1. Who this notice covers
This notice applies to visitors to Vigil’s website and people whose organization provides access to the Vigil service. When an employer or customer assigns training, that organization generally controls the learner data and Vigil processes it to provide the service. Your organization’s own privacy policies may also apply.
2. Information we process
Workspace and account information
We may process organization name, workspace identifiers, team membership, work email address, display name, user identifiers, administrator settings, and authentication or installation metadata. When a platform user chooses Google sign-in, Vigil receives the verified email address, display name, and stable Google account identifier needed to create or authenticate the account. Vigil does not receive the user’s Google password.
Training and compliance records
Vigil records assignments, lesson versions, attempts, answers, scores, completion timestamps, reminders, acknowledgements, and evidence-sync status. Administrators can use these records to operate training programs and demonstrate completion.
Integration information
When enabled by an administrator, Vigil processes Slack installation credentials, Vanta or Drata configuration, and customer-provided AI credentials. Sensitive credentials are encrypted before storage and are not displayed again after submission.
What we do not access
Vigil does not read Slack message content or channel history beyond the specific interaction needed to deliver an assignment and record a response. Vigil does not access shared files, documents, or attachments in your workspace, and does not access data from Google Drive, Gmail, CRM systems, financial platforms, or other business systems your organization uses. Customer-enabled Vanta and Drata integrations receive training evidence from Vigil; Vigil does not ingest their broader business data.
Billing, analytics, and technical information
Paddle processes checkout and payment details. Vigil receives subscription identifiers, status, licensed-seat quantities, customer identifiers, and billing-event metadata. We use Google Analytics only on our public marketing and legal pages to understand website usage and may collect page views without query strings, browser and device information, approximate location derived from IP address, and interaction data. Google Analytics does not load on login, invitation, learner, or authenticated application routes. We may also collect first-party service logs, IP address, error reports, and security events needed to operate and protect the service.
3. How we use information
- Deliver lessons, assessments, reminders, reporting, and certificates.
- Authenticate installations and operate Slack interactions.
- Send customer-directed evidence to Vanta or Drata.
- Provide optional AI-assisted content features using the provider selected by the customer.
- Administer subscriptions, prevent fraud, troubleshoot failures, and secure the service.
- Comply with applicable legal obligations and enforce our agreements.
We do not sell, rent, or otherwise make personal information available to third parties for their own purposes, and we do not use learner answers for advertising.
4. AI and BYOK processing
AI features are optional. When a customer enables them, an administrator may send a lesson brief, approved policy excerpt, and selected lesson content to the chosen OpenAI or Anthropic account. For program-gap summaries, Vigil sends only aggregate concept counts and miss rates after at least five learners have answered a concept; individual learner identities, answers, and scores are not sent. Vigil stores provider, model, action, status, and token-usage metadata without retaining abandoned prompts or generated drafts. Saved lessons follow normal lesson-version retention. Provider API charges and provider-side retention follow the customer’s provider account and agreement. Customers should not submit secrets, unnecessary personal information, protected health information, or regulated data unless their policies and provider agreement expressly permit it.
5. How information is shared
We share information only as needed with service providers operating Vigil, including infrastructure, communication, authentication, analytics, and support providers. Contact-form details are processed by Formspree so inquiries can be delivered and managed. Google processes authentication requests when a platform user chooses Google sign-in, and public website usage data may be processed by Google Analytics.
Paddle acts as merchant of record for purchases made through Paddle checkout and processes buyer and payment information under its own terms. At a customer’s direction, training evidence may be sent to Vanta or Drata, and prompts may be sent to the AI provider selected and configured by the customer. Slack separately processes workspace data under the customer’s relationship with Slack. See our Subprocessors page for current provider, purpose, data-category, and location information.
We may also disclose information when legally required, to protect rights and safety, or as part of a business transaction subject to appropriate safeguards.
6. Retention and deletion
We retain account, workspace, and training records while the customer account is active and afterward only as needed for requested export, security, billing, dispute resolution, legal obligations, or an agreed retention period. Administrators may request export or deletion of customer-controlled data by emailing support@vigilsecurity.app. Deletion requests are verified before processing. Residual copies in backups and security logs are removed through their ordinary lifecycle unless continued preservation is legally required.
7. Security, processing locations, and transfers
Vigil uses technical and organizational safeguards described on our Security page. The service runs on Cloudflare infrastructure, and information may be processed in countries other than where a learner lives. Vigil does not currently offer a contractual data-residency commitment. When required, Vigil and its providers rely on recognized contractual or legal transfer safeguards.
8. Your choices and rights
Depending on location, individuals may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information. Learners should ordinarily submit employment-related requests to their organization first. Vigil will assist customers with verified requests as required by contract and law.
9. Children and changes
Vigil is a workplace service and is not directed to children. We may update this notice as the product or legal requirements change. Material updates will be identified by a new revision date and, when appropriate, communicated to customers.
10. Contact
Privacy inquiries and verified data requests can be sent to support@vigilsecurity.app or submitted through our contact form. Select “Privacy request” so the message can be routed appropriately.