Privacy policy.
Last updated: 27 October 2026
This policy explains what personal data Vinculo collects when you use vinculo.art and app.vinculo.art, why we use it, who we share it with, how long we keep it and what your rights are.
1. Who is responsible for your data
Vinculo ("we", "us") is the controller of your personal data. For any question or request about your data, write to support@vinculo.art.
We apply this policy to everyone. Depending on where you live, the UK GDPR, the EU GDPR, US state privacy laws (such as the California Consumer Privacy Act) or Latin American laws (such as Brazil's LGPD) give you rights described in sections 8–10. Our Terms of service are governed by the law of England and Wales.
2. What data we collect
- Account (everyone)
- Name, email address, password (we store only a secure hash), role (client or designer), whether your email is confirmed, sign-up date, time zone (taken from your device and updated when your device's time zone changes, unless you turn this off in Settings), city (optional), interface language and profile photo (optional).
- Client profile
- Company name, country, a short description and tags.
- Sign-in with Google (clients only)
- Your name, email address, whether Google has confirmed it, and your Google account ID. We don't keep Google access tokens and never act in your Google account.
- Designer application
- Name, email, country, time zone, languages, specializations, years of experience, hourly rate, portfolio link, short bio, 2–3 work samples (files), the language you applied in, the status of the application and our decision.
- Designer profile
- Hourly rate, specializations, languages, availability, verification status, average reply time and Selected Work (titles, links, files).
- Billing details (clients)
- Legal company name, country, tax ID, street address, city, postal code and phone. We use them to issue invoices. We don't collect card or bank details.
- Projects
- Briefs (title, type of work, description, deliverables, scope, budget, dates, languages, time zone, notes), references, matches, hire requests (your message, payment scheme, backup designer), a designer's optional reason for declining, milestone deliveries and rejection reasons, project files, wallet balance, transactions and invoices (in US dollars; during the beta these amounts are notional) and your pool of designers.
- Reviews
- The outcome and optional text you leave about the other side of a project, and reviews about you.
- Notifications and emails
- In-app notifications about your events, your notification settings and a log of the emails we sent you (type, event and time, without the content).
- Files
- Everything you upload, with the original file name, type and size. We remove metadata such as camera details and location from profile photos. Other files are stored as uploaded, so remove location data from them first if you don't want to share it.
- Technical and security data
- Sessions (IP address, browser identifier and the time they were created and updated); counters that limit attempts to log in, sign up, reset a password and similar actions (IP address and a one-way hash of the email); server logs with IP addresses; a log of our administrators' actions (who did what on which record, without the values).
- Support
- If you write to support@vinculo.art, your email address and your message.
- Visit statistics
- See section 13.
3. Why we use your data and on what legal basis
- Create and run your account, sign you in and keep you signed in
- Contract: we need the data to provide the service you asked for.
- Review designer applications and verify designers
- Steps you asked us to take before a contract, and the contract itself.
- Match briefs with designers; hire requests, projects, milestones, reviews and your pool
- Contract.
- Billing details and invoices
- Contract.
- Service emails and in-app notifications
- Contract. Optional reminders: our legitimate interest in helping projects move on time; you can turn them off in Settings → Notifications.
- Security: attempt limits, protection against account takeover and abuse, server logs, backups
- Our legitimate interest in keeping Vinculo and your account safe.
- Support
- Contract, or our legitimate interest in answering you.
- Your interface language and cookie choice
- Our legitimate interest in showing Vinculo in your language and remembering your choice.
- Visit statistics
- Our legitimate interest in understanding how Vinculo is used (section 13).
Consent. We don't rely on consent for the processing above. The checkbox in our forms confirms your age and that you accept the Terms (section 14). If we ever ask for your consent, for example for analytics cookies, you can withdraw it at any time.
Matching is not AI. Vinculo ranks designers for a brief by fixed rules: type of work, rate, languages and delivery history. It only decides which designers are suggested. The client decides whom to hire, and designers are verified by a person. Matching has no legal or similarly significant effect on you.
We don't sell your data, don't use it for advertising and don't send marketing emails.
5. Transfers outside the UK and EU
Our server, database, files and backups are in Germany. Some providers are in the United States or other countries (section 4), and the Vinculo team may access the server remotely from outside the UK and EU. When data leaves the UK or the EU, we rely on the safeguards in the providers' standard terms: an adequacy decision (including the EU-US Data Privacy Framework and its UK Extension for certified companies) or the European Commission's Standard Contractual Clauses with the UK Addendum. Write to support@vinculo.art if you want details.
6. How long we keep data
- Account data
- Until you delete your account. Section 8 explains what deletion erases.
- Projects, milestones, transactions, invoices and reviews
- Kept after you delete your account as part of the other side's history, with your name shown as "Deleted user".
- Project files
- As long as the project is kept.
- Files not attached to a project (removed from a brief, unsaved photos)
- Deleted within about a day.
- Designer application drafts (work samples without a submitted application)
- 24 hours.
- Rejected designer applications and their work samples
- 12 months after the decision.
- Approved designer applications
- Kept with the designer account; anonymised when the account is deleted.
- Designer invite links
- Valid for 7 days.
- Sessions (IP address, browser identifier)
- Until you log out or the session ends: up to 30 days with "Remember me" or Google sign-in, otherwise 1 day.
- Email confirmation and password reset links
- 24 hours and 1 hour.
- In-app notifications and the email log
- 90 days.
- Attempt counters
- 1 day.
- Internal alerts
- 30 days.
- Admin activity log
- 12 months.
- Server logs
- Web server logs: 14 days. Application logs are limited in size and overwritten as new entries arrive.
- Backups of the database and files
- 7 days, so deleted data leaves the backups within 7 days.
- Support emails
- As long as we need them to handle your request.
7. How we protect your data
- All connections use HTTPS.
- Passwords are stored only as secure hashes. Password reset links work once, for 1 hour, and are stored only as hashes. Changing or resetting your password logs you out of other devices.
- Limits on login, sign-up, password reset and upload attempts protect against password guessing and abuse.
- Every request checks that you are allowed to see the data. Other users' records look the same as records that don't exist.
- Files are private. We serve them through links that expire after 15 minutes and check access on every request. File types are checked by content.
- Billing details are never written to logs. Internal alerts contain no emails, names or IP addresses.
- The database and files are backed up daily, and the server is monitored.
No system is completely secure. If a data breach affects you, we will tell you as the law requires.
8. Your rights
Under the UK GDPR and the EU GDPR you can access your data and get a copy, correct it, delete it, restrict its processing, receive the data you gave us in a portable format, object to processing based on our legitimate interest, and withdraw consent where we rely on it.
What you can do yourself:
- Correct: edit your profile in Settings; clients edit billing details in Settings → Billing.
- Delete: Settings → Delete account. Deletion erases your name, email, photo, password, sessions, notifications, settings, pool, billing details, designer application details and portfolio. It isn't possible while you have active projects, open hire requests (designers) or a balance (clients): finish them or write to support first. If you signed up with Google only, set a password first with "Forgot password?".
- Notifications: choose in-app notifications and turn off email reminders in Settings → Notifications.
- Cookies: change your choice in our Cookie policy.
Everything else, including a copy of your data or an objection: write to support@vinculo.art from the email linked to your account. We may ask you to confirm it's you. We answer within one month; for complex requests we may extend this by up to two more months and will tell you why. A copy of your data is sent by email in a common file format.
Complaints. You can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in your EU country. We'd appreciate the chance to answer your concern first.
9. US residents
If you live in a US state with a consumer privacy law (for example, California, Colorado, Connecticut, Virginia or Utah), you have the right to know what personal information we collect, use and disclose (sections 2–4), to access it, to correct it, to delete it and to get a portable copy.
We collect identifiers (name, email, IP address), professional information (designer profiles), commercial information (projects and notional transactions), internet activity (server logs) and approximate location (country from the IP address, and the city if you add one), for the purposes in section 3.
We don't sell your personal information, don't share it for cross-context behavioral advertising and don't use sensitive personal information beyond what the service needs. You can make a request yourself or through an authorized agent at support@vinculo.art. We won't treat you differently for using your rights. If we decline a request, you can appeal by replying to our answer.
10. Residents of Brazil and other Latin American countries
If you live in Brazil, the LGPD gives you the right to confirm that we process your data; to access it; to correct incomplete, inaccurate or outdated data; to have unnecessary or excessive data anonymised, blocked or deleted; to data portability; to know whom we share data with; and to withdraw consent where we rely on it. You can also complain to the ANPD (gov.br/anpd).
Similar rights exist in other Latin American countries, such as Argentina, Chile, Colombia, Mexico and Peru. The process is the same: write to support@vinculo.art. We answer within one month, or sooner where your local law requires it, for example within 15 days for a full access request under the LGPD.
11. Age: 18+
Vinculo is only for people aged 18 or over. When you create an account, apply as a designer or activate an invite, you confirm that you are 18 or older. If we learn that a user is under 18, we delete the account. If you believe a minor has given us personal data, write to support@vinculo.art.
13. Visit statistics
We count visits on our own server, without cookies or third-party trackers. When a page opens, your browser tells our server which page was viewed. We use your IP address only at that moment: to find your country in the DB-IP Lite database stored on our server, and to compute an anonymous daily identifier from your IP address, your browser identifier and a random value that changes every day.
The visit counter doesn't store your IP address. Daily identifiers and the random value are deleted after one day; we keep only daily totals by country and by page. The admin area and automated traffic aren't counted.
Legal basis: our legitimate interest in understanding how Vinculo is used. Country data: DB-IP Lite (db-ip.com), CC BY 4.0.
14. Consent
Our forms ask you to tick "I'm 18 or older and agree to the Terms and Privacy Policy" when you create a client account, apply as a designer or activate a designer invite. If you continue with Google, you give the same confirmation by continuing.
By ticking the box, you confirm your age, accept our Terms of service and confirm that you have read this policy. The legal basis for processing your account data stays the contract (section 3). We keep the time you created your account, sent your application or activated your invite; the documents that apply are the versions dated at that moment.
15. Changes to this policy
We may update this policy. The date at the top shows the latest version. We'll tell you about important changes by email at least 14 days before they take effect.
16. Contact
Privacy questions and requests: support@vinculo.art. Write from the email linked to your Vinculo account so we can find your data.