VIBES + LOGIC PRIVACY POLICY

Last Updated: September 10, 2026

1. Introduction

Vibes & Logic, Inc., a Delaware corporation, and our affiliates (collectively, "Vibes + Logic," "Company," "we," "us," or "our") welcome you. This Privacy Policy describes how we collect, use, disclose, and otherwise process the personal information we collect about or from you when you use our websites (including vibesandlogic.com), mobile applications, and other online products or services that link to this Privacy Policy (collectively, the "Services").

This Privacy Policy may be updated by us from time to time. When we make material changes to this Privacy Policy, we will notify you by updating the "Last Updated" date at the top of this Privacy Policy and, where required by applicable law, by providing additional notice (such as by email or through the Services).

By accepting this Privacy Policy, accessing or using the Services, or otherwise manifesting your assent to this Privacy Policy, you agree to be bound by this Privacy Policy. If you do not agree to (or cannot comply with) all of the terms of this Privacy Policy, please do not access or use the Services.

2. Information We Collect

In the course of operating the Services, Vibes + Logic collects or receives the following categories of personal information:

2.1 Information You Provide

Account Information, such as your name, email address, password, phone number, and other registration information.

Profile Information, such as your username, photograph or other likeness, biographical information, social media handles, country of residence, zip code, and any other information you choose to provide as part of your public profile.

Demographic Information, such as your gender identity, date of birth, and preferences.

Payment and Transaction Information, such as your credit card number, expiration date, card verification number, billing address, and transaction history when you purchase Subscriptions, Credits, or other paid products or services through the Services. Our third-party payment processing providers may also collect, process, and store your payment information in accordance with their respective privacy policies. We also collect information about your Subscription status (active, canceled, expired), Subscription tier (monthly or annual), Credit balance, Credit purchase history, and Credit redemption activity.

User-Generated Content, including audiovisual recordings, concert clips, photos, images, videos, comments, messages, and other content that you upload, submit, or transmit through the Services.

Communications, including any information you provide when you contact us for support or otherwise communicate with us.

2.2 Information Collected Automatically

Location Information, including general location derived from your IP address and, if you enable location services on your device, your precise geolocation.

Device and Usage Information, including your IP address, browser type and version, operating system, device identifiers, the pages you view on our Services, the actions you take on our Services, the date and time of your visits, time spent on pages, and other usage data.

Mobile App Analytics and Event Data. When you use our mobile application, we automatically collect information through integrated software development kits ("SDKs"), including the Firebase Analytics SDK (which sends data to Google) and the Facebook SDK (which sends data to Meta Platforms, Inc.). The Facebook SDK automatically logs certain events, including app opens, app installs, and in-app purchases (including purchase amounts and transaction identifiers), and transmits this data to Meta. Firebase Analytics collects usage data and, when Google Signals is enabled (see Section 2.6), may associate this data with your Google account for cross-device tracking and demographic analysis.

AI Interaction Data, including your interactions with Lumens and AI-generated visual features, including the queries you submit, the responses you receive, and your feedback on AI-generated content.

Connected Device Data, including information about third-party devices you connect to the Services (such as smart lightbulbs), including device identifiers, synchronization settings, and usage patterns.

2.3 Information from Third Parties

Social Media Information, when you interact with our Services through third-party social networking sites or allow us to access information from your social media profiles.

Third-Party Advertisers and Partners, including information from companies that help us deliver, measure, and analyze the effectiveness of our advertising.

Service Providers, including information from companies and individuals that provide services on our behalf.

2.4 Information Collected Through Cookies and Similar Technologies

We use cookies, web beacons, pixels, tracking tags, software development kits ("SDKs"), and similar technologies to collect information about how you use the Services. On our websites, these technologies include the Google Analytics 4 tag, the Google Ads conversion tag, the Meta (Facebook) pixel, the TikTok pixel, the X (formerly Twitter) pixel, the LinkedIn Insight Tag, and the HubSpot tracking code and chat widget. In our mobile application, we use the Firebase Analytics SDK (which transmits data to Google) and the Facebook SDK (which transmits data to Meta). Each of these technologies may place cookies or collect device identifiers, IP addresses, and browsing or usage data, and transmit that data to the respective third-party platform.

Cookies are small data files stored on your device that help us improve the Services and your experience, track usage, and enable certain functionality.

Session Cookies expire when you close the Services and are used to make it easier for you to navigate our Services.

Persistent Cookies remain on your device for an extended period and enable us to track and personalize your experience on our Services.

You can control cookies through your browser settings. However, disabling cookies may limit your ability to use certain features of the Services.

For visitors located in the European Economic Area, the United Kingdom, or Switzerland, non-essential cookies and similar technologies (including all advertising and analytics pixels and SDKs listed above) will not be activated until you have provided your prior, affirmative consent through our cookie consent management tool, as required by Article 5(3) of the ePrivacy Directive (2002/58/EC) and the UK Privacy and Electronic Communications Regulations (PECR). You may withdraw your consent or change your preferences at any time through the consent management tool accessible via the cookie icon on our websites or through the privacy settings in our mobile application.

2.5 Inferences

We may draw inferences from the personal information we collect to create a profile reflecting your preferences, interests, and characteristics (such as preferred music genres and artists).

2.6 Cross-Device Tracking and Demographic Profiling

We use Google Analytics 4 with Google Signals enabled. When Google Signals is active, Google may associate your activity on our Services with your Google account (if you are signed in to Google and have enabled "Ads Personalization") to provide cross-device reporting and demographic data (such as age range, gender, and interest categories). This means that Google may link your activity on our websites, web app, and mobile app across multiple devices (e.g., your phone, tablet, and computer) using your Google account identity. This data is used by us to understand how users interact with our Services across devices and to improve our advertising. You can opt out of Google Signals’ cross-device tracking and demographic data collection by disabling "Ads Personalization" in your Google account settings at https://myaccount.google.com/data-and-privacy.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

3.1 Providing and Improving the Services

(a) To provide and administer the Services, including creating and managing accounts, displaying customized content, and facilitating communication with other users;

(b) To process transactions and fulfill your requests for products, services, information, and features;

(c) To operate, maintain, improve, and develop the Services, including developing new features and products;

(d) To personalize your experience on the Services, including by recommending content, artists, and events based on your preferences and activity;

(e) To enable the Device Sync Features and synchronize the Services with your connected devices;

(f) To train, improve, and develop our AI-powered features, including Lumens and AI Visual Features; and

(g) To process and fulfill Subscription purchases and renewals, manage your Subscription status, process Credit purchases and redemptions, send you renewal reminders and notifications about your Subscription or Credits, and provide customer support related to billing and account management.

3.2 Communications

(a) To respond to your inquiries, comments, and requests;

(b) To send you administrative messages about your account, the Services, and changes to our Terms of Use or Privacy Policy;

(c) To send you marketing communications about the Services, new features, promotions, and events, subject to your consent where required by applicable law; and

(d) To send you transactional communications related to your Subscription or Credits, including purchase confirmations, renewal reminders, payment receipts, cancellation confirmations, and notifications about material changes to your Subscription terms or Credit redemption options.

3.3 Advertising and Marketing

(a) To market and administer surveys and promotions;

(b) To analyze trends, traffic, and usage data using analytics tools, including Google Analytics 4 (with Google Signals) and Firebase Analytics;

(c) To identify unique users across devices, including through Google Signals’ cross-device tracking linked to signed-in Google accounts (see Section 2.6);

(d) To build retargeting and remarketing audiences on third-party advertising platforms — including Google Ads, Meta (Facebook/Instagram), TikTok, X (formerly Twitter), LinkedIn, and HubSpot — using data collected through the pixels, tags, and SDKs described in Sections 2.2 and 2.4, and to serve targeted advertisements to you on those platforms based on your activity on our Services;

(e) To measure the effectiveness of our advertising campaigns, including through conversion tracking provided by Google Ads, Meta, TikTok, X, LinkedIn, and HubSpot; and

(f) To advertise the Services on third-party websites and applications.

3.4 Safety, Security, and Legal Compliance

(a) To protect the security and integrity of the Services;

(b) To detect, prevent, and address fraud, security breaches, and other harmful or illegal activity;

(c) To verify your identity when you make requests regarding your personal information;

(d) To enforce our Terms of Use and other agreements; and

(e) To comply with applicable laws, regulations, legal processes, and governmental requests.

4. How We Share Your Information

We share your personal information in the following circumstances:

4.1 With Artists, Artist Management, and Third-Party Partners

We may share your information (including your name, email address, location, and activity data) with artists whose content you engage with on the Services, their management teams, and third-party partners such as for the purpose of sending you targeted marketing communications about concerts, events, merchandise, and other offerings. Before sharing your information with such third parties for their own marketing purposes, we will obtain your express opt-in consent where required by applicable law.

4.2 With Service Providers

We share personal information with companies and individuals that provide services on our behalf, including payment processing, hosting, analytics, email delivery, marketing, customer support, and database management services. We require our service providers to use your personal information only in connection with the services they provide to us.

4.3 With Affiliates

We may share your personal information with our affiliates, subsidiaries, and parent companies, subject to the terms of this Privacy Policy.

4.4 With Advertising and Marketing Partners

We share personal information with the following categories of advertising and marketing partners:

(a) Analytics Providers. We share usage data with Google (through Google Analytics 4 and Firebase Analytics) to analyze how users interact with our Services. When Google Signals is enabled, Google may associate this data with your signed-in Google account for cross-device reporting and demographic analysis (see Section 2.6).

(b) Advertising Platforms. Through the pixels, tags, and SDKs described in Section 2.4, we transmit identifiers (such as cookies, device identifiers, and hashed IP addresses) and usage data (such as pages viewed, actions taken, and in-app events including purchases) to the following advertising platforms for the purpose of building retargeting audiences, optimizing ad delivery, and measuring conversions:

• Google (via the Google Ads conversion tag and Firebase Analytics SDK)
• Meta Platforms, Inc. (via the Meta pixel on our websites and the Facebook SDK in our mobile app, which automatically logs app opens, app installs, and in-app purchase events)
• TikTok (via the TikTok pixel)
• X Corp. (via the X pixel)
• LinkedIn (via the LinkedIn Insight Tag)
• HubSpot (via the HubSpot tracking code and chat widget)

These platforms use the data they receive to build audience segments, serve targeted advertisements to you on their platforms and across the web, and provide us with analytics about the performance of our advertising campaigns. For California residents, these disclosures may constitute "sharing" of personal information for "cross-context behavioral advertising" as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (see Section 9).

(c) Artist and Event Marketing Partners. We share information with artists, artist management teams, and third-party partners as described in Section 4.1.

4.5 For Legal and Safety Purposes

We may disclose your personal information if we believe disclosure is necessary or appropriate to:

(a) Comply with applicable laws, regulations, legal processes, or governmental requests;

(b) Enforce our Terms of Use and other agreements;

(c) Protect our rights, privacy, safety, or property, or that of our users or others; and

(d) Detect, prevent, or address fraud, security breaches, or technical issues.

4.6 Business Transfers

We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

4.7 With Your Consent

We may share your personal information for other purposes with your consent or at your direction.

4.8 Aggregated or De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, and other purposes.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the information, and applicable legal requirements.

For Subscription and Credit transaction data, we retain records of purchases, renewals, cancellations, and Credit redemptions for at least seven (7) years to comply with accounting, tax, and legal requirements.

For affirmative consent records related to automatic renewal agreements, we retain verification of consent for at least three (3) years or one (1) year after the Subscription is terminated, whichever period is longer, in compliance with California's Automatic Renewal Law.

6. Data Security

We implement appropriate technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee the absolute security of your personal information.

7. International Data Transfers

Your personal information may be transferred to, stored, and processed in the United States or other countries outside your country of residence, where data protection laws may differ from those in your country. By using the Services, you consent to the transfer of your personal information to the United States and other countries. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy.

8. Your Rights and Choices

8.1 Account Information & Data Deletion

You may update, correct, or delete your account or personal information at any time by logging into your account or contacting us at legal@vibesandlogic.com. Please note that we may retain certain information where permitted or required by applicable law, including to comply with legal obligations, resolve disputes, enforce our agreements, or complete transactions that you have requested.

8.2 Marketing Communications

You may opt out of receiving marketing communications from us by following the unsubscribe instructions in our emails, replying "STOP" to SMS/text messages, adjusting your communication preferences in your account settings, or contacting us at legal@vibesandlogic.com.

8.3 Cookies

Most web browsers are set to accept cookies by default. You can usually adjust your browser settings to remove or reject cookies. Please note that removing or rejecting cookies may affect the functionality of the Services.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you may manage your cookie and tracking technology preferences through our consent management tool, which is presented when you first visit our websites and is accessible at any time via the cookie icon displayed on our websites or through the privacy settings in our mobile application. Non-essential cookies and tracking technologies will not be activated without your prior consent.

Regardless of your location, you may also opt out of interest-based advertising by visiting the following platforms' opt-out tools:

• Google: https://adssettings.google.com
• Meta: https://www.facebook.com/settings/?tab=ads
• TikTok: Privacy settings within the TikTok app
• X: https://twitter.com/settings/privacy_and_safety
• LinkedIn: https://www.linkedin.com/psettings/advertising

8.4 Location Information

You can prevent the collection of precise location information by disabling location services in your device settings.

8.5 Right to Opt Out of Selling or Sharing ("Do Not Sell or Share My Personal Information")

As described in Section 4.4, we transmit personal information (such as device identifiers, cookies, and usage data) to third-party advertising platforms for cross-context behavioral advertising. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.140(ah)), these disclosures may constitute "sharing" of personal information.

You have the right to opt out of such sharing. You may exercise this right by:

(a) Clicking the "Do Not Sell or Share My Personal Information" link available in the footer of our websites and in the settings of our mobile application;

(b) Enabling an opt-out preference signal, such as the Global Privacy Control ("GPC"), in your browser or device settings — we recognize and honor GPC signals as a valid opt-out request; or

(c) Contacting us at legal@vibesandlogic.com.

When you opt out, we will stop transmitting your personal information to the advertising platforms listed in Section 4.4 for cross-context behavioral advertising purposes. Please note that opting out does not prevent us from using your information for our own internal analytics or from sharing it with service providers who process data on our behalf and do not use it for their own advertising purposes.

9. California Privacy Rights

This section applies to California residents and supplements the information in this Privacy Policy.

9.1 California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to Know. You have the right to request that we disclose the categories of personal information we have collected about you, the categories of sources from which we collected the information, the business or commercial purposes for collecting, selling, or sharing the information, the categories of third parties to whom we disclosed the information, and the specific pieces of personal information we have collected about you.

Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.

Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.

Right to Opt-Out of Sale or Sharing. You have the right to opt out of the "sale" of your personal information and the "sharing" of your personal information for cross-context behavioral advertising purposes. We "share" your personal information (as defined under the CCPA/CPRA) with advertising platforms — including Google, Meta, TikTok, X, LinkedIn, and HubSpot — through the pixels, tags, and SDKs described in Section 4.4, as well as with artists, artist management teams, and third-party partners for targeted marketing purposes. You may opt out of such sharing by: (i) clicking the "Do Not Sell or Share My Personal Information" link on our websites or in our mobile application; (ii) enabling the Global Privacy Control ("GPC") signal in your browser or device — we recognize and honor GPC as a valid opt-out request; or (iii) contacting us at legal@vibesandlogic.com.

Right to Limit Use of Sensitive Personal Information. If we collect sensitive personal information for purposes other than those permitted under the CCPA/CPRA, you have the right to limit our use and disclosure of such information.

Right to Non-Discrimination. You have the right not to be discriminated against for exercising any of your CCPA/CPRA rights.

To exercise your rights, please submit a request by emailing us at legal@vibesandlogic.com or by writing to us at: Vibes and Logic, Inc., 1770 Post St. #244, San Francisco, CA 94115. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf by providing written authorization and verifying your identity.

9.2 Categories of Personal Information Collected, Disclosed, and Sold/Shared

In the preceding twelve (12) months, we have collected the following categories of personal information: identifiers; California Customer Records categories (Cal. Civ. Code § 1798.80(e)); protected classification characteristics; commercial information (including Subscription purchase history, Credit purchase and redemption records, transaction history, and payment information); internet or other electronic network activity information; geolocation data; audio, electronic, visual, or similar information (including User Content); inferences; and sensitive personal information (such as precise geolocation and account login credentials).

We have disclosed each of these categories of personal information to service providers for business purposes.

We have "sold" or "shared" (as those terms are defined under the CCPA/CPRA) the following categories of personal information:

(a) To advertising platforms (Google, Meta, TikTok, X, LinkedIn, and HubSpot) for cross-context behavioral advertising: identifiers (such as device identifiers, cookies, and advertising IDs); internet or other electronic network activity information (such as browsing history, pages viewed, and in-app events including app opens, installs, and purchases); and inferences (such as interest-based audience segments).

(b) To artists, artist management teams, and third-party partners for targeted marketing: identifiers; commercial information; internet or other electronic network activity information; and geolocation data.

9.3 California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please write to us at: Vibes and Logic, Inc., 1770 Post St. #244, San Francisco, CA 94115. Please include "California Privacy Rights Notice" in your request.

10. Nevada Privacy Rights

If you are a Nevada resident, you have the right to opt out of the sale of certain personal information to third parties who intend to license or sell that information. You can exercise this right by contacting us at legal@vibesandlogic.com with the subject line "Nevada Do Not Sell Request."

11. European Privacy Rights (GDPR / UK GDPR)

This section applies to individuals in the European Economic Area, the United Kingdom, and Switzerland ("European Users").

11.1 Legal Basis for Processing

We process your personal information on the following legal bases:

Contractual Necessity. We process personal information to perform our agreements with you and to provide you with the Services.

Legitimate Interests. We process personal information for our legitimate interests, including to provide, improve, and secure the Services, to market the Services, and to understand how users interact with the Services, provided that such interests are not overridden by your data protection rights.

Consent. We process certain personal information based on your consent, including: (i) the use of non-essential cookies, pixels, tracking tags, and SDKs (such as those used for advertising and analytics described in Section 2.4) on your device, as required by Article 5(3) of the ePrivacy Directive and UK PECR; (ii) marketing communications; and (iii) sharing your information with third parties for their marketing purposes. You may withdraw your consent at any time by contacting us or, for cookies and tracking technologies, by adjusting your preferences through our consent management tool.

Legal Obligation. We process personal information to comply with legal obligations.

11.2 Your Rights Under GDPR / UK GDPR

If you are a European User, you have the following rights:

Right of Access. You have the right to request confirmation of whether we process your personal information and to access that information.

Right to Rectification. You have the right to request correction of inaccurate or incomplete personal information.

Right to Erasure. You have the right to request deletion of your personal information in certain circumstances.

Right to Restriction. You have the right to request that we restrict the processing of your personal information in certain circumstances.

Right to Object. You have the right to object to our processing of your personal information for direct marketing purposes or based on our legitimate interests.

Right to Data Portability. You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that information to another controller.

Right to Withdraw Consent. Where we rely on your consent to process your personal information, you have the right to withdraw your consent at any time.

To exercise your rights, please contact us at legal@vibesandlogic.com. We may ask you to verify your identity before responding to your request.

11.3 Complaints

If you are a European User and have concerns about our processing of your personal information, you have the right to lodge a complaint with your local data protection authority. A list of EU data protection authorities is available at: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080. UK residents may contact the Information Commissioner's Office (ICO) at https://ico.org.uk/.

11.4 International Transfers

When we transfer personal information from the EEA, UK, or Switzerland to countries outside those regions, we rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner's Office.

12. AI-Specific Disclosures

12.1 Lumens

Our Services include an AI-powered chatbot that uses artificial intelligence and machine learning to process your inquiries and generate responses. Lumens is an automated system, and you are interacting with a machine rather than a human when you use this feature. We collect and process your Lumens interactions to provide the chatbot service, improve the quality and accuracy of responses, train and develop our AI models, and personalize your experience.

12.2 AI-Generated Visual Content

Our Services include AI-powered features that generate visual backgrounds and effects for music performances. This content is generated by artificial intelligence and does not necessarily represent real-world images, persons, places, or events.

12.3 Automated Decision-Making

We may use automated decision-making, including profiling, to personalize your experience, recommend content, and deliver targeted advertising. You have the right to object to automated decision-making that has legal or similarly significant effects on you.

13. Children's Privacy

Our Services are intended for users eighteen (18) years of age or older. We do not knowingly collect personal information from children under the age of thirteen (13). If you are under thirteen (13), please do not use the Services or provide any personal information. If we learn that we have collected personal information from a child under thirteen (13), we will take steps to delete that information promptly. If you believe that a child under thirteen (13) has provided personal information to us, please contact us at legal@vibesandlogic.com.

14. Do Not Track and Opt-Out Preference Signals

Our Services recognize and respond to the Global Privacy Control ("GPC") opt-out preference signal. When we detect a GPC signal from your browser, we treat it as a valid request to opt out of the "sale" or "sharing" of your personal information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. At this time, our Services do not respond to other "Do Not Track" browser signals.

15. Third-Party Links

The Services may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of such third parties. We encourage you to review the privacy policies of any third-party sites or services you visit.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this Privacy Policy and, where required by applicable law, provide additional notice. Your continued use of the Services after any changes to this Privacy Policy constitutes your acceptance of the updated Privacy Policy.

17. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Vibes & Logic, Inc.

1770 Post St. #244

San Francisco, California 94115

Email: legal@vibesandlogic.com

For EU/UK data protection matters, you may also contact us at legal@vibesandlogic.com with "EU/UK Data Protection" in the subject line.