Privacy Policy

Who we are

greatVibe is provided by Gravient Systems Ltd, a New Zealand company. Gravient Systems Ltd is responsible for the personal information described in this policy.

This policy explains what we collect through our website and service, why we use it, who we share it with, how long we keep it, and the choices available to you.

Questions about this policy can be sent to privacy@gravient.ai.

What we collect

We collect the information needed to provide and protect greatVibe. Depending on how you use the service, this may include:

• Your name, email address, account identifiers, and organisation details.
• Subscription and billing status. Card details are handled by Stripe and are not stored by Gravient.
• Messages and information you provide when you contact sales, support, security, or privacy.
• Website and service records such as IP address, browser or device information, timestamps, request paths, and security or audit events.
• Product usage information such as feature and activity counts, event timestamps, performance and error information, and the account, node, or session identifiers associated with that activity.

We may receive account information from an organisation administrator who invites you, billing status from Stripe, sign-in details from an identity provider you choose, and metadata from a connected service when needed to complete work you direct.

Product data and connected services

Model API keys are stored encrypted on controlled nodes. Calls from your node to an AI provider you connect do not normally pass through Gravient's marketing infrastructure.

Gravient may process limited product data where this is needed to provide a feature you direct, investigate a support request or security incident, maintain audit evidence, or comply with law. A connected service or AI provider processes the information you choose to send to it under its own terms and privacy policy.

How we use personal information

We use personal information to:

• create and administer accounts and provide the service;
• process subscriptions and maintain billing records;
• secure greatVibe, prevent misuse, diagnose faults, and keep audit records;
• respond to enquiries and provide support;
• understand how the service is used and improve its features, reliability, and operation; and
• meet legal, tax, accounting, and regulatory obligations.

For people in the European Economic Area, the United Kingdom or Switzerland, our lawful bases are performance of our contract, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where the law requires it. You can object to processing based on legitimate interests.

Security

Credentials stored on controlled nodes are encrypted using AES-256-GCM. Node connections are protected using mutual TLS. Additional authenticated encryption is used for supported credential-delivery flows.

We use access controls, scoped credentials, and security and audit records to protect the service. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Third parties

Stripe processes subscription payments and provides billing status to us.

Google may process your email address and basic profile information if Google sign-in is available and you choose it.

AI providers are services you choose to connect. greatVibe is a platform. We are not party to your conversations with those providers, and we do not control how they handle data you send to them. Refer to each provider's own privacy policy.

Vultr hosts the public website. Cloudflare provides DNS and Web Analytics. Amazon Web Services runs parts of our delivery pipeline. They process connection and technical information needed to provide those services.

Vimeo hosts our videos. The preview video player on the homepage loads from Vimeo when it scrolls into view, without a click. That player uses Vimeo's do-not-track setting. Some video preview images on the homepage and the Watch page also load from Vimeo when they scroll into view. Other video players load only when you press play. Vimeo receives technical information such as your IP address when your browser requests its content.

Google Analytics shows us how people use this website, our account pages and the dashboard. See Analytics, cookies and browser storage below.

Cloudflare Web Analytics measures visits to this website, our account pages and the dashboard. On the account pages and the dashboard it only measures page loads whose address has no query string, fragment or IDs. It is cookieless and does not fingerprint visitors. It records page views, the site that referred you, your country, your device and browser, and how fast pages load. Cloudflare processes your IP address to receive the measurement. We see only totals. We rely on our legitimate interest in understanding basic, aggregate use of this site. You can object. Email privacy@gravient.ai, or block cloudflareinsights.com in your browser.

We do not sell your data. We do not share it with advertisers.

Overseas disclosures

We operate from New Zealand. The providers named in this policy may process personal information in other countries where they or their subprocessors operate.

The European Commission, the United Kingdom and Switzerland recognise New Zealand as providing adequate protection for personal information. Where those decisions apply, we rely on them for transfers to Gravient in New Zealand. For onward processing by providers in other countries, we use the protections required by applicable law and the provider's contractual privacy and security commitments.

Analytics, cookies and browser storage

We use Google Analytics 4 to see how people use this website. Google LLC provides it.

Google Analytics records the pages you view and how you arrived, including the site that referred you and any campaign tags in the link. It records your approximate location (country, and region or city where that setting is on), worked out from your IP address. Google Analytics 4 does not store IP addresses. It also records your device, browser and operating system.

It records these events: sign-up and call-to-action clicks with where they sit on the page, pricing plan clicks, contact link clicks, video plays, and the address of any page that was not found. Google's enhanced measurement may also record, depending on our settings: scrolling, clicks on links to other sites and file downloads.

Google Analytics sets two cookies: _ga and _ga_C9CLV68SL5. They may be set on greatvibe.ai and its subdomains, because the dashboard runs on regional subdomains. They last up to 2 years.

If you appear to be in the European Economic Area, the United Kingdom or Switzerland, we ask before we set these cookies. We judge this from your device's time zone. Until you choose, Google gets only cookieless signals. For you, Cookie settings appears at the bottom of each page of this website. Google also keeps these cookies off by default for visitors it places in those regions, until they accept.

Elsewhere, we set these cookies without asking. You can object. Email privacy@gravient.ai, block google-analytics.com and googletagmanager.com in your browser, or use Google's opt-out browser add-on.

While its cookies are off, Google still receives some signals: before you accept, and after you press Decline. These signals carry no cookies or identifiers. They contain the page, the time, basic device and browser details, and your IP address. Google uses your IP address to work out your approximate location. Google Analytics 4 does not store it. We send these signals based on our legitimate interest in understanding basic, aggregate use of this site. You can object. Email privacy@gravient.ai, or block google-analytics.com and googletagmanager.com in your browser.

Accept turns on analytics cookies. Decline keeps them off. Decline does not stop these cookieless signals.

If we asked you, you can change your choice at any time with Cookie settings. We keep your choice in a cookie called gv_consent on greatvibe.ai and its sub-domains, and in your browser's local storage under the name gv-consent. It lasts 400 days. It holds only 'granted' or 'denied', so your choice carries across our website, account pages and dashboard.

We also use Google Analytics on our account pages (sign-up, sign-in and account admin) and on the dashboard. On those pages it records cleaned page addresses only. We remove query strings and IDs from each address. It never receives your name, email address, account or node IDs, prompts, or anything you type into a form. On the account pages it also records these steps: starting checkout, adding a payment method, signing up, and signing in with the method you used. It never receives card details. On the dashboard it records page views only.

The dashboard and account admin show no cookie banner. A choice you made on this website applies on all of these pages, including regional dashboard addresses. Without one, visitors Google places in the European Economic Area, the United Kingdom or Switzerland send only the cookieless signals described above. Elsewhere, the cookies are set.

The sign-up form also loads Stripe to take card details. Stripe may set its own cookies to prevent fraud.

Google Signals and ad personalisation are off. We run no ads. Google may process this data in the United States under its data processing terms. Read how Google uses information from sites or apps that use its services.

If you arrive from a link with campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content or ref), we keep those tags in your browser's session storage under the name gv-attribution. It holds only those tags. It covers this tab only and is cleared when you close the tab. We use it to add the same tags to our sign-up link, so we know which link brought you to us. The stored tags are never sent anywhere except inside the sign-up link address when you follow it.

Third-party media providers may receive technical information when your browser requests their content, as described above.

Your rights

Depending on where you live and the law that applies, you may have rights to:

• access the personal information we hold about you;
• correct inaccurate information;
• ask us to delete or restrict use of information;
• receive certain information in a portable format;
• object to certain uses of information; and
• complain to the privacy or data protection regulator where you live.

New Zealand law gives you rights to access and correct your personal information. We normally respond to New Zealand access requests within 20 working days. Additional rights apply in some places, including the European Economic Area, the United Kingdom and Switzerland.

To exercise a right or raise a concern, email privacy@gravient.ai. We may need to verify your identity before acting. You may also complain to the Office of the Privacy Commissioner in New Zealand or a regulator with authority where you live.

Data breach notification

If a privacy breach has caused or may cause serious harm, we will notify affected people and the Office of the Privacy Commissioner in New Zealand as required by law. We will also make any notification required by other applicable laws.

Children

greatVibe is intended for people aged 16 or older. We do not knowingly create accounts for anyone under 16. If you believe a child has provided us with personal information, contact privacy@gravient.ai so we can investigate and take appropriate action.

Data retention

We keep personal information only for as long as it is reasonably needed for the purposes described in this policy. Retention differs by record type and may reflect the life of your account, security and audit needs, dispute resolution, backup cycles, and legal, tax, or accounting requirements.

When information is no longer needed, we delete it or remove identifying details where reasonably practicable. You can request deletion by emailing privacy@gravient.ai. Some information may need to be retained where law permits or requires it.

Changes to this policy

We will post any changes to this page and update the date at the top. If changes are significant, we will notify you by email.

Contact

Privacy Officer: David Jenkinson

Privacy questions: privacy@gravient.ai

Gravient Systems Ltd
New Zealand