Terms of Service

Last updated: June 30, 2026

1. Acceptable use

You may only scan systems you own or are explicitly authorized to test. Unauthorized scanning of third-party websites may violate computer fraud laws in your jurisdiction. You are solely responsible for obtaining permission before scanning any URL you do not own.

2. No security guarantee

The service performs passive, deterministic security checks with optional AI-powered verification. A passing score does not guarantee your application is secure. False negatives are possible. The service is a diagnostic tool, not a security certification. Always conduct additional security review for production applications.

3. AI-generated content

Fix prompts generated by the service are AI-assisted and may contain errors, incomplete recommendations, or introduce new bugs. You are responsible for reviewing all AI-generated fix prompts before applying them to your code. The service is not liable for any damage caused by AI-generated fix instructions. Users who do not wish to use AI-generated prompts can use the deterministic template mode, which does not call any AI provider.

EU AI Act Transparency. In accordance with Regulation (EU) 2024/1689 (EU AI Act), we disclose that the service uses artificial intelligence systems provided by third parties (Anthropic, DeepSeek, OpenAI) to verify security findings and generate fix recommendations. AI outputs are advisory in nature and must be reviewed by a qualified person before application. The AI systems used are classified as limited-risk under the AI Act and are subject to transparency obligations only. You may opt out of AI processing at any time by using the deterministic template mode in the scanner settings.

4. Service availability

The service is provided on a best-effort basis. We reserve the right to modify or discontinue the free tier, rate limits, and features at any time. Paid tiers will include availability commitments.

5. Intellectual property

Scan results and fix prompts generated by the service are yours to use freely. The VibeShield name, logo, and branding are proprietary. The scanner rules (regex patterns) are open-source under the MIT license.

6. Limitation of liability

The service is provided “as is” without warranty of any kind. To the fullest extent permitted by law, we are not liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to security breaches, data loss, service interruptions, or financial losses arising from use of the service.

7. Payment, refunds, and right of withdrawal

Paid subscription plans are billed monthly via Stripe, Inc. All payments are processed securely through Stripe — the service does not store your payment card details. Subscriptions auto-renew each month unless cancelled. You may cancel your subscription at any time from the Stripe Customer Portal; cancellation takes effect at the end of the current billing period. Refunds for the current billing period are at our sole discretion. If you believe you were charged in error, contact us at support@vibeshield.org.

EU Right of Withdrawal. If you are a consumer residing in the European Union, you have the right to withdraw from a purchase within 14 calendar days without giving any reason, in accordance with Directive 2011/83/EU. The withdrawal period begins on the day the contract is concluded. To exercise this right, contact us at support@vibeshield.org with your order details. If you used the service during the withdrawal period (e.g., generated fix prompts), you will be charged proportionally for the services consumed up to the point of withdrawal.

8. Account termination

We reserve the right to suspend or terminate your account at any time for violation of these Terms, including unauthorized scanning of third-party systems, abuse of the service, or fraudulent activity. You may delete your account at any time. Upon termination, your scan results, fix prompts, and account data will be deleted from our active databases within 30 days.

9. Bring Your Own Key (BYOK)

When you provide your own API key (DeepSeek, OpenAI, or Anthropic) for fix prompt generation, your key is stored only in your browser's localStorage and is never transmitted to or stored on the service servers. You are solely responsible for all API usage charges incurred through your key, including any charges resulting from unauthorized access to your key. The service does not log, monitor, or have access to your BYOK credentials.

10. Third-party services

The service relies on third-party service providers to operate. These include: Supabase (database and authentication), Vercel and Railway (hosting), PostHog (product analytics — cookieless), Sentry (error monitoring), Upstash (rate limiting), Stripe (payment processing), and DeepSeek / OpenAI / Anthropic (optional AI-powered fix prompts). By using the service, you also agree to the applicable terms of these third-party services as they relate to your use of our platform.

11. Governing law, jurisdiction, and dispute resolution

These Terms are governed by the laws of the Republic of Lithuania, without regard to conflict of law principles. As a data controller established in the EU, we comply with the General Data Protection Regulation (GDPR) and applicable Lithuanian data protection laws.

Dispute Resolution — Arbitration. Any dispute, controversy, or claim arising out of or relating to these Terms, or the breach, termination, or invalidity thereof, shall be settled by arbitration in accordance with the Rules of the Vilnius Court of Commercial Arbitration (VCCA). The seat of arbitration shall be Vilnius, Lithuania. The language of the arbitration shall be English. The arbitral tribunal shall consist of one arbitrator. The award shall be final and binding on both parties. Either party may also seek injunctive relief in any court of competent jurisdiction. This arbitration clause does not limit your right to bring an individual claim in small claims court or to file a complaint with your local data protection authority.

Online Dispute Resolution. The European Commission provides an online dispute resolution platform at https://ec.europa.eu/consumers/odr. Consumers may use this platform to resolve disputes. We are not obligated and generally not willing to participate in dispute resolution proceedings before a consumer arbitration board.

12. Changes to these terms

We may update these Terms from time to time. Material changes will be communicated via email to registered users and/or by updating the date at the top of this page. Continued use of the service after changes take effect constitutes acceptance of the updated Terms. If you do not agree with the changes, you must stop using the service.

13. Data Processing Agreement (DPA)

When you use the service to scan code or URLs, you are the data controller and we act as a data processor under GDPR Article 28. This section constitutes the Data Processing Agreement between you (Controller) and the service operator (Processor).

a) Subject matter and duration. The Processor will process personal data contained in scan submissions (code snippets, file uploads, URLs) for the purpose of providing security scanning services. Processing duration equals the retention period stated in our Privacy Policy (1 year for scan results).

b) Nature and purpose. Automated and AI-assisted analysis of submitted content to detect security vulnerabilities, exposed credentials, and compliance gaps. Processing includes: parsing, regex pattern matching, AI-based verification, and fix prompt generation.

c) Types of personal data. Scan content may contain personal data embedded in code or configuration files (API keys, email addresses, database connection strings). The Processor does not intentionally collect this data and redacts detected secrets in evidence output.

d) Categories of data subjects.Users of the Controller's applications, end-users whose data may appear in scanned code or URLs.

e) Processor obligations.The Processor shall: (i) process personal data only on documented instructions from the Controller; (ii) ensure persons authorized to process have committed to confidentiality; (iii) implement appropriate technical and organizational security measures; (iv) assist the Controller in responding to data subject rights requests; (v) assist with data breach notification; (vi) delete or return all personal data at the Controller's choice upon termination; (vii) make available all information necessary to demonstrate compliance.

f) Sub-processors. The Processor uses the following sub-processors: Supabase (database, EU hosting), Vercel (frontend hosting), Railway (API hosting), PostHog (cookieless analytics), Sentry (error monitoring), and Stripe (payment processing). When AI features are used: Anthropic, DeepSeek, or OpenAI. The Controller authorizes these sub-processors. The Processor will inform the Controller of any intended changes to sub-processors.

g) Security measures. The Processor implements: encryption in transit (TLS), encryption at rest, rate limiting, input validation, parameterized database queries, automatic secret redaction in evidence, JWT-based authentication, security headers (CSP, HSTS, X-Frame-Options), and regular dependency updates. Detailed security information is available upon request.

14. Contact

For questions about these Terms, contact us at legal@vibeshield.org.