses, device identifiers
  • Duration: Up to 13 months
  • Legal Basis: Consent where required (EU/EEA, UK, Switzerland); otherwise legitimate interests with opt-out
  • Opt-out: Use GPC browser signal, visit our Do Not Sell or Share page, or use platform-specific settings

7.2 Information We Collect Through Cookies

  • Device information (browser type, operating system, screen resolution)
  • IP address and approximate geographic location
  • Pages visited and content viewed
  • Time spent on pages and specific features
  • Links clicked and user interactions
  • Referral source (where you came from)
  • Unique identifiers assigned by tracking services
  • Session recordings and heatmaps (PostHog — linked to your account when signed in; form fields suppressed)

7.3 Sale or Sharing of Personal Information via Cookies

We share information collected through cookies with third-party advertising partners (Google, Facebook/Meta, TikTok, Pinterest). Under California law and other state privacy laws, this constitutes a "sale" or "sharing" of personal information.

These partners may:

  • Track you across multiple websites
  • Build profiles of your interests
  • Use your information for targeted advertising
  • Combine data with other information they have about you

You have the right to opt out of this sale or sharing.

7.4 Third-Party Services

We use the following third-party services that set cookies:

7.5 Your Cookie Choices

Cookie Banner

Accept, reject, or configure cookie categories when the banner appears, and reopen it anytime via "Cookie Preferences".

Global Privacy Control (GPC)

We automatically honor GPC browser signals. If your browser sends a GPC signal, we treat it as a request to opt out of non-essential cookies and disable advertising/analytics tracking immediately.

To enable GPC:

  • Use a privacy-focused browser like Brave or Firefox with GPC enabled
  • Install a GPC browser extension for Chrome/Edge
  • Enable privacy signals in your browser settings

Browser Settings

You can manage cookies directly through your browser settings:

  • View and delete cookies
  • Block third-party cookies
  • Block all cookies (may affect site functionality)
  • Clear cookies when closing your browser

Note: Blocking essential cookies may prevent our website from functioning properly.

Opt-Out of Specific Platforms

Do Not Sell or Share My Personal Information

California residents and residents of other states with privacy laws can opt out of data sharing for advertising by visiting our Do Not Sell or Share page.

7.6 Global Privacy Control (GPC)

We honor the Global Privacy Control browser signal. If your browser sends a GPC signal, we automatically treat it as a request to opt out of the sale or sharing of your personal information and disable non-essential tracking.

To enable GPC:

  • Use a privacy-focused browser like Brave or Firefox with GPC enabled
  • Install a GPC browser extension
  • Enable privacy signals in your browser settings

7.7 Cookie Duration

  • Session cookies: Deleted when you close your browser
  • Persistent cookies: Remain on your device for:
    • Analytics: Up to 2 years
    • Advertising: Up to 13 months
    • Essential: Up to 30 days

7.8 Do Not Track (DNT)

We do not currently respond to "Do Not Track" (DNT) signals from browsers, as there is no industry standard for DNT compliance. However, we honor Global Privacy Control (GPC) signals as described above.

8. Your Rights and Data Control Choices

8.1 For Merchants

You can access and update your personal information through your account settings. You can opt out of marketing communications by using the "unsubscribe" link in our emails.

8.2 For Customers of Merchants

Vaybel is a Data Processor for your information. If you wish to exercise your data protection rights (such as access, correction, or deletion), please contact the Merchant from whom you made the purchase. We will assist the Merchant in responding to your request as required by our Data Processing Addendum and applicable law.

8.3 For Users in the European Economic Area and the United Kingdom

If you are located in the EEA or UK, you have the right to request access to, correction, deletion, or portability of your Personal Data, and to object to or restrict processing. You may also lodge a complaint with your local supervisory authority. We rely on (i) contract (Article 6 §1(b)) to provide the Platform, (ii) legitimate interests (Article 6 §1(f)) for product analytics, platform safety and fraud prevention, and to develop and improve our AI models as described in Section 3.1, and (iii) consent (Article 6 §1(a)) for marketing cookies, advertising, and marketing emails. To exercise your rights, email legal@vaybel.com or submit a request via your account dashboard.

8.4 For California Residents

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), you have the right to (i) know what personal information we collect, (ii) request deletion, (iii) opt out of the sale or sharing of your personal information, and (iv) not be discriminated against for exercising your rights.

We share personal information with advertising partners (Meta, TikTok, Google, Pinterest) for targeted advertising purposes, which may constitute "sharing" under California law. You can opt out using GPC browser signals, browser settings, or by visiting our Do Not Sell or Share My Personal Information page linked in our footer.

To exercise your other rights, email legal@vaybel.com.

8.5 For Users in Other Jurisdictions

If you are located in Canada, your personal information is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). If you are located in Australia, we handle personal information consistent with the Privacy Act 1988 and the Australian Privacy Principles. Residents of other regions may have similar rights under local law. To exercise any privacy right, contact legal@vaybel.com and we will respond in accordance with the law applicable to you.

9. International Data Transfers

Our services are operated in the United States. If you are located outside the United States, your information will be transferred to, stored, and processed in the United States. Transfers of Personal Data from the European Economic Area (EEA), UK, and Switzerland are safeguarded by appropriate mechanisms, including the EU Standard Contractual Clauses and the UK Addendum, to ensure your data is protected. For more details, please see our DPA.

10. Children's Privacy

Our Services are not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18.

11. Changes to Our Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.

12. Contact Information

To ask questions or comment about this Privacy Policy and our privacy practices, contact us at:

Algorithmic Labs, LLC
Attn: Legal Department
169 Madison Ave, STE 11762
New York, NY, 10016 US
Email: legal@vaybel.com