1. Who this notice covers
This notice applies to visitors to Vigil’s website and people whose organization provides access to the Vigil service. When an employer or customer assigns training, that organization generally controls the learner data and Vigil processes it to provide the service. Your organization’s own privacy policies may also apply.
2. Information we process
Workspace and account information
We may process organization name, workspace identifiers, team membership, work email address, display name, user identifiers, administrator settings, and authentication or installation metadata.
Training and compliance records
Vigil records assignments, lesson versions, attempts, answers, scores, completion timestamps, reminders, acknowledgements, and evidence-sync status. Administrators can use these records to operate training programs and demonstrate completion.
Integration information
When enabled by an administrator, Vigil processes Slack installation credentials, Vanta or Drata configuration, and customer-provided AI credentials. Sensitive credentials are encrypted before storage and are not displayed again after submission.
Billing and technical information
Paddle processes checkout and payment details. Vigil receives subscription identifiers, status, licensed-seat quantities, customer identifiers, and billing-event metadata. We may also collect service logs, browser and device information, IP address, error reports, and security events needed to operate and protect the service.
3. How we use information
- Deliver lessons, assessments, reminders, reporting, and certificates.
- Authenticate installations and operate Slack interactions.
- Send customer-directed evidence to Vanta or Drata.
- Provide optional AI-assisted content features using the provider selected by the customer.
- Administer subscriptions, prevent fraud, troubleshoot failures, and secure the service.
- Comply with applicable legal obligations and enforce our agreements.
We do not sell personal information or use learner answers for third-party advertising.
4. AI and BYOK processing
AI features are optional. When a customer enables them, prompts and selected content are sent to the customer-selected provider under that provider’s terms and the customer’s account. Customers should not submit secrets, unnecessary personal information, protected health information, or regulated data unless their policies and provider agreement expressly permit it.
5. How information is shared
We share information only as needed with service providers operating Vigil, including infrastructure, communication, billing, monitoring, and support providers. At a customer’s direction, data may be exchanged with Slack, Paddle, Vanta, Drata, and a selected AI provider. We may also disclose information when legally required, to protect rights and safety, or as part of a business transaction subject to appropriate safeguards.
6. Retention and deletion
We retain customer and training records for the subscription term and any documented retention period selected by the customer or required for security, billing, dispute resolution, or law. Administrators may request export or deletion of customer-controlled data. Backup copies are removed on their ordinary lifecycle unless preservation is legally required.
7. Security and international processing
Vigil uses technical and organizational safeguards described on our Security page. Information may be processed in countries other than where a learner lives. When required, Vigil and its providers use recognized contractual or legal transfer safeguards.
8. Your choices and rights
Depending on location, individuals may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information. Learners should ordinarily submit employment-related requests to their organization first. Vigil will assist customers with verified requests as required by contract and law.
9. Children and changes
Vigil is a workplace service and is not directed to children. We may update this notice as the product or legal requirements change. Material updates will be identified by a new revision date and, when appropriate, communicated to customers.
10. Contact
Privacy inquiries and verified data requests can be submitted through your Vigil account representative. A dedicated privacy contact address will be published before commercial launch.