Privacy Policy — FunderVibe

Effective date: August 3, 2026 · Privacy questions: [email protected]

FunderVibe, operated by ESI ("we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and what rights you have over it. By using FunderVibe, you agree to the practices described here.

1. Data we collect

Account data: When you register, we collect your email address, chosen username, and password (stored as a bcrypt hash — we never store your plaintext password).

Profile data: Display name, bio, location, avatar image, and links you add to your public profile.

Project data: All content you submit as a Creator — project title, pitch, images, milestone descriptions, backer perk details — is stored on our servers and may be publicly visible.

Pledge data: When you back a project, we record the pledge amount, project, timestamp, and a Stripe Payment Intent ID. We do not receive or store your card number, CVC, or banking details — those go directly to Stripe.

Contact messages: If you use the contact form or help system, we store the content of your message and your account ID (or name/email if submitted as a guest).

Newsletter email: If you subscribe to campaign notifications, we store your email address and the date of subscription.

2. How we use your data

To provide and operate the Platform (authentication, project listings, pledges).
To send transactional emails (email confirmation, pledge receipts, payout notifications).
To send campaign launch notifications to newsletter subscribers (you can unsubscribe at any time).
To review campaigns for compliance with our Terms of Service.
To respond to support requests and contact form submissions.
To detect and prevent fraud and abuse.
To comply with legal obligations.

We do not sell your personal data. We do not use your data for advertising or share it with third-party marketing services.

3. Stripe payment data

Payment processing is handled entirely by Stripe, Inc. FunderVibe integrates with Stripe via their API and webhooks. When you make a payment, your card details are collected directly by Stripe's secure fields — they are never transmitted to or stored on FunderVibe's servers.

Stripe's handling of your data is governed by Stripe's Privacy Policy. By making a pledge, you acknowledge that your payment data will be processed by Stripe.

4. Cookies

FunderVibe uses a small number of strictly necessary cookies to keep you logged in and protect your session (CSRF protection). We do not use third-party analytics cookies or advertising cookies by default. See our Cookie Policy for the full list of cookies we use and how to control them.

5. Data retention

We retain your account data for as long as your account is active. Project data, pledge records, and audit logs may be retained for up to 7 years for legal and financial compliance purposes, even after account deletion.

Newsletter subscription records are retained until you unsubscribe. Contact form submissions are retained for up to 2 years and then purged.

6. Your rights

Depending on your jurisdiction, you may have the right to:

Access a copy of the personal data we hold about you.
Correct inaccurate or incomplete data (you can update most data directly in Account Settings).
Delete your account and personal data (subject to retention requirements above).
Restrict or object to processing of your data in certain circumstances.
Unsubscribe from newsletter emails at any time by contacting us.
Port your data in a machine-readable format upon request.

To exercise any of these rights, email [email protected] with the subject line "Privacy request". We will respond within 30 days.

7. Third-party services

We use the following third-party services that may process your data:

Stripe — payment processing and Creator payouts. Privacy policy →
Your email provider — transactional emails sent via our configured SMTP service.

We do not use Google Analytics, Facebook Pixel, or any other advertising or behavioural tracking services.

8. Security

We use industry-standard measures to protect your data: HTTPS for all connections, bcrypt password hashing, CSRF protection on all forms, and session tokens that expire on logout. No system is 100% secure. If you believe your account has been compromised, contact us immediately.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-platform notice. The "Effective date" at the top of this page reflects when the policy was last updated.