An Arabic translation is available for convenience; the English version governs.
Privacy Policy
What data Vigil collects about you and why — in plain language.
Last updated: {{LAST_UPDATED}} · Version: draft
Who this covers
This policy explains what personal data {{LEGAL_ENTITY}} ("Vigil", "we") collects about you through our website and console, and how we use it. It does not cover the camera footage or evidence stored on your own premises — you control that data; how Vigil processes it on your behalf is set out in our Data Processing Agreement.
What we collect and why
When you contact us through the website we collect the name, business, phone number and message you submit, to respond to your enquiry. When you send a message from the console we store its category and text to provide support. We use a strictly-necessary session cookie to keep you logged in, and store your language preference in your browser. Our software sends us operational telemetry — aggregate counts and health only (for example, how many cameras are online) — to run the service.
What we do not collect
We (the company) do not receive your camera footage or stored evidence — they stay on your premises. If you switch on the optional face-recognition feature, Vigil creates and stores biometric face data on your own box, with your consent and under your control (this is covered by the Data Processing Agreement); that biometric data is not sent to us and there is no central identity database. The only way our staff can see inside your console is by using an impersonation tool that is recorded in an audit log.
Our lawful basis
We rely on {{LAWFUL_BASIS}} (for example, taking steps at your request and our legitimate interest in operating and securing the service). Where {{APPLICABLE_LAW}} requires consent for a specific use, we ask for it.
How long we keep it
We keep enquiry and support messages for {{RETENTION_PERIOD}}, then delete them. Evidence on your premises is deleted automatically on your plan's schedule (Home after 5 days, Business after 15, Large sites after 30), which you can adjust.
Who we share with
We do not sell your data. We use {{HOSTING_PROVIDER}} to host our website. If you turn on AI scene descriptions, a single still image per incident is sent to our AI provider (Groq) to write the description — see the DPA. Your alert photos go through a Telegram bot that you create and control, not through us.
International transfers
Some providers (such as our AI provider) may process data outside {{YOUR_REGION}}. Where that happens we rely on {{TRANSFER_MECHANISM}}.
Your rights
Subject to {{APPLICABLE_LAW}}, you may request access to, correction or deletion of, or object to our use of your personal data. Contact {{CONTACT_EMAIL}} and we will respond within {{RESPONSE_WINDOW}}.
How we protect it
Console access is protected by a PIN that is hashed at rest; each business's data is isolated from every other; sessions use secure, http-only cookies; and evidence is stored per-business on your own box.
Changes & contact
We may update this policy; material changes will be posted here. Questions: {{CONTACT_EMAIL}}, {{LEGAL_ENTITY}}, {{ADDRESS}}.