Privacy Policy

Last updated 6 August 2026

Vibe Box is a crowd-powered video jukebox for venues. This policy explains what we collect, why, and who processes it. It covers vibebox.media and the venue owner, player and patron screens served from it.

Vibe Box is currently an invite-only pilot operated from South Africa. We handle personal information in line with the Protection of Personal Information Act (POPIA).

Who we are

Vibe Box is operated by the Vibe Box team. For any privacy question, correction or deletion request, contact hello@vibebox.media. We act as the responsible party for venue owner accounts, and process venue content on each owner’s behalf.

Venue owners

When a venue owner account is created, we hold:

• the owner’s full name and email address;
• a password, stored only as a salted hash by our authentication provider;
• sign-in timestamps and the audit trail of administrative actions on the account;
• organisation, venue, Vibe, sponsor and promotional content the owner creates;
• a YouTube Data API key, if the owner chooses to add one. It is encrypted at rest with a server-held key, is never sent to any browser, and is never written to logs or error messages. Owners can replace or remove it at any time.

We use this to operate the owner’s account, run their venue screens, send account email such as password resets, and keep a security audit trail.

Patrons

Patrons do not create accounts and we do not ask for their name, email or phone number. When someone scans a venue QR code and queues a song, we record the song request, any reaction or message they send to the screen, and housekeeping data needed to keep the queue fair and to stop abuse.

That housekeeping data includes a short-lived, venue-scoped browser identifier and a one-way hashed value derived from the request, used only for rate limiting and to confirm the request came from someone actually at the venue. We do not use it to build a profile of an individual, and it is not shared with the venue as identifiable information.

Cookies and similar storage

We use cookies and browser storage strictly to make the product work: keeping owners signed in, keeping a paired player screen paired, and remembering a patron’s current session at a venue. We do not run advertising or cross-site tracking cookies.

Service providers

Vibe Box runs on a small number of third parties, each with their own privacy terms:

• Vercel — application hosting and request logs.
• Supabase — database, realtime updates and authentication. Data is stored in the region chosen for the project, which may be outside South Africa.
• Resend — delivery of account email such as confirmations and password resets.
• YouTube / Google — video playback is embedded from YouTube, and search or playlist import uses the venue owner’s own YouTube Data API key. Google may set its own cookies when a video is played. Use of YouTube is subject to Google’s privacy policy and the YouTube Terms of Service.

Because some of these providers host data outside South Africa, personal information may be transferred across borders. We only use providers that offer appropriate contractual protection.

How long we keep things

• Owner account and venue content: for as long as the account is active, and for a short period afterwards so an account can be restored if closed by mistake.
• Security audit records: retained while the pilot runs, because they are how we investigate account and access problems.
• Patron queue and reaction activity: retained to power venue statistics; it is not linked to a named person.

Your rights

You can ask us what personal information we hold about you, ask for it to be corrected, or ask for it to be deleted. Email hello@vibebox.media and we will respond within a reasonable period. You also have the right to complain to the Information Regulator of South Africa.

Security

Access to venue data is restricted per tenant at the database level, administrative actions are audited, and secrets such as owner YouTube keys are encrypted and held server-side only. No system is perfect: if a breach affects your personal information, we will notify you and the regulator as required by law.

Children

Vibe Box is intended for venues and their adult patrons. We do not knowingly collect personal information from children.

Changes

If this policy changes materially we will update the date above and, for account holders, notify owners by email.

Questions about this page? Email hello@vibebox.media.