Privacy statement
Last updated:
Short version
We collect as little as possible. No analytics, no ad trackers, no third-party fonts. We set one cookie, only when you sign in.
Who is responsible
Vigilo [PLACEHOLDER: legal form, KvK, address] is the controller for data on this site and for account data. For data in scanned pages we act as processor for customers where applicable [PLACEHOLDER: DPA for Agency plan].
What we process and why
| What | Data | Basis | Kept |
|---|---|---|---|
| Free scan | Domain scanned, scan results, IP address (hashed, for rate limiting) | Legitimate interest (abuse prevention) | Hashed IP deleted within 24 hours; results 30 days |
| Email for results | Email, optional company, whether you agreed to follow-up emails, and the consent wording and time | Your request (results); consent (follow-ups) | 12 months, then deleted unless you became a customer. If you unsubscribe, we delete your details at once. |
| Customers | Name, company, billing email, VAT ID, invoicing address; per order: site, contact name and email, your notes and platform; sites, scans, reports, alert recipients you add (their email addresses); agency branding (name, logo, colour) | Contract; tax law | Account data until you delete your account. On deletion we anonymise order records: we keep invoice data and amounts for 7 years because Dutch tax law requires it, and remove your contact details, notes and report contents. |
| Your marketing preference | Whether you opted in to product emails in your account, with the wording and time | Consent | Until you switch it off or delete your account |
| Emails we send | Recipient, subject and content of each email (sign-in links are removed from the stored copy) | Contract; legitimate interest (proof of delivery) | 30 days |
| Technical event log | Account, order or scan IDs and the type of event (for example “report delivered”) | Legitimate interest (security, debugging) | [PLACEHOLDER: retention period] |
| Sign-in | Session cookie vg_session (strictly necessary) | Contract | 30 days |
| Contact by email | Your message | Legitimate interest | 12 months |
Cookies and local storage
We set one cookie, vg_session, only after you sign in. It is HttpOnly, Secure and SameSite=Lax and keeps you signed in for up to 30 days. Because it is strictly necessary, we don’t show a cookie banner.
Two small preferences are stored in your browser’s local storage and never sent to us: your theme (vigilo-theme, light or dark) and a flag that you are signed in (vigilo-signed-in), so pages know whether to load your account menu. Both are strictly functional, so they don’t need consent. You can clear them in your browser at any time.
Processors
- Cloudflare (hosting, database, email routing) [PLACEHOLDER: region/DPA]
- Mollie B.V., the Netherlands (payments)
- Apify Technologies s.r.o., Czech Republic (deep audits on Apify’s cloud infrastructure; receives scanned URLs only) [PLACEHOLDER: hosting region/DPA]
- Scaleway (transactional email, EU) [PLACEHOLDER: confirm provider + DPA]
International transfers
[PLACEHOLDER: Cloudflare and Apify transfer mechanisms (EU-US DPF / SCCs)]
Your rights
You can ask for access, correction, deletion, restriction, objection and portability, and withdraw consent for follow-up emails at any time (every tip email has an unsubscribe link). Email privacy@vigiloweb.com; we reply within one month. You can also complain to the Autoriteit Persoonsgegevens.
What we don’t do
No profiling, no selling data, no tracking pixels in emails (we don’t use open tracking or link tracking).