VibeCraft Privacy Policy

VIBECRAFT PRIVACY POLICY Version: 2026-09-03 Effective Date: September 3, 2026 This Privacy Policy explains how information is collected, used, disclosed, retained, and protected in connection with the VibeCraft platform, websites, applications, artificial intelligence features, visualization tools, business intelligence tools, customer-facing experiences, and related products and services (collectively, the “Service”). VibeCraft is a product and service operated by HERA Systems LLC, a Pennsylvania limited liability company (“VibeCraft,” “we,” “us,” or “our”). This Privacy Policy applies to information processed through the Service, including information concerning subscribing businesses, their authorized users, customers, prospects, and other individuals who interact with VibeCraft-powered experiences. By using the Service, you acknowledge the practices described in this Privacy Policy. 1. Information We Collect The information we collect depends upon how you interact with the Service. A. Account and Company Information When a company creates an account, purchases a subscription, completes onboarding, requests information, or otherwise interacts with VibeCraft, we may collect information such as: • company or organization name; • business address; • website; • contact names; • job titles; • email addresses; • telephone numbers; • usernames and account identifiers; • account preferences; • branding information; • subscription plan; • billing interval; • purchased features or add-ons; • promotional pricing or discounts; • onboarding information; and • other information provided in connection with the business relationship. B. Subscription, Agreement, and Transaction Information We may collect and maintain information relating to subscriptions, Orders, proposals, agreements, and transactions, including: • subscription plan and pricing; • onboarding, implementation, or activation arrangements; • billing frequency; • transaction and payment status; • promotional terms; • accepted proposals and Orders; • signer name, title, and email address; • typed or electronic signature; • date and time of acceptance; • applicable Terms of Service version; • applicable Privacy Policy version; • other applicable legal-document versions; • IP address; • user agent; • timezone; • document hashes or fingerprints; and • other information reasonably necessary to maintain an audit record of an electronic transaction. C. Payment Information Payments may be processed through third-party payment processors such as Stripe. Payment card information is generally submitted directly to the applicable payment processor and is not stored by VibeCraft. We may receive limited payment and billing information from the payment processor, such as: • payment status; • transaction identifier; • billing name or address; • payment method type; • expiration information; • last four digits of a payment card; and • subscription or invoice information. Payment information is also subject to the privacy practices of the applicable payment processor. D. Company Content Companies may submit information and materials to the Service, including: • logos; • branding materials; • photographs; • venue imagery; • venue information; • event information; • equipment information; • product and service offerings; • packages; • enhancements; • pricing; • configurations; • documents; • design preferences; • visualizations; • and other materials selected by the Company. The Company determines what Company Content it provides to VibeCraft. E. Customer, Prospect, and Event Information Companies may use VibeCraft to collect, store, process, or interact with information concerning their own customers and prospects. Depending upon how a Company configures and uses the Service, this may include: • names; • email addresses; • telephone numbers; • event information; • event dates; • venue selections; • service interests; • enhancement interests; • product selections; • design preferences; • music-related preferences; • questionnaire responses; • visualization selections; • interaction history; • sales activity; and • other information submitted by or concerning the Company’s customers or prospects. When VibeCraft processes this information on behalf of a subscribing Company, the Company is generally responsible for determining the purposes for which the information is collected and used, and VibeCraft processes the information to provide the Service. F. Venue Information We may collect or maintain information concerning venues from subscribing Companies, venues themselves, publicly available sources, licensed sources, independent research, or information developed through operation of the Service. Venue-related information may include: • venue name; • location; • publicly available business information; • photographs and imagery; • layouts; • measurements; • structural characteristics; • event-space information; • equipment-placement information; • venue capabilities; • platform-generated venue records; • metadata; and • other venue-related information. Company-specific Confidential Information and proprietary Company Content are treated in accordance with the Terms of Service and this Privacy Policy. G. Usage, Device, and Technical Information When individuals use or interact with the Service, we may automatically collect technical and usage information such as: • IP address; • browser type; • device type; • operating system; • referring pages; • pages or screens viewed; • timestamps; • session information; • feature usage; • button or interface interactions; • error and diagnostic information; • performance information; • approximate geographic information derived from IP address; • account activity; and • other technical information generated through use of the Service. We use this information to operate, secure, troubleshoot, understand, and improve the Service. H. Communications and Support Information If you contact us for onboarding, support, sales, billing, technical assistance, feedback, or other purposes, we may retain the content of those communications and related contact information. 2. How We Use Information We may use information collected through the Service to: • create and manage accounts; • provide and operate the Service; • configure and personalize Company accounts; • perform onboarding, implementation, and activation services; • create and maintain venue-related functionality; • provide customer-facing experiences; • generate visualizations and other Service outputs; • provide artificial intelligence functionality; • process subscriptions and payments; • administer Orders, agreements, and promotions; • authenticate users and maintain account security; • provide customer support; • communicate regarding accounts, subscriptions, billing, security, updates, and Service changes; • monitor performance and reliability; • diagnose and correct technical issues; • prevent fraud, abuse, unauthorized access, and security threats; • understand how the Service is used; • develop, test, maintain, and improve features; • develop new products and functionality; • perform internal analytics and research; • create aggregated or de-identified information; • comply with applicable law and legal obligations; • establish, exercise, or defend legal claims; • enforce agreements and policies; and • otherwise operate our business for legitimate business purposes consistent with this Privacy Policy. 3. Artificial Intelligence and Automated Processing VibeCraft uses artificial intelligence and automated technologies as part of certain Service features. Depending upon the feature used, information submitted to the Service may be processed by VibeCraft systems or third-party technology providers that assist us in providing artificial intelligence, image-generation, analysis, recommendation, automation, or related functionality. Information processed through AI-enabled features may include: • prompts; • venue information; • images; • design preferences; • event information; • Company Content; • user selections; • configuration information; and • other information necessary to generate the requested output. We use such processing to provide requested functionality, improve the Service, maintain safety and security, troubleshoot issues, and develop features as permitted by applicable law and our agreements with service providers. VibeCraft does not use identifiable customer or prospect information to provide another subscribing Company with Company-specific competitive intelligence. Where information is used to improve broader platform functionality, we may use aggregated, statistical, or de-identified information as described in this Privacy Policy. AI-generated outputs may not always be accurate, unique, or complete. Additional information regarding AI-generated content appears in the VibeCraft Terms of Service. 4. Aggregated and De-Identified Information We may create aggregated, statistical, or de-identified information from information processed through the Service. We may use this information to: • understand Service usage; • evaluate product performance; • develop benchmarks and industry insights; • improve artificial intelligence and recommendation systems; • improve visualization and sales tools; • develop new features and products; • improve security and reliability; • conduct internal research; and • otherwise operate and improve VibeCraft. We do not intend to use aggregated or de-identified information in a manner that reasonably identifies a particular subscribing Company, customer, prospect, or other individual. For example, VibeCraft may analyze aggregate patterns concerning how users interact with certain features or categories of enhancements without disclosing that a particular Company charges a particular price, has a particular customer, or achieves a particular conversion rate. 5. How We Share Information VibeCraft does not sell personal information for monetary consideration. We may disclose information in the circumstances described below. A. Service Providers We may provide information to third-party companies that perform services on our behalf or help us operate VibeCraft. These may include providers of: • cloud hosting and infrastructure; • databases and storage; • payment processing; • artificial intelligence and machine learning; • image processing or generation; • email delivery; • messaging; • analytics; • error monitoring; • security; • authentication; • customer support; • scheduling; • mapping; • communications; and • other technology or professional services. Service providers are permitted to process information for purposes related to providing their services to us, subject to applicable contractual and legal requirements. B. At the Direction of a Company or User We may disclose information when a subscribing Company or authorized user directs us to do so, including through integrations, customer-facing experiences, exports, or other Service functionality. C. Legal and Compliance Purposes We may disclose information if we reasonably believe disclosure is necessary to: • comply with applicable law; • respond to a subpoena, court order, warrant, or other valid legal process; • enforce our agreements; • investigate fraud or unlawful activity; • protect the rights, property, or safety of VibeCraft, HERA Systems LLC, our customers, users, or others; • detect or address security incidents; or • establish, exercise, or defend legal claims. Where legally permitted and reasonably appropriate, we may notify an affected Company of a legal request involving its information. D. Business Transactions Information may be disclosed or transferred in connection with a merger, acquisition, financing, investment, reorganization, sale of assets, due diligence process, bankruptcy, or similar corporate transaction involving HERA Systems LLC or the VibeCraft business. Any successor entity may continue to process information consistent with this Privacy Policy, applicable law, and existing contractual obligations. E. Affiliates and Business Operations Information may be shared within HERA Systems LLC and with future affiliates or related entities where reasonably necessary to operate, support, secure, or develop VibeCraft or other related business operations, subject to applicable confidentiality and privacy obligations. 6. What We Do Not Share With Other VibeCraft Customers VibeCraft may serve multiple companies within the same industry, geographic market, or venue. We do not provide another VibeCraft subscriber with your identifiable: • client or prospect lists; • client contact information; • Company-specific pricing; • individual sales activity; • Company-specific conversion information; • private account analytics; • Confidential Information; • proprietary Company configurations; or • proprietary Company Content merely because that subscriber operates in the same market or services the same venue. VibeCraft may maintain and reuse shared venue infrastructure, independently obtained venue information, VibeCraft-created venue assets, and aggregated or de-identified insights as described in the Terms of Service. 7. Your Clients' and Prospects' Information When a subscribing Company submits or collects information concerning its own customers, prospects, employees, contractors, or other individuals through the Service, that Company is responsible for determining whether it has appropriate authority to collect and provide that information. The Company is responsible for: • providing legally required privacy notices; • obtaining legally required permissions or consents; • determining the lawful purposes for which it collects information; • complying with applicable marketing and communications laws; and • responding to requests from its customers or prospects where the Company is legally responsible for doing so. VibeCraft processes such information to provide the Service and in accordance with the applicable agreement, this Privacy Policy, and applicable law. If an individual contacts VibeCraft regarding information controlled by one of our subscribing Companies, we may direct the individual to the applicable Company or assist the Company in responding where appropriate. 8. Cookies and Similar Technologies VibeCraft websites and applications may use cookies, local storage, pixels, session technologies, and similar technologies to: • maintain sessions; • authenticate users; • remember preferences; • provide requested functionality; • maintain security; • understand Service usage; • measure performance; • troubleshoot errors; and • improve the Service. Some technologies may be provided by third-party analytics, infrastructure, or service providers. Where required by applicable law, we will provide appropriate choices or obtain required consent before using non-essential cookies or similar technologies. Browser or device settings may allow users to control certain cookies, although disabling necessary technologies may affect Service functionality. 9. Communications We may send communications relating to: • account activity; • subscriptions; • billing; • security; • legal notices; • Service changes; • support; • onboarding; • product updates; and • other transactional or administrative matters. These communications may be necessary to provide the Service and may not be subject to marketing opt-out preferences. We may also send marketing or promotional communications where permitted by law. Recipients may opt out of marketing email by using the unsubscribe mechanism provided in the communication or by contacting us. Opting out of marketing communications does not prevent us from sending necessary transactional, account, billing, security, or legal communications. 10. Data Retention We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including while an account is active and for appropriate periods afterward. Retention periods may depend upon: • the nature of the information; • the duration of the business relationship; • contractual obligations; • legal and regulatory requirements; • accounting and tax requirements; • security and fraud-prevention needs; • backup and disaster-recovery practices; • dispute-resolution requirements; and • the need to establish, exercise, or defend legal claims. Certain records may be retained after account termination, including transaction records, invoices, signed agreements, legal-document acceptance records, security records, and other information necessary to maintain legitimate business and legal records. When information is no longer reasonably necessary, we may delete, anonymize, or de-identify it in accordance with our retention practices and applicable law. 11. Security VibeCraft uses commercially reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, acquisition, destruction, loss, alteration, or disclosure. These measures may include, where appropriate: • encryption in transit; • access controls; • authentication; • least-privilege access practices; • database security controls; • infrastructure security; • monitoring; • logging; and • other safeguards appropriate to the nature of the information processed. No system, network, database, or method of electronic transmission or storage can be guaranteed to be completely secure. Accordingly, while we work to protect information, VibeCraft cannot guarantee absolute security. Companies are responsible for maintaining the security of their own credentials, devices, networks, and authorized-user access. 12. Data Incidents If VibeCraft becomes aware of a security incident involving personal information, we will investigate and respond in accordance with applicable law and our contractual obligations. Where legally required, we will provide appropriate notice to affected Companies, individuals, regulators, or other parties. 13. Children's Privacy VibeCraft is a business platform and is not intended for use by children. We do not knowingly solicit personal information directly from children under 13 through general VibeCraft account registration or marketing activities. A subscribing Company may, depending upon its business and use of the Service, submit event-related information concerning individuals of different ages. The subscribing Company is responsible for ensuring that it has appropriate authority to provide such information and for complying with laws applicable to its collection and use. If we learn that personal information has been collected directly by VibeCraft from a child in a manner inconsistent with applicable law, we will take appropriate steps to address the information. 14. Privacy Rights and Choices Depending upon where you reside and applicable law, you may have rights concerning personal information, which may include rights to: • request access to personal information; • request correction of inaccurate information; • request deletion of certain information; • request a copy of certain information; • object to or restrict certain processing; • withdraw consent where processing is based upon consent; or • appeal certain privacy-request decisions where required by law. These rights are not absolute and may be subject to exceptions. For example, we may retain information where necessary to comply with law, maintain transaction records, establish or defend legal claims, detect fraud, maintain security, or satisfy contractual obligations. Requests may be submitted to: contact@getvibecraft.com We may take reasonable steps to verify the identity and authority of the person submitting a request before responding. If a request concerns information that VibeCraft processes on behalf of a subscribing Company, we may direct the requester to that Company or coordinate with the Company as appropriate. 15. State Privacy Rights Residents of certain U.S. states may have additional privacy rights under applicable state privacy laws. Where such laws apply to VibeCraft's processing activities, we will honor applicable rights and obligations, which may include rights concerning access, correction, deletion, portability, certain disclosures, and the ability to opt out of specified processing activities. The availability and scope of these rights depend upon applicable law, the individual's relationship with VibeCraft, and whether VibeCraft acts as a business/controller or service provider/processor with respect to the information. VibeCraft does not sell personal information for monetary consideration. If our data practices materially change in a manner that creates additional legally defined opt-out rights, we will update this Privacy Policy and provide applicable mechanisms as required by law. 16. International Users and Data Processing VibeCraft is operated from the United States. If information is submitted from outside the United States, it may be transferred to, processed in, or stored in the United States or other jurisdictions where VibeCraft's service providers operate. Those jurisdictions may have privacy and data-protection laws that differ from those in the individual's home jurisdiction. Where required by applicable law, VibeCraft will use appropriate mechanisms for international transfers of personal information. 17. Third-Party Websites and Services The Service may contain links to, integrate with, or otherwise interact with third-party websites, applications, or services. This Privacy Policy does not govern the independent privacy practices of third parties. We encourage users to review the privacy policies of third-party services they choose to use. 18. Changes to This Privacy Policy We may update this Privacy Policy as VibeCraft, our technology, legal requirements, and our business practices evolve. When we make changes, we will update the version and effective date. Where changes are material, we may provide additional notice through the Service, by email, during renewal or acceptance, or through another reasonable method. Historical versions may be maintained as part of VibeCraft's legal-document records. The version recorded in connection with a signed or electronically accepted Order will remain associated with that transaction. 19. Relationship to the Terms of Service This Privacy Policy should be read together with the VibeCraft Terms of Service and any applicable Order. The Terms of Service contain additional provisions concerning Company Content, shared venue infrastructure, aggregated and de-identified information, confidentiality, security, artificial intelligence, and other aspects of the Service. Nothing in this Privacy Policy transfers ownership of Company Content to VibeCraft or grants a subscribing Company ownership of VibeCraft technology, venue infrastructure, platform assets, or intellectual property. 20. Contact Us Questions, requests, or concerns regarding privacy or this Privacy Policy may be directed to: HERA Systems LLC VibeCraft Pennsylvania, United States Email: contact@getvibecraft.com This Privacy Policy is provided for review in connection with use of the VibeCraft Service. The version recorded in connection with your signed or electronically accepted Order is the version associated with that transaction.